This week's security news: China's Microsoft cloud email breach may expose deeper problems

The cyberattack that compromised tens of thousands of servers Microsoft Exchange worldwide in March was one of the largest security incidents of the year. The hackers, believed to be linked to the Chinese government, exploited four previously unknown vulnerabilities in popular email software to gain access to sensitive data and install malware on affected systems.

While Microsoft quickly released patches to correct the flaws, many organizations were slow to apply them or were not aware of the urgency. As a result, attackers had an opportunity to compromise as many servers as they could before being detected. By some estimates, more than 60.000 organizations in the United States alone were affected by the breach, including small businesses, local governments, schools, and nonprofits.

The impact of the breach is still unfolding, as security researchers and law enforcement agencies attempt to assess the extent of the damage and identify the victims. Some of the compromised servers may still host malicious web shells that allow hackers to maintain remote access and execute commands. Additionally, stolen data can be used for other attacks, such as phishing, identity theft, or espionage.

The breach also raises questions about the security and reliability of cloud-based services, especially those provided by Microsoft, which dominates the enterprise software market.

While Microsoft has claimed that its cloud-based version of Exchange was not affected by the attack, some experts have argued that the company's complex, interconnected cloud infrastructure may pose hidden risks and vulnerabilities that are not well understood or disclosed.

For example, some researchers have suggested that hackers may have used a technique called "cross-cloud compromise" to leverage their access to Exchange servers and gain access to other Microsoft cloud services, such as Azure or Office 365. This could potentially exposing more data and systems to attackers, as well as making their presence more difficult to detect and eliminate.

Another concern is that Microsoft had been aware of the vulnerabilities in Exchange for months before disclosing them publicly and releasing patches. According to a report by The Wall Street Journal, Microsoft was notified of the flaws by a Taiwanese security company called Devcore in January, but did not act on them until March, when it learned that they were being actively exploited by hackers.

This delay may have given the attackers more time to prepare and launch their campaign, as well as increasing the chances of other threat actors discovering and exploiting the same vulnerabilities. It also raises questions about Microsoft's vulnerability disclosure policy and its responsibility to inform and protect its customers.

The breach of Microsoft Exchange servers is a reminder that cloud-based services are not immune to cyberattacks and that organizations must take proactive measures to protect their data and systems.

This includes quickly applying patches, monitoring network activity, implementing backup and recovery plans, and educating users about cyber hygiene. It also means demanding more transparency and accountability from cloud providers, like Microsoft, about their security practices and policies.

If you are interested in the latest developments in civil rights, cybersecurity, and surveillance, you may want to read this blog post. It covers three important stories that have emerged recently and explains why they are important to our society.

The first story is about a landmark class action lawsuit settlement against the New York Police Department (NYPD) for its violent and unlawful treatment of protesters in 2020. The NYPD was accused of using excessive force, making false arrests, and violating the constitutional law. rights of thousands of people who took to the streets after the murder of George Floyd at the hands of a Minneapolis police officer. The lawsuit was supported by a powerful tool that analyzed massive amounts of video evidence from various sources, such as police body cameras, helicopters and social media.

The tool, created by SITU Research, a design agency specializing in civil liberties issues, was able to identify patterns and trends in police behavior and provide concrete evidence of systemic abuses. The settlement, amounting to more than $13 million for 1.380 plaintiffs, is one of the largest in U.S. history for a protest-related case.

The second story is about a new research paper that exposes the alarming vulnerabilities of orbiting satellites. The paper, written by researchers at the University of Bochum in Germany, reveals that three different satellite models have multiple critical flaws that could allow hackers to take control of them, disrupt their operations, or even crash them into other satellites or the Earth. .

Researchers tested the satellites using publicly available information and tools and found that they lacked basic security measures such as encryption, authentication and integrity checks. The document highlights the urgent need to improve the cybersecurity of satellites, which are essential for many aspects of our modern lives, such as communications, navigation, weather forecasting and military intelligence.

The third story is about a bipartisan bill that aims to prevent U.S. law enforcement and intelligence agencies from purchasing Americans' personal data from third-party intermediaries without a court order. The bill, called the Fourth Amendment Not for Sale Act, was introduced by Senators Ron Wyden and Rand Paul, known for their strong opposition to surveillance overreach.

The bill would close a loophole that allows federal agencies to bypass Fourth Amendment protections by purchasing data from companies that collect it from various sources, such as apps, websites or devices. The bill would also prohibit agencies from purchasing data obtained illegally or without consent from foreign governments or hackers. The bill has garnered support from both Democrats and Republicans, as well as civil liberties groups and technology companies.