Microsoft investigates after Lapsus$ gang brags of Bing, Cortana code heist
(2022/03/21)
- Reference: 1647892391
- News link: https://www.theregister.co.uk/2022/03/21/microsoft_lapsus_breach_probe/
- Source link:
The Lapsus$ extortion gang briefly alleged over the weekend it had compromised Microsoft.
The [1]devil-may-care cyber-crime ring has previously boasted of breaking into Nvidia, Samsung, Ubisoft, and others. Its modus operandi is to infiltrate a big target's network, exfiltrate sensitive internal data, and then make demands to prevent the public release of this material – and perhaps just release some of it anyway.
"We are aware of the claims and are investigating," a Microsoft spokesperson told The Register on Monday.
[2]
On Saturday and Sunday, the crooks shared then deleted on Telegram screenshots suggesting they had broken into Microsoft's internal DevOps environment, as [3]spotted by infosec bod Dominic Alvieri. The screenshot shows internal projects including Bing and Cortana's source code, and WebXT compliance engineering projects.
[4]
[5]
"Normally you wouldn’t give credibility to a snapshot," tweeted Alvieri, "but Lapsus has breached Samsung, Impresa, Mercado Libre, Ubisoft, and Nvidia." The researcher said Microsoft and Vodafone have allegedly been hit, adding that the brag about the Windows giant seems "credible so far and reputation is at stake."
If the screenshots are legit, this would be a major security breach for the American IT titan. There's the potential for miscreants to find and exploit security holes in the code, should they get their hands on it. Perhaps Microsoft should have fought a little harder for Mandiant before [6]Google scooped it up for $5.4bn.
[7]Devil-may-care Lapsus$ gang is not the aspirational brand infosec needs
[8]Lapsus$ extortionists dump Samsung data online, chaebol confirms security breach
[9]Leaked stolen Nvidia key can sign Windows malware
[10]CISOs face 'perfect storm' of ransomware and state-supported cybercrime
The suspected Microsoft intrusion follows a series of high-profile sorties by Lapsus$, which, until recently, was best known for meddling with Brazil's Ministry of Health and Portuguese media outlets SIC Noticias and Expresso.
That all changed in February when the gang, believed to be based in Brazil, [11]sneaked into Nvidia 's networks and stole one terabyte of data including employee credentials and proprietary information, and dumped some of it online.
[12]
Days later Lapsus$ [13]raided Samsung and stole 190GB of internal files including some Galaxy device source code.
The criminal group followed that up by claiming it was responsible for a [14]cybersecurity incident " at gaming giant Ubisoft, and it's reportedly behind a Vodafone security breach as well. Earlier this month, the telco said it was probing Lapsus$'s claims that it stole 200GB worth of source code.
"We are investigating the claim together with law enforcement, and at this point we cannot comment on the credibility of the claim," a Voda spokesperson [15]told CNBC. "However, what we can say is that generally the types of repositories referenced in the claim contain proprietary source code and do not contain customer data." ®
Get our [16]Tech Resources
[1] https://www.theregister.com/2022/03/17/lapsus-larger-companies/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YjkDoAuyCOTOxR3TGMuGpgAAABI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://twitter.com/AlvieriD/status/1505528706738974724
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YjkDoAuyCOTOxR3TGMuGpgAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YjkDoAuyCOTOxR3TGMuGpgAAABI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2022/03/08/google_buys_mandiant_5_4bn_dollars/
[7] https://www.theregister.com/2022/03/17/lapsus-larger-companies/
[8] https://www.theregister.com/2022/03/07/samsung_lapsus_data_theft/
[9] https://www.theregister.com/2022/03/05/nvidia_stolen_certificate/
[10] https://www.theregister.com/2022/03/18/ciso_security_storm/
[11] https://www.theregister.com/2022/02/26/nvidia_security_breach/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YjkDoAuyCOTOxR3TGMuGpgAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2022/03/07/samsung_lapsus_data_theft/
[14] https://news.ubisoft.com/en-gb/article/3tSsBh25mhHhlbGSy1xbRw/ubisoft-cyber-security-incident-update
[15] https://www.cnbc.com/2022/03/10/vodafone-investigating-hackers-claims-threatening-to-leak-source-code.html
[16] https://whitepapers.theregister.com/
The [1]devil-may-care cyber-crime ring has previously boasted of breaking into Nvidia, Samsung, Ubisoft, and others. Its modus operandi is to infiltrate a big target's network, exfiltrate sensitive internal data, and then make demands to prevent the public release of this material – and perhaps just release some of it anyway.
