Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security //

Law

// // //
8/22/2018
08:05 AM
Larry Loeb
Larry Loeb
Larry Loeb

Microsoft Yanks Suspected Russian-Intelligence Domains

Microsoft has pulled the plug on domains it suspected as fronts for Russian Intelligence. The company says the targets were US conservative groups.

Microsoft, riding the latest wave of security theatre, has announced that it has shut down some domains that it asserts were set up by the Strontium group (a confederate of the Russian GRU) so that it could conduct phishing operations.

The domains included close similarities to conservative think tanks, as well as US Senate operations. The pulled domains are my-iri.org, hudsonorg-my-sharepoint.com, senate.group, adfs-senate.services, adfs-senate.email and office365-onedrive.com.

In the announcement, Microsoft said that the Digital Crimes Unit (DCU) carried out a court order to enable this domain transfer and noted that they have used this approach 12 times in the last two years to shut down 84 fake websites associated with this group.

They also say a special master appointed by a federal judge concluded in the recent court order obtained by DCU, saying that there is "good cause" to believe that Strontium is "likely to continue" its conduct. No active phishing attacks were associated with the removed domains.

Nikita Karimov via Unsplash
Nikita Karimov via Unsplash

This action raises a meta-question: Why is Microsoft taking actions affecting national security that involve a court? Is this not something that some governmental entity like the FBI should be involved in rather than a private business?

MSFT has already announced its "Defending Democracy Program" with some fanfare in April. It paints itself as a concerned participant looking to "bring people and expertise together from across governments, political parties, campaigns and the tech sector. While cybersecurity starts with Microsoft and other companies in the tech sector, it's ultimately a shared responsibility with customers and governments around the world."

They seem to want their influence felt around the world. All of it.

Microsoft has a checkered history regarding individual rights. It has long been suspected of having backdoors in its products that could be exploited by authorities. This seeming change to an altruistic view of the political process may leave some unconvinced about Microsoft's true motivation.

But many of the leading tech companies (like Amazon, Apple, Facebook, Microsoft and Twitter) did have a meeting in April with intelligence community representatives about what tech companies could be doing to counter election manipulation. So, it's not just Microsoft involved in this effort.

It is not inconceivable that this latest Microsoft action was done at the behest of the intelligence community, using Microsoft as a cover.

But Microsoft has its own private agenda. The AccountGuard service that it has established as part of the Defending Democracy program will only work with Office 365 users, for example.

They say the AccountGuard service "provides best practices and guidance, and may provide notification of a nation state attack. This service does not make a participant 'hack-proof' -- it is the customer's responsibility to manage security."

Giving service to its users is what any company should do. Yet making pre-emptive judgments about national security situations is beyond its rightful sphere. In this case, the outcome may be beneficial, though normalizing a company's dealing with common threats is a dangerous precedent that may not work out so well the next time it happens.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-31081
PUBLISHED: 2022-06-27
HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on ...
CVE-2022-31082
PUBLISHED: 2022-06-27
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. glpi-inventory-plugin is a plugin for GLPI to handle inventory management. In affected versions a SQL injection can be made using package deployment tasks. Thi...
CVE-2022-31084
PUBLISHED: 2022-06-27
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to co...
CVE-2022-31085
PUBLISHED: 2022-06-27
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled b...
CVE-2022-31086
PUBLISHED: 2022-06-27
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if th...