Forgot your password?
typodupeerror
Government Microsoft Security United States IT

US Security Services May 'Have Moles Within Microsoft,' Says Researcher 228

Posted by Soulskill
from the clippy-was-a-double-agent dept.
Barence writes "U.S. government officials could be working under cover at Microsoft to help the country's cyber-espionage programme, according to one leading security expert. According to Mikko Hypponen, chief research officer at security firm F-Secure, the claim is a logical conclusion to a series of recent discoveries and disclosures linking the U.S. government to 2010's Stuxnet attack on Iran and ties between Stuxnet and the recent Flame attack. 'It's plausible that if there is an operation under way and being run by a U.S. intelligence agency it would make perfect sense for them to plant moles inside Microsoft to assist in pulling it off, just as they would in any other undercover operation,' he said. 'It's not certain, but it would be common sense to expect they would do that.'"
This discussion has been archived. No new comments can be posted.

US Security Services May 'Have Moles Within Microsoft,' Says Researcher

Comments Filter:
  • Ockham's razor (Score:5, Insightful)

    by Anonymous Coward on Friday June 15, 2012 @11:33AM (#40336233)
    ... or they just paid/threatened Microsoft. Much simpler and easier.
    • Re:Ockham's razor (Score:4, Insightful)

      by Culture20 (968837) on Friday June 15, 2012 @11:40AM (#40336333)

      ... or they just paid/threatened Microsoft. Much simpler and easier.

      And it has the added bonus of being legal. "Moles in MS" would be a big no-no, no?

      • Re:Ockham's razor (Score:4, Insightful)

        by JeffSh (71237) <[gro.0m0m] [ta] [todhsalsffej]> on Friday June 15, 2012 @11:42AM (#40336357)

        Only if it were to ever be acknowledged, something that has zero possibility of ever happening.

        • by cayenne8 (626475)

          Only if it were to ever be acknowledged, something that has zero possibility of ever happening.

          I dunno about that.....of late, the Obama administration is been quite 'leaky' when it comes to secret/covert ops.....what we already know about Stuxnet comes to mind.

          • by JeffSh (71237)

            To further this idea, even if we were to have it confirmed, what would it change? The population is too pacified to really care.

          • I dunno about that.....of late, the Obama administration is been quite 'leaky' when it comes to secret/covert ops.....what we already know about Stuxnet comes to mind.

            I'm not so sure knowing about stuxnet is really a leak. I seem to remember, when Iran started complaining about it, that pretty much everyone thought it was the US/Israel.

            It really didn't appear to be anyone else, and it didn't appear like anyone else would really care - so confirming it was the US/Israel was about as revealing as someone telling me that it's possible the US might have invaded Iraq for oil-related reasons

      • by Anonymous Coward on Friday June 15, 2012 @12:01PM (#40336635)

        "Moles in MS" would be a big no-no, no?

        Actually, it sounds like it'd be a runaway hit reality show.

        "For the past year, we sent a Google developer deep undercover at Microsoft armed with an Android-powered hidden camera and an agenda to subtly promote open technologies. Now, we're going to show you the results. Sometimes hilarious, sometimes heartbreaking, sometimes horrifying; tune in starting this August on Slashdot TV for 'Moles in Microsoft' to see what happens when development ideologies collide in the real world."

      • by MHolmesIV (253236)

        It certainly would run afoul of our Moonlighting policies.

        On the other hand, my life has just become awesome! The next coworker I talk to could be a spy.

    • Re:Ockham's razor (Score:5, Informative)

      by Sir_Sri (199544) on Friday June 15, 2012 @11:54AM (#40336511)

      Or they just paid former microsoft employees with technical positions to come work for the government.

      Didn't the NSA offer to help 'secure' windows 7 (http://www.computerworld.com/s/article/9141105/NSA_helped_with_Windows_7_development), they could just offer to help with 'collaboration' and then provide some security fixes and use some of the loopholes they find before anyone else does.

