Connect with us

Software

According to Microsoft, hackers stole its email signing key. Kind of

blank

Published

on

blank

China-backed hackers stole a digital skeleton key to access US government emails.

A China-backed hacking group stole one of Microsoft’s email keys, allowing near-unfettered access to U.S. government inboxes, due to a series of unfortunate and cascading mistakes. Microsoft revealed how the hackers pulled off the heist in a long-awaited blog post this week. Although one mystery was solved, several crucial details remain unknown.

In July, Microsoft disclosed that Storm-0558 hackers, which it believes are backed by China, “acquired” an email signing key used to secure Outlook.com accounts. The hackers broke into government officials’ Microsoft-hosted personal and enterprise email accounts using that digital skeleton key. The hack targeted unclassified emails of U.S. government officials and diplomats, including Commerce Secretary Gina Raimondo and Ambassador to China Nicholas Burns.

The hackers’ source of that consumer email signing key was unknown until this week, when Microsoft revealed the five issues that led to its leak.

Microsoft reported in its blog that a consumer key signing system crashed in April 2021. The crash created a system snapshot for analysis. This consumer key signing system is “highly isolated and restricted” from the internet to prevent cyberattacks. Microsoft was unaware that the system crash resulted in a snapshot image containing the consumer signing key #1, which they failed to detect in snapshot#2 .

The snapshot image was “subsequently moved from the isolated production network into our debugging environment on the internet connected corporate network” to determine the system crash. Microsoft confirmed its standard debugging process, but credential scanning did not detect the key in snapshot image#3.

After the snapshot image was moved to Microsoft’s corporate network in April 2021, Microsoft said the Storm-0558 hackers were able to “successfully compromise” a Microsoft engineer’s corporate account, which had access to the snapshot image’s debugging environment, which contained the consumer signing key. Microsoft said “we don’t have logs with specific evidence of this exfiltration,” but this was the “most probable mechanism by which the actor acquired the key.”

Microsoft stated that its email systems were not properly validating the consumer signing key#4, allowing access to enterprise and corporate email accounts of various organizations and government departments. The company stated that its email system would accept a request for enterprise email using a security token signed with the consumer key#5.

Mystery solved? Not quite

Microsoft’s admission that the consumer signing key was likely stolen from its systems ends the speculation that it was obtained elsewhere.

How the intruders hacked Microsoft is unknown. Jeff Jones, senior director at Microsoft, told that “token-stealing malware” compromised the engineer’s account but declined to comment.

Phishing and malicious links can spread token-stealing malware that steals session tokens. Session tokens are small files that keep users logged in without having to re-enter a password or two-factor authentication. Thus, stolen session tokens can give an attacker full access without the user’s password or two-factor code.

Last year, a teenage hacking team called Lapsus$ used malware to steal Uber employee passwords and session tokens. CircleCi was compromised in January after its antivirus software missed token-stealing malware on an engineer’s laptop. After hackers broke into LastPass’s cloud storage via a compromised developer’s computer, customers’ password vaults were breached.

How the Microsoft engineer’s account was compromised could help network defenders prevent future incidents. The engineer’s work computer or a personal device Microsoft allowed on its network may have been compromised. The real culprits for the compromise are the network security policies that failed to block the (albeit highly skilled) intruder, so focusing on an engineer seems unfair.

Cybersecurity is difficult even for corporate mega-giants with nearly unlimited cash and resources. Even if they failed, Microsoft engineers considered a wide range of complex threats and cyberattacks when designing protections and defenses for the company’s most sensitive and critical systems. Storm-0558 hacked into Microsoft’s network by chance or knowing it would find the keys to its email kingdom. It’s a reminder that cybercriminals only need to succeed once.

No analogy fits this unique breach or circumstances. It’s possible to admire a bank’s vault security while acknowledging the robbers who stole the loot inside.

It will be some time before the full extent of the espionage campaign is known, and the remaining victims whose emails were accessed are unknown. The Cyber Security Review Board, a group of security experts that analyzes major cybersecurity incidents, will investigate the Microsoft email breach and other issues “relating to cloud-based identity and authentication infrastructure.”

