Microsoft joins list of companies hacked this month

Microsoft has joined the long list of companies whose websites have been hacked in the past one month. Mere days after high-profile attacks on Apple, Twitter and Facebook, Microsoft admitted that a “small number” of its computers were attacked.

In a blog post, Matt Thomlinson, General Manager of Trustworthy Computing Security of Microsoft, wrote that the company faced a security intrusion similar to that of Apple and Facebook. Some of Microsoft’s computers, including a few in its Mac business units, were infected by malicious software that used similar techniques to break into other high-profile websites. Microsoft has claimed, like almost every other company that was hacked in February, that user-data remained untouched during this breach.

Microsoft attacked too (Image credit: The Daily Caller)

Consistent with security practices, Thomlinson says Microsoft kept mum about the attack until the initial round of investigations was finished. “This type of cyber attack is no surprise to Microsoft and other companies that must grapple with determined and persistent adversaries,” Thomlinson wrote. ”We continually re-evaluate our security posture and deploy additional people, processes, and technologies as necessary to help prevent future unauthorised access to our networks.”

More from News & Analysis

What is the US HIRE Bill and why is India’s $250-billion IT sector worried? Is the internet dead? What's this theory that OpenAI's Sam Altman says might be true?

All of these attacks look like they utilise a Zero Day Java vulnerability to breach the sites. Twitter was one of the first websites to own-up to a breach earlier in February, and also admit that data of about 250,000 users may have been compromised. Twitter wrote in its blog that it detected “unusual access patterns that led to us identifying unauthorized access attempts to Twitter user data.” The company claimed that it managed to detect and shut down a live attack within moments, but its investigation indicated that the attackers may have found limited user information.

The micro-blogging site wrote that the hackers could have had access to usernames, email addresses, session tokens and encrypted/salted versions of passwords for approximately 250,000 users. As a precautionary measure, Twitter sent out emails to these users letting them know that the site had reset their passwords and revoked security tokens for their accounts. All these users had to create new passwords to access their accounts.

Facebook got off lighter, as only a few employee computers were infected with malware and no user data was compromised. The incident occurred when a handful of employees visited a mobile developer website that had been compromised. The discovery was made by Facebook security last month but the social networking site was quick to point out that it had found “no evidence that Facebook user data was compromised.”

Apple too said that it had been hacked and that a “small number” of employee computers were affected in an attack that exploited a Java vulnerability. The malware had been specially designed to attack Macs. Apple found that the malware was installing itself using a vulnerability in the Java plug-in for browsers and immediately released updates to patch it up. The update for Mac OS X updated the Java version to 1.6.0_41, and if the version was lower than 2012-006, the Java SE 6 plug-in was completely blocked out.