Normal view

There are new articles available, click to refresh the page.
Today — 18 May 2024Main stream

How China is using AI news anchors to deliver its propaganda

18 May 2024 at 03:00

News avatars are proliferating on social media and experts say they will spread as the technology becomes more accessible

The news presenter has a deeply uncanny air as he delivers a partisan and pejorative message in Mandarin: Taiwan’s outgoing president, Tsai Ing-wen, is as effective as limp spinach, her period in office beset by economic under performance, social problems and protests.

“Water spinach looks at water spinach. Turns out that water spinach isn’t just a name,” says the presenter, in an extended metaphor about Tsai being “Hollow Tsai” – a pun related to the Mandarin word for water spinach.

Continue reading...

💾

© Photograph: Storm-1376

💾

© Photograph: Storm-1376

Microsoft to start enforcing Azure multi-factor authentication in July – Source: www.bleepingcomputer.com

microsoft-to-start-enforcing-azure-multi-factor-authentication-in-july-–-source:-wwwbleepingcomputer.com

Source: www.bleepingcomputer.com – Author: Sergiu Gatlan Starting in July, Microsoft will begin gradually enforcing multi-factor authentication (MFA) for all users signing into Azure to administer resources. After first completing the rollout for the Azure portal, the MFA enforcement will see a similar rollout for CLI, PowerShell, and Terraform. Redmond says customers will also receive additional […]

La entrada Microsoft to start enforcing Azure multi-factor authentication in July – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Yesterday — 17 May 2024Main stream

Microsoft Plans Boldest Games Bet Since Activision Deal, Changing How 'Call of Duty' Is Sold

By: msmash
17 May 2024 at 10:00
Microsoft plans a major shakeup of its videogame sales strategy by releasing the coming installment of Call of Duty to its subscription service instead of the longtime, lucrative approach of only selling it a la carte. WSJ: The plans, which mark the biggest change to Microsoft's gaming division since it closed the $75 billion takeover of Activision Blizzard, are expected to be announced at the company's annual Xbox showcase next month, according to people familiar with the matter. Call of Duty is one of the most successful entertainment properties ever, generating over $30 billion in lifetime revenue. Activision, which makes it, has long released new editions annually, selling about 25 million copies on average, selling for around $70 each in recent years. Before the Microsoft deal last year, Activision was reluctant to fully embrace subscription-based models for a game that still attracts a premium price. Microsoft's subscription service, Game Pass, costs $9.99 to $16.99 a month, and provides access to hundreds of games from Microsoft and dozens of other companies.

Read more of this story at Slashdot.

Zero-Trust DNS – Source: www.schneier.com

zero-trust-dns-–-source:-wwwschneier.com

Source: www.schneier.com – Author: Bruce Schneier Zero-Trust DNS Microsoft is working on a promising-looking protocol to lock down DNS. ZTDNS aims to solve this decades-old problem by integrating the Windows DNS engine with the Windows Filtering Platform—the core component of the Windows Firewall—directly into client devices. Jake Williams, VP of research and development at consultancy […]

La entrada Zero-Trust DNS – Source: www.schneier.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Microsoft shares temp fix for Outlook encrypted email reply issues – Source: www.bleepingcomputer.com

microsoft-shares-temp-fix-for-outlook-encrypted-email-reply-issues-–-source:-wwwbleepingcomputer.com

Source: www.bleepingcomputer.com – Author: Sergiu Gatlan ​Microsoft has shared a temporary fix for a known issue preventing Microsoft 365 customers from replying to encrypted emails using the Outlook Desktop client. This confirms customer reports regarding these issues when using the classic Outlook clients shared on Microsoft’s community website in recent months. According to online reports, […]

La entrada Microsoft shares temp fix for Outlook encrypted email reply issues – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Microsoft: Windows Server 2019 updates fail with 0x800f0982 errors – Source: www.bleepingcomputer.com

microsoft:-windows-server-2019-updates-fail-with-0x800f0982-errors-–-source:-wwwbleepingcomputer.com

