Microsoft Fingers NSO Group as the Prime Mover in Cyber Attacks. Er, What?
Okay, okay, I am not sure if this story is accurate, but it certainly is interesting. Navigate to “Microsoft President Blames Israeli Company for Rash of Cyberattacks, Wants Biden to Intervene.” The write up reports:
Smith [the Microsoft president] has suggested that NSO Group and similar companies are “a new generation of private companies akin to 21st-century mercenaries” who generate “cyber-attack proliferation to other governments that have the money but not the people to create their own weapons. In short, it adds another significant element to the cybersecurity threat landscape.”
If accurate, Mr. Smith may want to validate that industrial strength cyber tools are available from code dumps from other specialized software vendors, downloadable via Microsoft’s own Github, penetration testing tool developers and the third parties creating add on kits to these software, and on certain fora on either encrypted messaging platforms or the handful of remaining Dark Web sites which allow authorized users to buy or download exploits.
In the galaxy of specialized software firms, NSO Group has been illuminated due to its emergence as a PR magnet and the business set up of the company itself. However, there are other specialized software vendors and there are other sources of code, libraries, and information to guide the would be bad actor.
Microsoft itself suffered a security breach and promptly (after five or six months) took action. The company published a report. Now Microsoft is acting to focus attention on a company which may or may not have had an impact on the supply chain matter involving SolarWinds and possibly other cyber security firms.
This Microsoft assertion is almost as interesting as the death star response to the incident.
But the kicker is this report form Techradar: “Microsoft Azure Breach Left Thousands of Customer Records Exposed.” If correct, this statement seems to suggest that Microsoft is into shifting blame:
Thanks to questionable security practices by an app developer, more than half a million sensitive documents of its customers were exposed on the Internet. The documents were housed in an unprotected Microsoft Azure blob storage and could be viewed by anyone with the direct address of the files, without any kind of authentication.
Okay.
Stephen E Arnold, December 21, 2020
Comments
Human Rights Don’t Exist in Brazil
There is a criminal organization in Brazil using NSO Group’s Pegasus to infect devices for hack for hire, to incite terrorism, blackmail people, produce illegal pornography and assist in assassinations. They also have other advanced malware, like UEFI implants and even persistent implants for Kindle and Raspberry Pi. Plus face/voice recognition on every camera and microphone they can get into, in public or private places.
Brazil won’t do anything to stop them. Only the FBI, CIA and NSA can stop them.
There is also the possibility that they were engaged on the hack of Bezos’ smartphone.
If you know of any security researcher who wants to reverse engineer the exploits they are using, I am more than willing to help them.
If you want a story about how they operate, I am willing to work with you to expose them.