Microsoft has admitted it was hit by an attack on a Java flaw which was also used to hit Facebook and Apple, indicating the hack may have been carried out by the same attackers.
“As reported by Facebook and Apple, Microsoft can confirm that we also recently experienced a similar security intrusion,” said Matt Thomlinson, general manager of Microsoft’s Trustworthy Computing Security, in a blog post on Friday.
Microsoft said it found a “small number of computers”, including some in its Mac business unit, that were infected by malicious software using techniques similar to those disclosed by Facebook and Apple.
“Consistent with our security response practices, we chose not to make a statement during the initial information gathering process,” Thomlinson wrote. “We have no evidence of customer data being affected and our investigation is ongoing.”
In reporting its hack Facebook said it had tracked the attackers back to systems in China.
Last week, security company Mandiant released a report suggesting a group associated with, or possibly part of, China’s People’s Liberation Army (PLA) was responsible for hitting a large number of English-speaking businesses, many based in the US. China has denied those claims.
Hacks on various media firms, including the New York Times and the Washington Post, have also been attributed to China, which it has also denied. Earlier this month Twitter said it was hit by an attack similar to those which hit the media outlets, resulting in the theft of about 250,000 user passwords.
Other reports suggested that the recent round of attacks on English-language media companies, which hit more than 40 companies, were carried out by an Eastern European hacker group.
Many of the recent attacks, including those on Apple and Facebook, were carried out via a previously unknown security flaw in Java, according to the companies involved. Facebook said it had notified Oracle of the flaw, which Facebook indicated was patched in a 1 February Java update.
How well do you know Apple? Take our quiz.
Suspended prison sentence for Craig Wright for “flagrant breach” of court order, after his false…
Cash-strapped south American country agrees to sell or discontinue its national Bitcoin wallet after signing…
Google's change will allow advertisers to track customers' digital “fingerprints”, but UK data protection watchdog…
Welcome to Silicon In Focus Podcast: Tech in 2025! Join Steven Webb, UK Chief Technology…
European Commission publishes preliminary instructions to Apple on how to open up iOS to rivals,…
San Francisco jury finds Nima Momeni guilty of second-degree murder of Cash App founder Bob…
View Comments
This really should be taken more seriously. Oracle has destroyed Java’s reputation, and it is barely even needed for anything anymore! To avoid the risk, pretty much everyone should disable it in their browser. Here is how if anyone needs a hand http://disablejava.com