Microsoft Source Code Exposed: What We Know & What It Means

Microsoft says there is no increase in security risk; however, experts say access to source code could make some steps easier for attackers.

Microsoft confirmed last week that attackers were able to view some of its source code, which it found during an ongoing investigation of the SolarWinds breach. While its threat-modeling approach mitigates the risk of viewing code, many questions remain that could determine the severity of this attack.
In a blog post published on Dec. 31, 2020, officials said Microsoft has not found evidence of access to production services or customer data, nor has it discovered that its systems were used to attack other companies. The company has not found indications of common tactics, techniques, and procedures (TTPs) linked to abuse of forged SAML tokens against its corporate domains.
It did find an internal account had been used to view source code in a number of code repositories, according to the
blog post
, from the Microsoft Security Response Center (MSRC). This activity was unearthed when investigators noticed unusual activity with a small number of internal accounts, the post explains, and the affected account didnt have permissions to change any code or engineering systems. The accounts were investigated and remediated, officials noted.
The news began to generate attention in the security community, and with good reason: Microsofts software is among the most widely deployed in the world, and organizations of all sizes rely on the companys products and services. Its an appealing target, in particular among advanced attackers like those behind the
SolarWinds incident
.
Its something they cant access themselves, and theres a lot of assumption that theres super-secret things there that are going to compromise [their] security, says Jake Williams, founder and president of Rendition Infosec, regarding why businesses might understandably panic at the news.
While its certainly concerning, and we dont know the full extent of what attackers could see, Microsofts threat-modeling strategy assumes attackers already have some knowledge of its source code. This inner source approach adopts practices from open source software development and culture, and it doesnt rely on the secrecy of source code for product security.
There are a lot of software vendors, and security vendors, that rely on the secrecy of their code to ensure security of applications, Williams explains. Microsoft made a big push for secure software development in Windows Vista. It didnt make the decision to open source the code but designed it with the assumption that could possibly happen someday. Source code is viewable within Microsoft, and viewing the source code isnt tied to heightened security risk.
If the code is all publicly released, there should not be new vulnerabilities discovered purely because that occurs, Williams adds.
Microsofts practice isnt common; for most organizations, the process of adopting the same approach and revamping their existing code base is too much work. However, Microsoft is a big enough target, with people regularly reverse engineering its code, that it makes sense.
While attackers were only able to view the source code, and not edit or change it, this level of access could prove helpful with some things — for example, writing rootkits. Microsoft, which did not provide additional detail for this story beyond its blog post, has not confirmed which source code was accessed and how that particular source code could prove helpful to an attacker.
Its one of many questions that remain following Microsofts update. What have the attackers already seen? Where was the affected code? Were the attackers able to access an account that allowed them to alter source code? There is still much we dont know regarding this intrusion.
This inner source approach still creates risk, writes Andrew Fife, vice president of marketing at Cycode, in a
blog post
on the news. Modern applications include microservices, libraries, APIs, and SDKs that often require authentication to deliver a core service. Its common for developers to write this data into source code with the assumption only insiders can see them.
While Microsoft claims their threat models assume that attackers have knowledge of source code, it would be far more reassuring if they directly addressed whether or not the breached code contained secrets, he writes. In the same way source code is a software companys IP, Fife adds, it can also be used to help reverse engineer and exploit an application.
This is an ongoing investigation, and we will continue to provide updates as they are known. In the meantime, Williams advises organizations to continue applying security patches as usual and stick with the infosec basics: review trust relationships, check your logging posture, and adopt the principles of least privilege and zero trust.
Supply chain attacks are really difficult to defend against, and it really comes back to infosec foundations, he says. If your model of protecting against an attack is give me an indicator of compromise and I will block that indicator, thats 90s thinking.

Last News
▸ Travel agency fined £150,000 for breaking Data Protection Act. ◂ Discovered: 23/12/2024 Category: security	▸ 7 arrested, 3 more charged in StubHub cyber fraud ring. ◂ Discovered: 23/12/2024 Category: security	▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Microsoft Source Code Exposed: What We Know & What It Means