Source: www.bleepingcomputer.com – Author: Sergiu Gatlan ​Microsoft has acknowledged a new known issue causing this month’s KB5037765 security update for Windows Server 2019 to fail to install with 0x800f0982 errors. “Windows servers attempting to install the May 2024 security update (KB5037765), released May 14, 2024, might face issues during the installation process,” Microsoft explains on […]

La entrada Microsoft: Windows Server 2019 updates fail with 0x800f0982 errors – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Before yesterdayMain stream

'Microsoft's Quest For Short-Term $$$ is Doing Long-Term Damage To Windows, Surface, Xbox, and Beyond'

By: msmash
16 May 2024 at 10:40
In an op-ed on Windows Central, the site's co-managing editor Jez Corden laments Microsoft's "short-sighted" decision-making and "inconsistent" investment in its products and services, which he argues has led to a loss of trust among customers and missed opportunities in the tech industry. Despite Microsoft's advancements in AI and cloud computing, the company has made "baffling" decisions such as shutting down Windows Phone, under-investing in Xbox, and canceling promising Surface products. The author argues that Microsoft's lack of commitment to security, customer support, and long-term quality has "damaged" its reputation and hindered its potential for growth. Examples include recent hacking scandals, poor customer service experiences, and the aggressive promotion of Microsoft Edge at the expense of user choice. The author also expresses concern over Microsoft's handling of the Xbox brand, particularly the decision to release exclusive games on PlayStation, which could undermine the reasons for customers to choose Xbox. The op-ed concludes that while Microsoft has the potential to be a leader in the tech industry, its pattern of short-sighted decisions and failure to learn from past mistakes has led to a growing sense of doubt among its customers and observers.

Read more of this story at Slashdot.

Zero-Trust DNS – Source: securityboulevard.com

zero-trust-dns-–-source:-securityboulevard.com

Source: securityboulevard.com – Author: Bruce Schneier Microsoft is working on a promising-looking protocol to lock down DNS. ZTDNS aims to solve this decades-old problem by integrating the Windows DNS engine with the Windows Filtering Platform—the core component of the Windows Firewall—directly into client devices. Jake Williams, VP of research and development at consultancy Hunter Strategy, […]

La entrada Zero-Trust DNS – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Microsoft Asks Hundreds of China-Based AI Staff To Consider Relocating Amid US-China Tensions

By: msmash
16 May 2024 at 10:00
Microsoft is asking hundreds of employees in its China-based cloud-computing and AI operations to consider transferring outside the country, as tensions between Washington and Beijing mount around the critical technology. WSJ: Such staff, mostly engineers with Chinese nationality, were recently offered the opportunity to transfer to countries including the U.S., Ireland, Australia and New Zealand, people familiar with the matter said. The company is asking about 700 to 800 people [non-paywalled link], who are involved in machine learning and other work related to cloud computing, one of the people said.ÂThe move by one of America's biggest cloud-computing and AI companies comes as the Biden administration seeks to put tighter curbs around China's capability to develop state-of-the-art AI. The White House is considering new rules that would require Microsoft and other U.S. cloud-computing companies to get licenses before giving Chinese customers access to AI chips.

Read more of this story at Slashdot.

Zero-Trust DNS

16 May 2024 at 07:03

Microsoft is working on a promising-looking protocol to lock down DNS.

ZTDNS aims to solve this decades-old problem by integrating the Windows DNS engine with the Windows Filtering Platform—the core component of the Windows Firewall—directly into client devices.

Jake Williams, VP of research and development at consultancy Hunter Strategy, said the union of these previously disparate engines would allow updates to be made to the Windows firewall on a per-domain name basis. The result, he said, is a mechanism that allows organizations to, in essence, tell clients “only use our DNS server, that uses TLS, and will only resolve certain domains.” Microsoft calls this DNS server or servers the “protective DNS server.”...

