Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security //

Law

8/22/2018
08:05 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Microsoft Yanks Suspected Russian-Intelligence Domains

Microsoft has pulled the plug on domains it suspected as fronts for Russian Intelligence. The company says the targets were US conservative groups.

Microsoft, riding the latest wave of security theatre, has announced that it has shut down some domains that it asserts were set up by the Strontium group (a confederate of the Russian GRU) so that it could conduct phishing operations.

The domains included close similarities to conservative think tanks, as well as US Senate operations. The pulled domains are my-iri.org, hudsonorg-my-sharepoint.com, senate.group, adfs-senate.services, adfs-senate.email and office365-onedrive.com.

In the announcement, Microsoft said that the Digital Crimes Unit (DCU) carried out a court order to enable this domain transfer and noted that they have used this approach 12 times in the last two years to shut down 84 fake websites associated with this group.

They also say a special master appointed by a federal judge concluded in the recent court order obtained by DCU, saying that there is "good cause" to believe that Strontium is "likely to continue" its conduct. No active phishing attacks were associated with the removed domains.

This action raises a meta-question: Why is Microsoft taking actions affecting national security that involve a court? Is this not something that some governmental entity like the FBI should be involved in rather than a private business?

MSFT has already announced its "Defending Democracy Program" with some fanfare in April. It paints itself as a concerned participant looking to "bring people and expertise together from across governments, political parties, campaigns and the tech sector. While cybersecurity starts with Microsoft and other companies in the tech sector, it's ultimately a shared responsibility with customers and governments around the world."

They seem to want their influence felt around the world. All of it.

Microsoft has a checkered history regarding individual rights. It has long been suspected of having backdoors in its products that could be exploited by authorities. This seeming change to an altruistic view of the political process may leave some unconvinced about Microsoft's true motivation.

But many of the leading tech companies (like Amazon, Apple, Facebook, Microsoft and Twitter) did have a meeting in April with intelligence community representatives about what tech companies could be doing to counter election manipulation. So, it's not just Microsoft involved in this effort.

It is not inconceivable that this latest Microsoft action was done at the behest of the intelligence community, using Microsoft as a cover.

But Microsoft has its own private agenda. The AccountGuard service that it has established as part of the Defending Democracy program will only work with Office 365 users, for example.

They say the AccountGuard service "provides best practices and guidance, and may provide notification of a nation state attack. This service does not make a participant 'hack-proof' -- it is the customer's responsibility to manage security."

Giving service to its users is what any company should do. Yet making pre-emptive judgments about national security situations is beyond its rightful sphere. In this case, the outcome may be beneficial, though normalizing a company's dealing with common threats is a dangerous precedent that may not work out so well the next time it happens.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4719
PUBLISHED: 2020-09-24
The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request.
CVE-2020-15604
PUBLISHED: 2020-09-24
An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one. CW...
CVE-2020-24560
PUBLISHED: 2020-09-24
An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one. CW...
CVE-2020-25596
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The SYSENTER instruction leaves various state sanitization activities to software. One of Xen's sanitization paths injects a #GP fault, and incorrectly delivers it twice to the guest. T...
CVE-2020-25597
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. There is mishandling of the constraint that once-valid event channels may not turn invalid. Logic in the handling of event channel operations in Xen assumes that an event channel, once valid, will not become invalid over the life time of a guest. Howeve...