The
company said in a blog post that the hackers were able to use
the key - which they acquired under undisclosed circumstances -
and take advantage of "a validation error in Microsoft code" to
carry out their cyberespionage campaign.
The blog provided the most fulsome explanation yet for a hack
that rattled both the cybersecurity industry and China-U.S.
relations. Beijing has denied any involvement in the spying.
Microsoft and U.S. officials said on Wednesday night that
Chinese state-linked hackers had been secretly since May
accessing email accounts at around 25 organizations. U.S.
officials said those included at least two government agencies:
the State and Commerce Departments.
Secretary of State Antony Blinken told China's top diplomat,
Wang Yi, in a meeting in Jakarta on Thursday that any action
that targets the U.S. government, U.S. companies or American
citizens "is of deep concern to us, and that we will take
appropriate action to hold those responsible accountable,"
according to a senior State Department official.
Microsoft's blog post did not explain how the hackers got their
hands on one of the company's digital keys, leading some experts
to speculate that Microsoft itself had been hacked ahead of the
thefts.
The company did not immediately respond to questions about the
key.
The breach has thrown Microsoft's security practices under
scrutiny, with officials and lawmakers calling on the Redmond,
Washington-based company to make its top level of digital
auditing, also called logging, available to all its customers
free of charge.
Microsoft said in a statement late on Thursday that it was
taking the criticism on board.
"We are evaluating feedback and are open to other models," the
company said, adding that it was "actively engaged" with U.S.
officials on the matter.
(Reporting by Raphael Satter; Editing by Sandra Maler)
[© 2023 Thomson Reuters. All rights
reserved.] Copyright 2022 Reuters. All rights reserved. This material may not be published,
broadcast, rewritten or redistributed.
Thompson Reuters is solely responsible for this content.
![](column_spacer.png)
|
|