The post Zero-Trust DNS appeared first on Security Boulevard.

Zero-Trust DNS

16 May 2024 at 07:03

Microsoft is working on a promising-looking protocol to lock down DNS.

ZTDNS aims to solve this decades-old problem by integrating the Windows DNS engine with the Windows Filtering Platform—the core component of the Windows Firewall—directly into client devices.

Jake Williams, VP of research and development at consultancy Hunter Strategy, said the union of these previously disparate engines would allow updates to be made to the Windows firewall on a per-domain name basis. The result, he said, is a mechanism that allows organizations to, in essence, tell clients “only use our DNS server, that uses TLS, and will only resolve certain domains.” Microsoft calls this DNS server or servers the “protective DNS server.”

By default, the firewall will deny resolutions to all domains except those enumerated in allow lists. A separate allow list will contain IP address subnets that clients need to run authorized software. Key to making this work at scale inside an organization with rapidly changing needs. Networking security expert Royce Williams (no relation to Jake Williams) called this a “sort of a bidirectional API for the firewall layer, so you can both trigger firewall actions (by input *to* the firewall), and trigger external actions based on firewall state (output *from* the firewall). So instead of having to reinvent the firewall wheel if you are an AV vendor or whatever, you just hook into WFP.”

Windows Quick Assist abused in Black Basta ransomware attacks – Source: www.bleepingcomputer.com

windows-quick-assist-abused-in-black-basta-ransomware-attacks-–-source:-wwwbleepingcomputer.com

Source: www.bleepingcomputer.com – Author: Sergiu Gatlan ​Financially motivated cybercriminals abuse the Windows Quick Assist feature in social engineering attacks to deploy Black Basta ransomware payloads on victims’ networks. Microsoft has been investigating this campaign since at least mid-April 2024, and, as they observed, the threat group (tracked as Storm-1811) started their attacks by email bombing […]

La entrada Windows Quick Assist abused in Black Basta ransomware attacks – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Microsoft's AI Push Imperils Climate Goal As Carbon Emissions Jump 30%

By: BeauHD
16 May 2024 at 03:00
Microsoft's ambitious goal to be carbon negative by 2030 is threatened by its expanding AI operations, which have increased its carbon footprint by 30% since 2020. To meet its targets, Microsoft must quickly adopt green technologies and improve efficiency in its data centers, which are critical for AI but heavily reliant on carbon-intensive resources. Bloomberg reports: Now to meet its goals, the software giant will have to make serious progress very quickly in gaining access to green steel and concrete and less carbon-intensive chips, said Brad Smith, president of Microsoft, in an exclusive interview with Bloomberg Green. "In 2020, we unveiled what we called our carbon moonshot. That was before the explosion in artificial intelligence," he said. "So in many ways the moon is five times as far away as it was in 2020, if you just think of our own forecast for the expansion of AI and its electrical needs." [...] Despite AI's ravenous energy consumption, this actually contributes little to Microsoft's hike in emissions -- at least on paper. That's because the company says in its sustainability report that it's 100% powered by renewables. Companies use a range of mechanisms to make such claims, which vary widely in terms of credibility. Some firms enter into long-term power purchase agreements (PPAs) with renewable developers, where they shoulder some of a new energy plant's risk and help get new solar and wind farms online. In other cases, companies buy renewable energy credits (RECs) to claim they're using green power, but these inexpensive credits do little to spur new demand for green energy, researchers have consistently found. Microsoft uses a mix of both approaches. On one hand, it's one of the biggest corporate participants in power purchase agreements, according to BloombergNEF, which tracks these deals. But it's also a huge purchaser of RECs, using these instruments to claim about half of its energy use is clean, according to its environmental filings in 2022. By using a large quantity of RECs, Microsoft is essentially masking an even larger growth in emissions. "It is Microsoft's plan to phase out the use of unbundled RECs in future years," a spokesperson for the company said. "We are focused on PPAs as a primary strategy." So what else can be done? Smith, along with Microsoft's Chief Sustainability Officer Melanie Nakagawa, has laid out clear steps in the sustainability report. High among them is to increase efficiency, which is to use the same amount of energy or computing to do more work. That could help reduce the need for data centers, which will reduce emissions and electricity use. On most things, "our climate goals require that we spend money," said Smith. "But efficiency gains will actually enable us to save money." Microsoft has also been at the forefront of buying sustainable aviation fuels that has helped reduce some of its emissions from business travel. The company also wants to partner with those who will "accelerate breakthroughs" to make greener steel, concrete and fuels. Those technologies are starting to work at a small scale, but remain far from being available in commercial quantities even if expensive. Cheap renewable power has helped make Microsoft's climate journey easier. But the tech giant's electricity consumption last year rivaled that of a small European country -- beating Slovenia easily. Smith said that one of the biggest bottlenecks for it to keep getting access to green power is the lack of transmission lines from where the power is generated to the data centers. That's why Microsoft says it's going to increase lobbying efforts to get governments to speed up building the grid. If Microsoft's emissions remain high going into 2030, Smith said the company may consider bulk purchases of carbon removal credits, even though it's not "the desired course." "You've got to be willing to invest and pay for it," said Smith. Climate change is "a problem that humanity created and that humanity can solve."

