Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security //

Law

8/22/2018
08:05 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Microsoft Yanks Suspected Russian-Intelligence Domains

Microsoft has pulled the plug on domains it suspected as fronts for Russian Intelligence. The company says the targets were US conservative groups.

Microsoft, riding the latest wave of security theatre, has announced that it has shut down some domains that it asserts were set up by the Strontium group (a confederate of the Russian GRU) so that it could conduct phishing operations.

The domains included close similarities to conservative think tanks, as well as US Senate operations. The pulled domains are my-iri.org, hudsonorg-my-sharepoint.com, senate.group, adfs-senate.services, adfs-senate.email and office365-onedrive.com.

In the announcement, Microsoft said that the Digital Crimes Unit (DCU) carried out a court order to enable this domain transfer and noted that they have used this approach 12 times in the last two years to shut down 84 fake websites associated with this group.

They also say a special master appointed by a federal judge concluded in the recent court order obtained by DCU, saying that there is "good cause" to believe that Strontium is "likely to continue" its conduct. No active phishing attacks were associated with the removed domains.

This action raises a meta-question: Why is Microsoft taking actions affecting national security that involve a court? Is this not something that some governmental entity like the FBI should be involved in rather than a private business?

MSFT has already announced its "Defending Democracy Program" with some fanfare in April. It paints itself as a concerned participant looking to "bring people and expertise together from across governments, political parties, campaigns and the tech sector. While cybersecurity starts with Microsoft and other companies in the tech sector, it's ultimately a shared responsibility with customers and governments around the world."

They seem to want their influence felt around the world. All of it.

Microsoft has a checkered history regarding individual rights. It has long been suspected of having backdoors in its products that could be exploited by authorities. This seeming change to an altruistic view of the political process may leave some unconvinced about Microsoft's true motivation.

But many of the leading tech companies (like Amazon, Apple, Facebook, Microsoft and Twitter) did have a meeting in April with intelligence community representatives about what tech companies could be doing to counter election manipulation. So, it's not just Microsoft involved in this effort.

It is not inconceivable that this latest Microsoft action was done at the behest of the intelligence community, using Microsoft as a cover.

But Microsoft has its own private agenda. The AccountGuard service that it has established as part of the Defending Democracy program will only work with Office 365 users, for example.

They say the AccountGuard service "provides best practices and guidance, and may provide notification of a nation state attack. This service does not make a participant 'hack-proof' -- it is the customer's responsibility to manage security."

Giving service to its users is what any company should do. Yet making pre-emptive judgments about national security situations is beyond its rightful sphere. In this case, the outcome may be beneficial, though normalizing a company's dealing with common threats is a dangerous precedent that may not work out so well the next time it happens.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Exploiting Google Cloud Platform With Ease
Dark Reading Staff 8/6/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: They said you could use Zoom anywhere.......
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13285
PUBLISHED: 2020-08-13
For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting vulnerability exists in the issue reference number tooltip.
CVE-2020-16087
PUBLISHED: 2020-08-13
An issue was discovered in Zalo.exe in VNG Zalo Desktop 19.8.1.0. An attacker can run arbitrary commands on a remote Windows machine running the Zalo client by sending the user of the device a crafted file.
CVE-2020-17463
PUBLISHED: 2020-08-13
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
CVE-2019-16374
PUBLISHED: 2020-08-13
Pega Platform 8.2.1 allows LDAP injection because a username can contain a * character and can be of unlimited length. An attacker can specify four characters of a username, followed by the * character, to bypass access control.
CVE-2020-13280
PUBLISHED: 2020-08-13
For GitLab before 13.0.12, 13.1.6, 13.2.3 a memory exhaustion flaw exists due to excessive logging of an invite email error message.