‘Largest-ever the world has seen’: Microsoft president claims 1,000+ software engineers must have worked on SolarWinds breech

The SolarWinds breach was the largest and most sophisticated ever discovered, Microsoft’s Brad Smith told CBS. The network framed the breach as a reckless Russian hack attack that the NSA was unable to spot in time.

The multifaceted breach, best-known for the company SolarWinds and its software, affected thousands of government and private computers in the US. It was first made public in December 2020 and was quickly blamed by people in Washington on Moscow. Microsoft was among companies whose electronic credentials were exploited.

Speaking to CBS’s ‘60 Minutes’ program, Microsoft President Brad Smith said that “from a software engineering perspective, it's probably fair to say that this is the largest and most sophisticated attack the world has ever seen.”

The company tasked 500 software engineers to analyze what had happened. Smith said “certainly more than 1,000” similar specialists were involved in working on the breach itself. “Almost certainly, these attacks are continuing,” he added.

Smith was one of several guests interviewed for the program, which purports to explain how “Russian spies” hacked key departments of the US government and learned their secrets. The experts helped paint a picture of an intelligence operation that was “unprecedented in audacity and scope” and part of an under-the-radar “cyber war” between the US and Russia.

Moscow has “outsmarted” the DHS and “circumvented” the NSA, which “gathers intelligence overseas, but is prohibited from surveilling US computer networks,” according to the program.

But when it comes to tools at their disposal, Washington is apparently still way ahead, judging by the words of ‘60 Minutes' guest Jon Miller, whose firm creates cyber warfare weapons for the US government.

“I build things much more sophisticated than this,” he bragged. But the ‘Russian’ operation was “a watershed style attack. I would never do something like this. It creates too much damage.”

Program host Bill Whitaker and guests speculated how Russia probably wanted to “foment chaos” and could “destroy all the computers” affected by the breach or otherwise cause significant damage to the US. Its scope is still to be fully determined, and Moscow is not going to stop, ‘60 Minutes’ found. Moscow has denied any responsibility for the SolarWinds breach.

So supposedly the Russians should rest assured that the US only deploys its cyber arsenals responsibly, and with a surgical precision. That was presumably the case when the Obama administration reportedly carried off a cyberattack against Russian infrastructure that was the “digital equivalent of bombs,” or when the Trump administration allegedly stepped up its intrusions into the Russian power grid.

CBS claimed that the 2017 WannaCry and NotPetya ransomware epidemic was a kind of dry run for a supply-chain type of attack perpetrated by Russia. This type of intrusion compromises a less-protected trusted source of software to get into a more-protected target. SolarWinds’ popular Orion software was one such trusted source in a wider operation attributed to Russia.

‘60 Minutes’ omitted the fact that the viruses utilized an exploit developed by the NSA, which was leaked by the hacker group Shadow Brokers. Microsoft notably said at the time that the US spy agency was responsible for the damage. Like its other alphabetic colleagues in the US intelligence community, the agency allowed its weapons to be stolen and hoarded exploits instead of helping software producers patch vulnerabilities, the show reported.

Think your friends would be interested? Share this story!