US calls Microsoft ‘a waterfall of errors’ for Chinese hack

A scathing US government report found that the intrusion into Microsoft servers by a Chinese hacking group, which breached the emails of several senior US officials, was due to “a host of avoidable errors” by the tech giant.

The Cybersecurity Review Board (CSRB), led by the U.S. Department of Homeland Security, conducted a seven-month investigation into the incident, which involved China-affiliated cyber espionage actor Storm-0558.

The operation, which was first discovered by the US State Department in June 2023, included hacks on the official and personal mailboxes of Commerce Secretary Gina Raimondo and US Ambassador to China Nicholas Burns.

Microsoft’s core business is to provide cloud computing services like Azure or Office360, which host sensitive data and power business and government operations in key sectors of the economy.

The report, which was released on Monday, criticized a Microsoft corporate culture that was “contrary to the company’s centrality in the technology ecosystem and the level of trust customers have in the company.”

“Cloud computing is one of the most critical infrastructures we have, as it hosts sensitive data and powers business operations across our economy,” said CSRB Chairman Robert Silvers.

“It is imperative that cloud service providers prioritize security and build it in by design,” he said.

The review identified a series of operational and strategic decisions by Microsoft that opened the door to the breach, including the failure to identify a new employee’s compromised laptop following a corporate acquisition in 2021.

It also found that Microsoft fell short of security standards seen at competing cloud companies including Google, Amazon and Oracle.

“The board finds that this intrusion was preventable and should never have happened,” the review said.

The report also recommends that Microsoft develop and publicly release a plan with timelines to implement comprehensive security improvements across its products and practices.

CSRB Vice Chairman Dmitry Alperovich called Storm-0558 and similar actors a “persistent and dangerous threat” with “the ability and intent to compromise identification systems to access sensitive data, including emails of persons of interest to the Chinese government.” Was.”

The government thanked Microsoft, which did not immediately respond to a request for comment, for cooperating fully with its review.

Microsoft has said it is currently improving its software security following the breach and similar cybersecurity attacks in recent years.

Appointed by the White House, the CSRB serves as an independent investigator of major cyber incidents affecting U.S. critical infrastructure.

(This story has not been edited by News18 staff and is published from a syndicated news agency feed – AFP)