 

As Editor here at GeekReply, I'm a big fan of all things Geeky. Most of my contributions to the site are technology related, but I'm also a big fan of video games. My genres of choice include RPGs, MMOs, Grand Strategy, and Simulation. If I'm not chasing after the latest gear on my MMO of choice, I'm here at GeekReply reporting on the latest in Geek culture.

Apps

Mark Zuckerberg reports that Threads has a total of 150 million users who engage with the app on a monthly basis

blank

Published

on

blank

Threads, Meta’s alternative to Twitter and X, is experiencing consistent and steady growth. During the Q1 2024 earnings call, Mark Zuckerberg stated that the social network currently has over 150 million monthly active members, which is an increase from 130 million in February.

Threads made significant progress in integrating with ActivityPub, the decentralized protocol that powers networks such as Mastodon, during the last quarterly earnings conference. In March, the firm granted U.S.-based users who are 18 years of age or older the ability to link their accounts to the Fediverse, enabling their posts to be seen on other servers.

By June, the business intends to make its API available to a broad range of developers, enabling them to create experiences centered on the social network. Nevertheless, it remains uncertain whether Threads will enable developers to create comprehensive third-party clients.

Meta just introduced their AI chatbot on various platforms like Facebook, Messenger, WhatsApp, and Instagram. Threads was conspicuously omitted from this list, perhaps because of its lack of built-in direct messaging capabilities.

Threads introduced a new test feature on Wednesday that allows users to automatically archive their posts after a certain length of time. Additionally, users have the ability to store or remove specific postings from an archive and make them accessible to the public.

Threads is around nine months old, and Meta has consistently expanded its readership. Nevertheless, Threads cannot be considered a viable substitute for X, as Instagram’s head, Adam Mosseri, explicitly stated in October that Threads will not “amplify news on the platform.” However, Meta’s social network continues to grow in popularity. According to app analytics company Apptopia, Threads now has more daily active users in the U.S. than X, as Business Insider reported earlier this week.

Continue Reading

Android

TikTok Shop is now introducing its collection of pre-owned high-end fashion items to customers in the United Kingdom

blank

Published

on

blank

TikTok Shop, the social commerce marketplace of TikTok, is introducing a new section dedicated to secondhand luxury items in the United Kingdom. This move positions TikTok Shop in direct rivalry with existing platforms such as The RealReal, Vestiaire Collective, Depop, Poshmark, and Mercari. The offering has been present at TikTok Shop U.S. for a duration exceeding six months.

The addition of this new category enables clients in the United Kingdom to conveniently buy second-hand luxury garments, designer purses, and various accessories from within the TikTok application. Upon its inception, the platform offers a selection of only five British brands, namely Sellier, Luxe Collective, Sign of the Times, HardlyEverWornIt, and Break Archive.

Since its introduction in 2022, TikTok Shop has generated sales of approximately $1 billion or more in merchandise value. Nevertheless, despite its triumph, some contend that TikTok Shop is undermining the short-form video-sharing platform, alleging that counterfeit and substandard merchandise are inundating the market. The purchase of pre-owned luxury goods online carries the greatest danger of encountering counterfeit products, even for major e-commerce platforms such as Amazon, eBay, and others, which also struggle with ensuring authenticity.

TikTok Shop, like other resale marketplaces, implements an anti-counterfeit policy that ensures a complete reimbursement in the event that a seller is verified to have sold a counterfeit item. Bloomberg has disclosed that the corporation is engaged in discussions with luxury goods company LVMH to enhance efforts to combat counterfeiting.

Every secondhand brand on TikTok Shop in the U.S. must possess certificates from third-party authenticators. TikTok collaborated with authentication providers Entrupy and Real Authentication to verify the authenticity of designer handbags available on the platform.

Concurrently, a representative from TikTok informed me that the five British brands each possess their own internal verification procedure. They declined to provide the commencement date for accepting secondhand brands other than their own.

TikTok Shop’s introduction of a used luxury category is a calculated maneuver to access the expanding market for previously owned high-end goods. The secondhand luxury market is a prosperous industry valued at around $49.3 billion (€45 billion) in 2023, with global sales of pre-owned designer items.

Moreover, this expansion is in line with the growing inclination of individuals towards adopting preloved fashion, and it creates new opportunities for secondhand brands in the U.K. to access a broader client demographic. The prevalence of secondhand fashion on TikTok is apparent, as seen by more than 144,000 TikTok postings utilizing the hashtag #secondhandfashion, resulting in nearly 1.2 billion views.