      Now the israeli's. They have spies at microsoft. The US government probably not directly, at least not in the US, there are enough cheaper no risk ways to get what they want.

      • Re:Ockham's razor (Score:5, Insightful)

        by s.petry (762400) on Friday June 15, 2012 @12:37PM (#40337067)

        I'm not even sure they would have to do that. The technical details in TFA are a bit scarce, but enough exists for a better theory than the TFA presents.

        Someone with some hefty CPU power broke the MS cert, which allowed them to create their own at will and spoof a MS cert.

        The Government has the access to MS source code, and their methods. If you know where hooks get applied and how priorities work, you don't need to be from MS to write good code. You just need to be a good coder.

        Spoofing Windows Update server really would not be that hard. Hell you don't even need a real man in the middle attack if you have a forged Cert and know the structure. You just need to spoof a DNS answer, the client will do everything else for you.

        Having the fake key is huge! Write an application, sign as Genuine MS, put on a faked Windows update server, reroute a DNS call. Shazam! Of course there is other knowledge required, such as evading AV detection, etc.. but they had that figured out very well also.

        It would take a good team, and time, but no need to have a mole. I would not be surprised if the US Government had moles in MS, but if they did it would primarily be for reasons other than Stuxnet and Flame, or any other computer espionage program.

        • Re:Ockham's razor (Score:5, Insightful)

          by dnahelicase (1594971) on Friday June 15, 2012 @03:23PM (#40338929)

          >

          It would take a good team, and time, but no need to have a mole. I would not be surprised if the US Government had moles in MS, but if they did it would primarily be for reasons other than Stuxnet and Flame, or any other computer espionage program.

          I would be surprised if the US doesn't have "spies" within Microsoft. Microsoft is huge, and hugely important in how the world handles data. I would be shocked if the US, China, India, Russia, and several other countries didn't have "spies" somewhere in Microsoft.

          • by s.petry (762400)

            You agreed with what I said about them possibly having spies, but no other input. Do you really think they would be there to infect the OS and devise espionage schemes? I found that extremely unlikely. More like, they are making sure certain things don't get fixed, and making sure that the good people at Microsoft don't behave in corrupt ways that they are not known to act (Corrupt for the US is good, corrupt for China not so much). Maybe watching to make sure foreign influences don't hack espionage in

    • Re:Ockham's razor (Score:5, Interesting)

      by Aighearach (97333) on Friday June 15, 2012 @12:09PM (#40336725) Homepage

      We can get even simpler and easier, MS already gives the military access to their source code so that it can be reviewed. This is a requirement for all the software used on the most secure systems.

      It has always been viewed as a joke around here, because unless they are going to fix the bugs themselves, having the source isn't going to make windoze take extra care about your data.

      So the simplest and most obvious answer is, they didn't need to sneak in, and they didn't need to make threats either.

      • by ackthpt (218170) on Friday June 15, 2012 @12:38PM (#40337075) Homepage Journal

        We can get even simpler and easier, MS already gives the military access to their source code so that it can be reviewed. This is a requirement for all the software used on the most secure systems.

        It has always been viewed as a joke around here, because unless they are going to fix the bugs themselves, having the source isn't going to make windoze take extra care about your data.

        So the simplest and most obvious answer is, they didn't need to sneak in, and they didn't need to make threats either.

        That explains some of the mental breakdown of returning veterans...

        • by steelfood (895457)

          Little known secret about Gitmo: Terrorists voluntarily spill the beans after they're forced to analyze the Windows source code for exploits. Everybody's led to believe it's waterboarding, but that's actually the lesser evil. There's a reason they don't send drones out for the engineers-turned-terrorists.

        • Not to belabor the obvious. This is one reason open source, over time, is more secure that closed source. Which would you rather rely on, software that has source code anybody can look at, or software that only the development company and the military of the world's sole superpower can look at?

          Of course, nefarious elements can put subtle security bugs in open source projects, but one hopes over time that the community is able to find and eliminate them.

          • That is indeed the obvious advantage.

