Connect with us

Technology

Microsoft describes how its leaders were spied on by Russian hackers

Published

on

Microsoft describes how its leaders were spied on by Russian hackers

The Russian state-sponsored hackers responsible for the SolarWinds attack launched a nation-state attack against Microsoft’s corporate systems, the company disclosed last week. Some members of Microsoft’s senior leadership team had their email accounts compromised by hackers, who may have been snooping on them for weeks or months.

Microsoft released a preliminary investigation of how the hackers circumvented its security measures, even though the software company’s original SEC report late on Friday had little details about how the attackers obtained access. It also serves as a warning that other firms have been targeted by the same hacking outfit, commonly known as Nobelium or by the weather-themed nickname “Midnight Blizzard,” which Microsoft uses to refer to them.

Initially, Nobelium used a password spray assault to gain access to Microsoft’s servers. Hackers employ a dictionary of possible passwords in this kind of brute force attack against accounts. Crucially, two-factor authentication was not activated on the compromised non-production test tenant account. In order to avoid discovery, Microsoft claims that Nobelium “tailored their password spray attacks to a limited number of accounts, using a low number of attempts.”

The group identified and compromised a historical test OAuth application that had elevated access to the Microsoft corporate environment by using the access they had gained from the previous attack. A popular open standard for token-based authentication is OAuth. It’s a widely used web feature that lets you log into apps and services without giving your password to a website. OAuth is used on websites that you might be able to get into with your Gmail account.

The group was able to produce more malicious OAuth apps and accounts thanks to this higher access, which also gave them access to Microsoft’s corporate network and, eventually, its Office 365 Exchange Online service, which gives users access to email inboxes.

“Midnight Blizzard leveraged these malicious OAuth applications to authenticate to Microsoft Exchange Online and target Microsoft corporate email accounts,” explains Microsoft’s security team.

Microsoft previously stated that it was “a very small percentage of Microsoft corporate email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions.” The company has not disclosed the exact number of its corporate email accounts that were targeted and accessed.

Additionally, Microsoft has yet to provide a precise timeframe for the duration of the hackers’ eavesdropping on its top leadership group and other staff members. Although the first attack happened in late November 2023, Microsoft didn’t become aware of it until January 12th. This could indicate that for almost two months, the attackers surveilled Microsoft leaders.

The same group of hackers had earlier this week gotten access to Hewlett Packard Enterprise’s (HPE) “cloud-based email environment.” Although HPE did not identify the supplier, it did disclose that the event was “probably connected” to the “exfiltration of a restricted quantity of [Microsoft] SharePoint documents as early as May 2023.”

The Microsoft hack happened a few days after the business declared its intention to restructure its software security in response to significant attacks on the Azure cloud. This is Microsoft’s most recent cybersecurity incident. A Microsoft Exchange Server vulnerability allowed 30,000 companies’ email systems to be compromised in 2021, and Chinese hackers used a Microsoft cloud attack last year to access emails belonging to the US government. The same Nobelium group that carried out this embarrassing executive email hack previously targeted Microsoft in the massive SolarWinds attack almost three years ago.

The cybersecurity community will probably take issue with Microsoft’s revelation that a crucial test account was operating without two-factor authentication. Although there was no software vulnerability in Microsoft, the hackers were able to stealthily navigate Microsoft’s corporate network thanks to a series of incorrectly set up test setups. “In an interview with CNBC earlier this week, George Kurtz, the CEO of CrowdStrike, questioned how the compromise of the highest ranking officials at Microsoft occurred in a non-production test environment.” “I believe there will be much more information released on this,”

Kurtz was correct; additional information has surfaced, but some crucial elements remain unreported. Microsoft asserts that in order to properly defend against these threats, “mandatory Microsoft policy and workflows would ensure MFA and our active protections are enabled” if this identical non-production test environment were implemented today. Microsoft still has a lot of explaining to do, particularly if it wants its users to think that it is genuinely making improvements to the way it develops, tests, builds, and runs its services and software to better defend against security risks.