Today’s statement follows closely after the U.S. House of Representatives passed a bill mandating that ByteDance sell TikTok or else risk a ban in the U.S. This bill seems to be gaining favor in the Senate. An embargo would have a significant impact on American merchants who sell their products on the application. As per the company’s statement, the brief video-sharing application produced a total of $14.7 billion in revenue for small- to mid-size enterprises in the year 2023.

Continue Reading

Android

Airchat, developed by Naval Ravikant, is a social application that focuses on conversation rather than written messages

blank

Published

on

blank

Airchat is a recently developed social media application that promotes and encourages users to engage in open and spontaneous conversations.

Last year, a previous iteration of Airchat was released. However, yesterday the team, which included Naval Ravikant, the founder of AngelList, and Brian Norgard, a former product executive for Tinder, rebuilt the application and reintroduced it on both iOS and Android platforms. At present, Airchat is exclusively accessible via invitation. However, it has already achieved a ranking of #27 in the social networking category on Apple’s App Store.

Airchat has a user interface that is visually familiar and easy to understand. Users can follow other users, navigate through a feed of posts, and interact with those posts by replying, liking, and sharing them. The distinction comes from the fact that the content consists of audio recordings for both posts and replies, which are subsequently converted into written form by the application.

Airchat automatically starts sending messages, which you can quickly navigate through by vertically swiping up and down. If you have the desire, you have the option to pause the audio and only read the text. Additionally, users have the capability to exchange photographs and videos. However, it appears that audio is the main point of interest for everyone, and Ravikant explains that it has the potential to significantly change the way social apps function, especially when contrasted to text-based platforms.

blank

Upon my recent enrollment in Airchat, the majority of the messages I encountered pertained to the application itself. Notably, Ravikant and Norgard actively engaged in responding to inquiries and seeking input from users.

“All humans are inherently capable of harmonious interactions with one another; it simply necessitates the use of our innate communication abilities,” Ravikant stated. “The prevalence of online text-only media has created the false belief that people are unable to get along, when in reality, everyone is capable of getting along.”

Past instances have seen digital entrepreneurs placing their bets on speech as the upcoming significant trend in social media. However, Airchat’s utilization of asynchronous, threaded messages provides a distinct experience compared to the transient live chat rooms that briefly gained popularity on Clubhouse and Twitter Spaces. Norgard claimed that this method eliminates the obstacle of stage fright when it comes to participation, as individuals have the freedom to make multiple attempts at producing a message without anybody being aware.

Indeed, he stated that during discussions with the first users, the team discovered that the majority of individuals currently utilizing AirChat exhibit introverted and timid characteristics.

Personally, I have not yet persuaded myself to publish anything. I was primarily intrigued by observing how other individuals were utilizing the application. Additionally, I had a complex emotional connection with the auditory perception of my own speech.

However, there is value in listening to Ravikant and Norgard articulate their perspective instead of solely relying on written transcriptions, as the latter may overlook subtle aspects such as excitement and tone. I am particularly interested in observing how deadpan humor and shitposting are conveyed, or not, in audio format.

I also encountered some difficulty with the velocity. The application automatically sets the audio playing to double the normal speed, which I found to be artificial, especially considering that the main purpose is to promote human interaction. To reset the speed, simply press and hold the pause button. However, when the speed is set to 1x, I observed that I would begin to skim through longer postings while listening, and I would often jump forward before listening to the entire audio. However, perhaps that is acceptable.

blank

However, Ravikant’s conviction in the efficacy of speech to reduce hostility does not always obviate the requirement for content-filtering functionalities. According to him, the feed operates based on intricate regulations that aim to conceal spam, trolls, and those that either you or they may prefer not to receive messages from. However, at the time of publication, he had not yet replied to a subsequent user inquiry regarding content moderation.

When questioned about monetization, namely the introduction of advertisements, whether in audio format or otherwise, Ravikant stated that the company is currently not under any obligation to generate revenue. (He characterized himself as “not the exclusive investor” but rather as a significant stakeholder in the company.)

“Monetization is of little importance to me,” he stated. “We will operate this project with minimal financial resources if necessary.”

Continue Reading

Trending