            Another clear advantage to open source is that it is easy to obtain the source code from multiple different routes and run comparison checks, thus assuring that the source code you have is in fact the code everyone is using. If you are buying copies of closed source code on the black market, you have no assurance that the code is correct in all respects, and no way to assure that the seller is not an agent of the CIA, Mossad, MI5, or the French Foreign Legion.

            Maybe you

    • Re:Ockham's razor (Score:5, Insightful)

      by flyingsquid (813711) on Friday June 15, 2012 @01:02PM (#40337329)

      ... or they just paid/threatened Microsoft. Much simpler and easier.

      The problem with the claim put forward in the article is that it is *not* the logical conclusion of what we know about Stuxnet and Flame. What we know about Flame is that (i) it's the most advanced piece of malware ever created (that we know about), (ii) it has connections to Stuxnet, (iii) it's primarily targeting Iran, but it's also targeting Syria, Palestine, Egypt, Saudi Arabia. That information tells us a lot about who was behind it.

      Okay, so first off, Flame is very large and extremely advanced. That implies a country with an advanced cyber-warfare program. That list is fairly short, and the big names on it are the United States, Russia, China, and Israel.

      Second, the people behind Flame were also involved in Stuxnet. The people analyzing Stuxnet came to the conclusion that it was the work of two different countries, with suspicion falling on the U.S. and Israel. In the New York Times article, it's reported that Stuxnet is designed by the U.S., but the Israelis helped out. The Obama Administration has not denied anything published in that article.

      Third, Flame is primarily targeting Iran, again that points to the U.S. and Israel, Iran's primary enemies. However, Flame's secondary targets are all areas that are potential threats to Israel (Syria, Palestine, Egypt, Saudi Arabia) but this list does not include countries that pose security threats to the U.S. but not to Israel (Afghanistan, Iraq, North Korea). Finally, there are also some Flame infections in Israel itself. Given that one of the purposes of an intelligence organization is (unfortunately) to spy on their own citizens, that also fits the idea that Flame is written by the Israelis.

      If Flame is Israeli, then the idea that the U.S. is planting spies in Microsoft is not the "logical conclusion" of the facts at all. So does this mean that the Mossad has penetrated Microsoft? Well, I suppose it's possible. It would antagonize the U.S. to learn that our ally has spies in our corporations, but it's also been alleged that Israel has moles in the Pentagon, so it wouldn't be entirely surprising, either.

    • by Darinbob (1142669)

      Or they just have smart enough people that can figure out how Windows works without actually having to be an employee. Much simpler too to just have a cheap summer hire save up all the source code on a thumb drive.

  • by Anonymous Coward on Friday June 15, 2012 @11:33AM (#40336243)

    The US Government has licenses for the Windows source code. Nothing we've seen those virii do have required anything more than that.

  • by Anonymous Coward on Friday June 15, 2012 @11:34AM (#40336257)
    What would surprise me, is if the US thinks they're the only one.
  • by fluffythedestroyer (2586259) on Friday June 15, 2012 @11:34AM (#40336259) Homepage
    dont forget security companies and firms... and yes it does make lots of sense.
    • Re: (Score:3, Interesting)

      by Anonymous Coward

      Don't forget that the US Department of Homeland Security maintains a giant list of security flaws. It's called the Common Vulnerabilities Enumeration [mitre.org].

      Check the fine print at the bottom of the page: "CVE is co-sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security."

      So that means the government doesn't even need to go looking for holes - security companies send them to the government directly to be listed!

      No mole required, just a "friendly" email informing them that they

      • Re: (Score:2, Informative)

        by Anonymous Coward

        Don't forget that the US Department of Homeland Security maintains a giant list of security flaws. It's called the Common Vulnerabilities Enumeration [mitre.org].

        Check the fine print at the bottom of the page: "CVE is co-sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security."

        So that means the government doesn't even need to go looking for holes - security companies send them to the government directly to be listed!

        No mole required, just a "friendly" email informing them that they're going to keep silent for a bit and "forgetting" to post the alert publicly.