"We are aware of the claims and are investigating," a Microsoft spokesperson told The Register on Monday.
[2]
On Saturday and Sunday, the crooks shared then deleted on Telegram screenshots suggesting they had broken into Microsoft's internal DevOps environment, as [3]spotted by infosec bod Dominic Alvieri. The screenshot shows internal projects including Bing and Cortana's source code, and WebXT compliance engineering projects.
[4]
[5]
"Normally you wouldn’t give credibility to a snapshot," tweeted Alvieri, "but Lapsus has breached Samsung, Impresa, Mercado Libre, Ubisoft, and Nvidia." The researcher said Microsoft and Vodafone have allegedly been hit, adding that the brag about the Windows giant seems "credible so far and reputation is at stake."
If the screenshots are legit, this would be a major security breach for the American IT titan. There's the potential for miscreants to find and exploit security holes in the code, should they get their hands on it. Perhaps Microsoft should have fought a little harder for Mandiant before [6]Google scooped it up for $5.4bn.
[7]Devil-may-care Lapsus$ gang is not the aspirational brand infosec needs
[8]Lapsus$ extortionists dump Samsung data online, chaebol confirms security breach
[9]Leaked stolen Nvidia key can sign Windows malware
[10]CISOs face 'perfect storm' of ransomware and state-supported cybercrime
The suspected Microsoft intrusion follows a series of high-profile sorties by Lapsus$, which, until recently, was best known for meddling with Brazil's Ministry of Health and Portuguese media outlets SIC Noticias and Expresso.
That all changed in February when the gang, believed to be based in Brazil, [11]sneaked into Nvidia 's networks and stole one terabyte of data including employee credentials and proprietary information, and dumped some of it online.
[12]
Days later Lapsus$ [13]raided Samsung and stole 190GB of internal files including some Galaxy device source code.
The criminal group followed that up by claiming it was responsible for a [14]cybersecurity incident " at gaming giant Ubisoft, and it's reportedly behind a Vodafone security breach as well. Earlier this month, the telco said it was probing Lapsus$'s claims that it stole 200GB worth of source code.
"We are investigating the claim together with law enforcement, and at this point we cannot comment on the credibility of the claim," a Voda spokesperson [15]told CNBC. "However, what we can say is that generally the types of repositories referenced in the claim contain proprietary source code and do not contain customer data." ®
Get our [16]Tech Resources
[1] https://www.theregister.com/2022/03/17/lapsus-larger-companies/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YjkDoAuyCOTOxR3TGMuGpgAAABI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://twitter.com/AlvieriD/status/1505528706738974724
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YjkDoAuyCOTOxR3TGMuGpgAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YjkDoAuyCOTOxR3TGMuGpgAAABI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2022/03/08/google_buys_mandiant_5_4bn_dollars/
[7] https://www.theregister.com/2022/03/17/lapsus-larger-companies/
[8] https://www.theregister.com/2022/03/07/samsung_lapsus_data_theft/
[9] https://www.theregister.com/2022/03/05/nvidia_stolen_certificate/
[10] https://www.theregister.com/2022/03/18/ciso_security_storm/
[11] https://www.theregister.com/2022/02/26/nvidia_security_breach/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YjkDoAuyCOTOxR3TGMuGpgAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2022/03/07/samsung_lapsus_data_theft/
[14] https://news.ubisoft.com/en-gb/article/3tSsBh25mhHhlbGSy1xbRw/ubisoft-cyber-security-incident-update
[15] https://www.cnbc.com/2022/03/10/vodafone-investigating-hackers-claims-threatening-to-leak-source-code.html
[16] https://whitepapers.theregister.com/
Bing and Cortana code was stolen?
DS999
Wow we're really going all the way to damage the Russian economy by letting them have that!
I hope the code is released
Duncan Macdonald
Having the code publicly visible might get M$ to fix some of the worst errors in it.
Not such a big deal
martinusher
It often takes longer to unravel a whole bunch of "mature" source code than it does to rewrite it.
I've had dumped on me source bases that I wouldn't wish on my worst enemy. You know stuff is contorted when you're still looking at it years later and parts of it still don't make sense.
Then there's no guarantee that this dump isn't of some developers 'archive' filesystem that includes numerous versions of the same code, all non-functional and all of it obsolete. I wish this crew luck in their endeavors (they're going to need it).
There's the potential for miscreants to find and exploit security holes in the code, should they get their hands on it.
Or perhaps they could fix some of the defects? There's a myriad of bugs in Visual Studio that the development team have never seemed interested in addressing. Think of it as a kind of out-sourcing.