Read more of this story at Slashdot.

Microsoft fixes a bug abused in QakBot attacks plus a second under exploit – Source: go.theregister.com

microsoft-fixes-a-bug-abused-in-qakbot-attacks-plus-a-second-under-exploit-–-source:-gotheregister.com

Source: go.theregister.com – Author: Team Register Happy May Patch Tuesday. We’ve got a lot of vendors joining this month’s patchapalooza, which includes a handful of bugs that have been exploited — either in the wild or at Pwn2Own — and now fixed by Microsoft, Apple, Google and VMware. Starting with Microsoft: Redmond disclosed and fixed […]

La entrada Microsoft fixes a bug abused in QakBot attacks plus a second under exploit – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

No mayday call necessary for the year’s fifth Patch Tuesday – Source: news.sophos.com

no-mayday-call-necessary-for-the-year’s-fifth-patch-tuesday-–-source:-newssophos.com

Source: news.sophos.com – Author: Angela Gunn The deluge of patches in April dried up substantially in May, as Microsoft on Tuesday released 59 patches touching 11 product families. Windows as usual takes the lion’s share of patches with 48, with the rest spread among .NET, 365 Apps for Enterprise, Azure, Bing Search for iOS, Dynamics […]

La entrada No mayday call necessary for the year’s fifth Patch Tuesday – Source: news.sophos.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Microsoft fixes VPN failures caused by April Windows updates – Source: www.bleepingcomputer.com

microsoft-fixes-vpn-failures-caused-by-april-windows-updates-–-source:-wwwbleepingcomputer.com

Source: www.bleepingcomputer.com – Author: Sergiu Gatlan Today, ​Microsoft fixed a known issue breaking VPN connections across client and server platforms after installing the April 2024 Windows security updates. “Windows devices might face VPN connection failures after installing the April 2024 security update or the April 2024 non-security preview update,” Redmond explains on the Windows health […]

La entrada Microsoft fixes VPN failures caused by April Windows updates – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Microsoft Windows DWM Zero-Day Poised for Mass Exploit – Source: www.darkreading.com

microsoft-windows-dwm-zero-day-poised-for-mass-exploit-–-source:-wwwdarkreading.com

Source: www.darkreading.com – Author: Tara Seals, Managing Editor, News, Dark Reading Source: Wim Wiskerke via Alamy Stock Photo A trio of zero-days headline Microsoft’s May Patch Tuesday update, which offers a modest spring bouquet of 59 CVEs in total (just a third of last month’s downpour of patches for admins to deal with). But at […]