        CVE doesn't work that way. From the FAQ:

        Isn’t CVE just another vulnerability database?

        No. CVE is not a vulnerability database. CVE is designed to allow vulnerability databases and other capabilities to be linked together, and to facilitate the comparison of security tools and services. As such, CVE does not contain information such as risk, impact, fix information, or detailed technical information. CVE only contains the standard identifier number with status indicator, a brief description, and references to related vulnerability reports and advisories.

        The project arose because different vendors were assigning different names and ids to vulnerabilities and generally just confusing the hell out of everyone. CVE just provides a standard id that all of the different security researchers can use to refer to the same issue.

        In practice, researchers typically contact MITRE or other software vendors participating in the program to obtain a CVE ID, possibly before the assessment of the vulnerability is complete. Then they

  • by Apharmd (2640859) on Friday June 15, 2012 @11:35AM (#40336269)
    I doubt Microsoft would balk at any requests at access. These are, after all, matters of national security, and are therefore paramount over all other concerns. No decent American (ahem) company could refuse.
  • by cpu6502 (1960974) on Friday June 15, 2012 @11:36AM (#40336283)

    They THINK there MIGHT be moles inside Microsoft. ("Definitive proof!" says Alex on his radio show.) That's nice. I think their might be moles inside everybody's backyards..... I haven't actually seen any, but let's publish it anyway and scare everyone.

    1. Publish some random guy
    2. Spin it to make it sound factual "evidence"
    3. $profit$

    • Now I'm not saying there are moles at Microsoft and Apple, but neither of them have reported back to me either way.

      So, what are they hiding?

      • by cpu6502 (1960974)

        And Rachel Maddow. And Ed Schultz. And .....

        But Beck usually backs-up his stuff with documents. Quoting Bill Ayers or Cloward-Piven from the 70s saying, "We will blow-up government buildings and take over through force," is pretty damning. Quoting the FBI Agent who infiltrated the organization and confirms they were prepared to kill to achieve their ends is also pretty damning.

        • by Joe U (443617)

          You forgot Rush and O'Reilly.

          Beck is a hack. Actually, all of them are, Maddow, Limbaugh, etc...

          The "news" attack style he and his counterparts use are so filled with holes and fallacies you could drive an entire interstate highway worth of trucks through them.

    • Re: (Score:2, Offtopic)

      by jellomizer (103300)

      But that is how conspiracies work. The more information you don't have the stronger the evidence that it must be real.
      I mean a while back they took a mixed race baby born in a different country, paid the hospital to lie to publish a new paper reports, and an other insider generated false documents to prove he was born in the United States, Pay for a team of actors to say they knew this child when they were children, all in the offshoot that perhaps this child (where the culture at the time figured had near

      • by bobbied (2522392)

        But that is how conspiracies work. The more information you don't have the stronger the evidence that it must be real. I mean a while back they took a mixed race baby born in a different country, paid the hospital to lie to publish a new paper reports, and an other insider generated false documents to prove he was born in the United States, Pay for a team of actors to say they knew this child when they were children, all in the offshoot that perhaps this child (where the culture at the time figured had near 0 chance of major success in life) would become president and support the Socialist Cause....

        Yea, and the moon landings where faked too.... Seriously, there are just some things that do not make sense to keep beating and this whole birther thing is a long dead horse, as is the idea that the moon landings were faked or 9/11 was an inside job. Besides, there are more effective arguments you can use to use that don't involve wild conspiracies where you have to suspend all reason.

        It's usually better to not think of things as conspiracies anyway. Folks are usually not that good at cooking up such com

        • by s.petry (762400)

          Are you sure? Hell if I had a few trillion dollars like some of them guys and no real job, I'd probably sit around scheming all day. I have morals, so doubt my scheming would be in the same lines as theirs, but still..

  • Seriously, they might be undercover from some but not the ones that do the hiring. That way they could get in just the right posisition to be in.

