Microsoft to warn users if their email accounts are being targeted by governments
PUBLISHED : Friday, 01 January, 2016, 4:21pm
UPDATED : Friday, 01 January, 2016, 4:21pm
Reuters in San Francisco
Microsoft said it already notifies users if accounts have been targeted or compromised by a third party but is taking the additional step of letting people know if it is likely that the attacker may be ‘state-sponsored’. Photo: Reuters
Microsoft Corp experts concluded several years ago that Chinese authorities had hacked into more than a thousand Hotmail email accounts, targeting international leaders of China’s Tibetan and Uygur minorities in particular - but it decided not to tell the victims, allowing the hackers to continue their campaign, according to former employees of the company.
On Wednesday, Microsoft said it would change its policy and in future tell its email customers when it suspects there has been a government hacking attempt. Microsoft spokesman Frank Shaw said the company was never certain of the origin of the Hotmail attacks.
The company also confirmed for the first time that it had not called, emailed or otherwise told the Hotmail users that their electronic correspondence had been collected. The company declined to say what role the exposure of the Hotmail campaign played in its decision to make the policy shift.
The first public signal of the attacks came in May 2011, though no direct link was immediately made with the Chinese authorities. That’s when security firm Trend Micro Inc announced it had found an email sent to someone in Taiwan that contained a miniature computer program.
The program took advantage of a previously undetected flaw in Microsoft’s own web pages to direct Hotmail and other free Microsoft email services to secretly forward copies of all of a recipient’s incoming mail to an account controlled by the attacker.
Trend Micro found more than a thousand victims, and Microsoft patched the vulnerability before the security company announced its findings publicly.
Microsoft also launched its own investigation that year, finding that some interception had begun in July 2009 and had compromised the emails of top Uygur and Tibetan leaders in multiple countries, as well as Japanese and African diplomats, human rights lawyers and others in sensitive positions inside China, two former Microsoft employees said.
Some of the attacks had come from a Chinese network known as AS4808, which has been associated with major spying campaigns, including a 2011 attack on EMC Corp’s security division RSA that US intelligence officials publicly attributed to China.
The Chinese government “is a resolute defender of cyber security and strongly opposes any forms of cyberattacks”, Chinese Foreign Ministry spokesman Lu Kang said, adding that it punishes any offenders in accordance with the law.
Microsoft officials did not dispute that most of the attacks came from China, but said some came from elsewhere. They did not give further detail.
“We weighed several factors in responding to this incident, including the fact that neither Microsoft nor the US government were able to identify the source of the attacks, which did not come from any single country,” the company said. “We also considered the potential impact on any subsequent investigation and ongoing measures we were taking to prevent potential future attacks.”
In announcing the new policy, Microsoft said: “As the threat landscape has evolved our approach has too, and we'll now go beyond notification and guidance to specify if we reasonably believe the attacker is `state-sponsored.'”