Technology

OpenAI Launches SearchGPT, a Search Engine Driven by AI

Published

on

The highly anticipated launch of SearchGPT, an AI-powered search engine that provides real-time access to information on the internet, by OpenAI is being made public.

“What are you looking for?” appears in a huge text box at the top of the search engine. However, SearchGPT attempts to arrange and make sense of the links rather than just providing a bare list of them. In one instance from OpenAI, the search engine provides a synopsis of its discoveries regarding music festivals, accompanied by succinct summaries of the events and an attribution link.

Another example describes when to plant tomatoes before decomposing them into their individual types. You can click the sidebar to access more pertinent resources or pose follow-up questions once the results are displayed.

At present, SearchGPT is merely a “prototype.” According to OpenAI spokesman Kayla Wood, the service, which is powered by the GPT-4 family of models, will initially only be available to 10,000 test users. According to Wood, OpenAI uses direct content feeds and collaborates with outside partners to provide its search results. Eventually, the search functions should be integrated right into ChatGPT.

It’s the beginning of what may grow to be a significant challenge to Google, which has hurriedly integrated AI capabilities into its search engine out of concern that customers might swarm to rival firms that provide the tools first. Additionally, it places OpenAI more squarely against Perplexity, a business that markets itself as an AI “answer” engine. Publishers have recently accused Perplexity of outright copying their work through an AI summary tool.

OpenAI claims to be adopting a notably different strategy, suggesting that it has noticed the backlash. The business highlighted in a blog post that SearchGPT was created in cooperation with a number of news partners, including businesses such as Vox Media, the parent company of The Verge, and the owners of The Wall Street Journal and The Associated Press. “News partners gave valuable feedback, and we continue to seek their input,” says Wood.

According to the business, publishers would be able to “manage how they appear in OpenAI search features.” They still appear in search results, even if they choose not to have their content utilized to train OpenAI’s algorithms.

According to OpenAI’s blog post, “SearchGPT is designed to help users connect with publishers by prominently citing and linking to them in searches.” “Responses have clear, in-line, named attribution and links so users know where information is coming from and can quickly engage with even more results in a sidebar with source links.”

OpenAI gains from releasing its search engine in prototype form in several ways. Additionally, it’s possible to miscredit sources or even plagiarize entire articles, as Perplexity was said to have done.

There have been rumblings about this new product for several months now; in February, The Information reported on its development, and in May, Bloomberg reported even more. A new website that OpenAI has been developing that made reference to the transfer was also seen by certain X users.

ChatGPT has been gradually getting closer to the real-time web, thanks to OpenAI. The AI model was months old when GPT-3.5 was released. OpenAI introduced Browse with Bing, a method of internet browsing for ChatGPT, last September; yet, it seems far less sophisticated than SearchGPT.

OpenAI’s quick progress has brought millions of users to ChatGPT, but the company’s expenses are mounting. According to a story published in The Information this week, OpenAI’s expenses for AI training and inference might total $7 billion this year. Compute costs will also increase due to the millions of people using ChatGPT’s free edition. When SearchGPT first launches, it will be available for free. However, as of right now, it doesn’t seem to have any advertisements, so the company will need to find a way to make money soon.

Continue Reading

Technology

Google Revokes its Intentions to stop Accepting Cookies from Marketers

Published

on

Following years of delay, Google has announced that it will no longer allow advertisers to remove and replace third-party cookies from its Chrome web browser.

Cookies are text files that websites upload to a user’s browser so they can follow them around when they visit other websites. A large portion of the digital advertising ecosystem has been powered by this practice, which makes it possible to track people across many websites in order to target ads.

Google stated in 2020 that it would stop supporting certain cookies by the beginning of 2022 after determining how to meet the demands of users, publishers, and advertisers and developing solutions to make workarounds easier.

In order to do this, Google started the “Privacy Sandbox” project in an effort to find a way to safeguard user privacy while allowing material to be freely accessible on the public internet.

