Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 16 submissions in the queue.

Microsoft Discovers Supply Chain Attack at Unnamed Maker of PDF Software

posted by chromas on Saturday July 28 2018, @04:20AM   Printer-friendly
from the too-small-to-be-named dept.

MrPlow writes:

Submitted via IRC for BoyceMagooglyMonkey

Microsoft said today that hackers compromised a font package installed by a PDF editor app and used it to deploy a cryptocurrency miner on users' computers.

The OS maker discovered the incident after its staff received alerts via the Windows Defender ATP, the commercial version of the Windows Defender antivirus.

Microsoft employees say they investigated the alerts and determined that hackers breached the cloud server infrastructure of a software company providing font packages as MSI files. These MSI files were offered to other software companies.

One of these downstream companies was using these font packages for its PDF editor app, which would download the MSI files from the original company's cloud servers during the editor's installation routine.

[...] Microsoft did not reveal the names of the two software companies involved in this incident. The OS maker says the compromise lasted between January and March 2018, and affected only a small number of users, suggesting the hacked companies aren't big names on the PDF software market.

Indicators of compromise are available in Microsoft's report on the attack, here.

Source: https://www.bleepingcomputer.com/news/security/microsoft-discovers-supply-chain-attack-at-unnamed-maker-of-pdf-software/

Original Submission

 
This discussion has been archived. No new comments can be posted.
Microsoft Discovers Supply Chain Attack at Unnamed Maker of PDF Software | Log In/Create an Account | Top | 8 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 5, Insightful) by Rosco P. Coltrane on Saturday July 28 2018, @05:25AM (1 child)

    by Rosco P. Coltrane (4757) on Saturday July 28 2018, @05:25AM (#713933)

    The only real message in that "annoucement" from Microsoft is that only Microsoft Windows Defender ATP detected the attack, and you should purchase a license too if you care about your computerv - because ooh, look at the big bad malware it's caught!

    No real information on the unspecified PDF editor that was targeted (I'd like to know so I can avoid installing ir perhaps), the exact font package I should avoid, or the cloud provider that was supposedly breached...

    But hey, Windows Defender ATP is great!

    Starting Score:    1  point
    Moderation   +3  
       Insightful=3, Total=3
    Extra 'Insightful' Modifier   0  
    Karma-Bonus Modifier   +1  
    Total Score:   5  

  • (Score: 1, Funny) by Anonymous Coward on Saturday July 28 2018, @10:46AM

    by Anonymous Coward on Saturday July 28 2018, @10:46AM (#713963)

    "Installing Microsoft Windows Defender ATP ... please wait"

    "Downloading font packages ... please wait"

    "Enter your Bitcoin wallet ID for authentication ... please wait"