  • by Anonymous Coward on Friday June 15, 2012 @11:40AM (#40336327)

    "Foreign government officials could be working under cover at Microsoft".

    Since many/much of the actual development is overseas anyway.

  • Government: "Hello there, Microsoft. This here is a really big gun. We want your source code."
    Microsoft: "Ummm, okay."

    The End

    What's this crap about a mole again? Moles are for when you can't just walk in the front door and take whatever you want.

    • Every major government around the world ALREADY has access to Windows source code. Starting in 2001, when Microsoft's security started being a major focus, they began a program to grant access to the code to interested parties.

      http://www.microsoft.com/en-us/sharedsource/government-security-program.aspx [microsoft.com]

      http://www.microsoft.com/en-us/sharedsource/ [microsoft.com]

    • by Artifakt (700173)

      Make an obvious show of force, and fifty people know about it. When one of them talks, you have no idea who spilled the beans, and in fact, you really can't tell if anyone did or if it's an outsider just speculating that you leaned on Microsoft. The quietest way is to plan in advance. Find a young guy in your agency who has what it takes to become just the right employee in the right position a few years down the road, and pay him* to get really good at what you think Microsoft will want by then. The second

    • Sigh. (Score:5, Informative)

      by Sycraft-fu (314770) on Friday June 15, 2012 @12:01PM (#40336623)

      You don't need a big gun to get the MS source code. It isn't some big fucking secret like all the ./ers seem to think. It isn't GPL, but plenty of institutions have copies. Basically any government that uses Windows does, huge surprise there. Also a lot of research universities. One such university I know that has it is ASU. Then there are copies in the hands of partners for better debugging/integration of their products.

      Just because the source isn't on Sourceforge, doesn't mean it is some massive secret. A bit of Google would get you http://www.microsoft.com/en-us/sharedsource/default.aspx [microsoft.com] which is MS's page on their source sharing.

    • by Aighearach (97333)

      I know you're new around here, but please, everybody else has known for years and years that the US Government already has a license to MS source code. Even countries like India have that license. What is in the source isn't secret, and the files have even been broadly published for example on torrent networks. It is highly restricted, but not unknown or unknownable.

      And in the general case, any company that is providing software for use in the most secure military installations gave access to their code yea

    • by couchslug (175151)

      "Government: "Hello there, Microsoft. This here is a really big gun. We want your source code."
      Microsoft: "Ummm, okay." "

      That's a terrifying abuse of government power! I hope they don't extort source from the Linux community.

  • Then obviously they don't really know for sure (so says Betteridge's Law of Headlines). [wikipedia.org]
  • by treerex (743007) on Friday June 15, 2012 @11:59AM (#40336601) Homepage
    Let's not beat around the bush! I say Microsoft has known USG agents working on the systems intentionally putting holes in the OS that can then be leveraged for zero-day attacks against other governments. Balmer is in cahoots I say! CAHOOTS!
  • The question should be, whether these moles will lead to skin cancer, and if Microsoft should limit's exposure to the sun to counter balance them.

    • The question should be, whether these moles will lead to skin cancer, and if Microsoft should limit's exposure to the sun to counter balance them.

      Why do you think Microsoft is headquartered in the Seattle area?

      Coincidence? I should think not.

  • by WaffleMonster (969671) on Friday June 15, 2012 @12:09PM (#40336721)

    Author of TFA dreams up some impossible to falsify idea - offers no supporting evidence of any kind except to say it is plausable.

    I love myself a good MS conspiracy and I'm sure there are plenty which actually do exist but lets not reward intellectual laziness.

    Just two questions:

    1. What do editors of PC Pro get paid to do?
    2. What is it doing on slashdot?

    Now if you'll excuse me my magic unicorn 'Flame' is hungry and wants a bowl of lucky charms before flying back to the land of lua to meet the angry birds.

  • ...put a worm in apple?
  • The answer to headlines that end with a question mark:
    No.

  • 1) The fact that it's common sense does not mean the government is doing it

    2) If it's common sense, why is it worthy of news?