In January, Google declared that it was “extremely confident” in the advancement of its plans to replace cookies. One such proposal was “Federated Learning of Cohorts,” which would essentially group individuals based on similar browsing habits; thus, only “cohort IDs”—rather than individual user IDs—would be used to target them.

However, Google extended the deadline in June 2021 to allow the digital advertising sector more time to finalize strategies for better targeted ads that respect user privacy. Then, in 2022, the firm stated that feedback had indicated that advertisers required further time to make the switch to Google’s cookie replacement because some had resisted, arguing that it would have a major negative influence on their companies.

The business announced in a blog post on Monday that it has received input from regulators and advertisers, which has influenced its most recent decision to abandon its intention to remove third-party cookies from its browser.

According to the firm, testing revealed that the change would affect publishers, advertisers, and pretty much everyone involved in internet advertising and would require “significant work by many participants.”

Anthony Chavez, vice president of Privacy Sandbox, commented, “Instead of deprecating third-party cookies, we would introduce a new experience in Chrome that lets people make an informed choice that applies across their web browsing, and they’d be able to adjust that choice at any time.” “We’re discussing this new path with regulators and will engage with the industry as we roll it out.”

Continue Reading

Technology

 Samsung Galaxy Buds 3 Pro Launch Postponed Because of Problems with Quality Control

Published

on

At its Unpacked presentation on July 10, Samsung also debuted its newest flagship buds, the Galaxy Buds 3 Pro, with the Galaxy Z Fold 6, Flip 6, and the Galaxy Watch 7. Similar to its other products, the firm immediately began taking preorders for the earphones following the event, and on July 26th, they will go on sale at retail. But the Korean behemoth was forced to postpone the release of the Galaxy Buds 3 Pro and delay preorder delivery due to quality control concerns.

The Galaxy Buds 3 Pro went on sale earlier this week in South Korea, Samsung’s home market, in contrast to the rest of the world. However, allegations of problems with quality control quickly surfaced. These included loose case hinges, earbud joints that did not sit flush, blue dye blotches, scratches or scuffs on the case cover, and so on. It appears that the issues are exclusive to the white Buds 3 Pro; the silver devices are working fine.

Samsung reportedly sent out an email to stop selling Galaxy Buds 3 Pros, according to a Reddit user. These problems appear to be a result of Samsung’s inadequate quality control inspections. Numerous user complaints can also be found on its Korean community forum, where one consumer claims that the firm would enhance quality control and reintroduce the earphones on July 24.

 A Samsung official stated. “There have been reports relating to a limited number of early production Galaxy Buds 3 Pro devices. We are taking this matter very seriously and remain committed to meeting the highest quality standards of our products. We are urgently assessing and enhancing our quality control processes.”

“To ensure all products meet our quality standards, we have temporarily suspended deliveries of Galaxy Buds 3 Pro devices to distribution channels to conduct a full quality control evaluation before shipments to consumers take place. We sincerely apologize for any inconvenience this may cause.”

Should Korean customers encounter problems with their Buds 3 Pro devices after they have already received them, they should bring them to the closest service center for a replacement.

Possible postponement of the US debut of the Galaxy Buds 3 Pro

Samsung seems to have rescheduled the launch date and (some) presale deliveries of the Galaxy Buds 3 Pro in the US and other markets by one month. Inspect your earbuds carefully upon delivery to make sure there are no issues with quality control, especially if your order is still scheduled for July.

The Buds 3 Pro is currently scheduled for delivery in late August, one month after its launch date, on the company’s US store. Additionally, Best Buy no longer takes preorders for the earphones, and Amazon no longer lists them for sale.

There are no quality control difficulties affecting the Buds 3, and they are still scheduled for delivery by July 24, the day of launch. Customers of the original Galaxy Buds 3 Pro have reported that taking them out is easy to tear the ear tips. Samsung’s delay, though, doesn’t seem to be related to that issue.

Continue Reading

Trending

error: Content is protected !!