  • I think it is a matter of time before US media is banned from reporting on the findings by computer security experts - especially the uncontrollable ones in Russia and Finland - under the guise that it aides and abets terrerists.
  • If it's truly beneficial to have moles in software companies, you can expect that China and maybe Russia also have them too.. The only benefit seems to be the certificates and access the update servers.
  • No. (Score:3, Informative)

    by Anonymous Coward on Friday June 15, 2012 @12:42PM (#40337109)

    Read more about what actually happened. Microsoft was using some keys with md5 hashing that weren't properly set to prohibit their use for code signing and those keys were signed by the Microsoft root. Using a collision attack they created a copy of a signed key and used that to sign their code.

    Brief Explanation:
    http://blogs.technet.com/b/srd/archive/2012/06/03/microsoft-certification-authority-signing-certificates-added-to-the-untrusted-certificate-store.aspx

    Detailed Explanation:
    http://blogs.technet.com/b/srd/archive/2012/06/06/more-information-about-the-digital-certificates-used-to-sign-the-flame-malware.aspx

    Hotfix MS just published to speed up the revocation process:
    http://blogs.technet.com/b/pki/archive/2012/06/12/announcing-the-automated-updater-of-untrustworthy-certificates-and-keys.aspx

    http://support.microsoft.com/kb/2677070

  • by Mike Buddha (10734) on Friday June 15, 2012 @12:44PM (#40337149)

    Why would hte government bother with moles when it can just read the Microsoft engineers minds from it's spy satellites. It's common sense that they'd be doing this.

  • They're not exclusive and the government doesn't trust Microsoft either. Sure, pretend to partner with Microsoft and put in some explicit backdoors. Just make sure that there are a few Microsoft doesn't know about too.

  • 1. DUH
    2. "May have". Yeah, that's news. Meaningless. They "may not have" too. Is there something specific somebody has to say, with something to back it up other than a closed circle of "may have"?
    3. Speculation is fact on Slashdot. This warrants an article, why? Is there NEWS here, or are we going to see "space aliens MAY HAVE dressed up like call-boys and 'anally probed' the editorial staff"?

    Wankers.

    • by s.petry (762400)

      3. Speculation is fact on Slashdot. This warrants an article, why? Is there NEWS here, or are we going to see "space aliens MAY HAVE dressed up like call-boys and 'anally probed' the editorial staff"?

      -1. You do realize that Slashdot does not write the articles right? Discussion is Slashdot members, and your number 1 and number 2 have been stated a few dozen times.

      Odd that you seemingly fail to grasp the basic concept of -1 and call others wankers.

  • You know, when the discovery of an driving game in Excel 2000 was the earth-shattering revelation of the year. The current crop of hidden "features" kind a gives new meaning to the term "Easter egg", no?
    Oh, and get off my lawn...
  • Why would the government of countries such as Iran, run closed source software from openly unfriendly countries such as the US?

    They should either be writing their own, or at the very least using open source so they can thoroughly audit it.

    Same applies to hardware, they don't need to develop their own hardware from scratch, just use published designs, inspect them and then manufacture their own.

  • All they have to do is walk up to Microsoft and tell them they WILL do xyz. And let them know if they reveal it, they are violating national security and will be jailed.

  • Article is misdirection. If you can not figure it out, you have not been paying attention.
  • Shortly after we loaded Microsoft's Command Navigation Program hotfix, we were out cruising in our Battlestar when, poof, all our systems went offline and, a few seconds later, in came the nukes...

  • ... Microsoft's antitrust agreement with the DOJ [wikipedia.org] was overseen by the presiding judge of the FISA [wikipedia.org] court? My guess is that they needed to limit the amount of information concerning Windows inner workings being released to third parties where such inner workings were critical to intelligence gathering functions. Who other than a FISA court judge would be cleared to have the FBI/CIA/NSA call up and tell them to leave out details of certain interfaces?

Vitamin C deficiency is apauling.

Working...