La entrada Microsoft Windows DWM Zero-Day Poised for Mass Exploit – Source: www.darkreading.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Microsoft Fixes Three Zero-Days in May Patch Tuesday – Source: www.infosecurity-magazine.com

microsoft-fixes-three-zero-days-in-may-patch-tuesday-–-source:-wwwinfosecurity-magazine.com

Source: www.infosecurity-magazine.com – Author: 1 System administrators have over 60 CVEs to address in the latest Microsoft Patch Tuesday, including three zero-day vulnerabilities. Of these three zero-day bugs, two have been actively exploited in the wild, the most prominent of which (CVE-2024-30051) has been used to deliver QuakBot and other malware. It is an elevation […]

La entrada Microsoft Fixes Three Zero-Days in May Patch Tuesday – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Apple, SpaceX, Microsoft return-to-office mandates drove senior talent away

14 May 2024 at 10:40
Someone holding a box with their belonging in an office

Enlarge (credit: Getty)

A study analyzing Apple, Microsoft, and SpaceX suggests that return to office (RTO) mandates can lead to a higher rate of employees, especially senior-level ones, leaving the company, often to work at competitors.

The study (PDF), published this month by University of Chicago and University of Michigan researchers and reported by The Washington Post on Sunday, says:

In this paper, we provide causal evidence that RTO mandates at three large tech companies—Microsoft, SpaceX, and Apple—had a negative effect on the tenure and seniority of their respective workforce. In particular, we find the strongest negative effects at the top of the respective distributions, implying a more pronounced exodus of relatively senior personnel.

The study looked at résumé data from People Data Labs and used "260 million résumés matched to company data." It only examined three companies, but the report's authors noted that Apple, Microsoft, and SpaceX represent 30 percent of the tech industry's revenue and over 2 percent of the technology industry's workforce. The three companies have also been influential in setting RTO standards beyond their own companies. Robert Ployhart, a professor of business administration and management at the University of South Carolina and scholar at the Academy of Management, told the Post that despite the study being limited to three companies, its conclusions are a broader reflection of the effects of RTO policies in the US.

Read 8 remaining paragraphs | Comments

Melinda Gates To Resign From Gates Foundation

By: BeauHD
13 May 2024 at 19:20
Melinda French Gates announced today she is stepping down from the Bill and Melinda Gates Foundation, three years after announcing her separation from Microsoft co-founder Bill Gates. With her departure as co-chair, the foundation will change its name to Gates Foundation and Bill Gates will be its sole chairperson, said CEO Mark Suzman. NBC News reports: In a statement posted on her Instagram account, she said that as part of her agreement to step down from the foundation, she will retain $12.5 billion that she plans to put toward her ongoing work supporting women and families. "This is not a decision I came to lightly," French Gates wrote. "I am immensely proud of the foundation that Bill and I built together and of the extraordinary work it is doing to address inequities around the world." In a separate statement, Bill Gates said, "I am sorry to see Melinda leave, but I am sure she will have a huge impact in her future philanthropic work." Now worth $75.2 billion, the Gates Foundation has over the course of its three-decade lifespan made $77.6 billion worth of grant payments, making it one of the largest donor organizations in the world, with a focus on health and developmental goals. It is one of the largest contributors to the World Health Organization, and played a key role in efforts to address the Covid pandemic. "After a difficult few years watching women's rights rolled back in the U.S. and around the world, she wants to use this next chapter to focus specifically on altering that trajectory," Suzman said of French Gates. "I want to reassure you that the millions of people our work serves and the thousands of partners we work alongside can continue to count on the foundation. The foundation today is stronger than it has ever been." "I know we all wish Melinda the best in her next chapter," he added, noting that French Gates "will not be bringing any of the foundation's work with her when she leaves."

Read more of this story at Slashdot.

Microsoft Places Uses AI To Find the Best Time For Your Next Office Day

By: msmash
13 May 2024 at 16:01
An anonymous reader shares a report: Microsoft is attempting to solve the hassle of coordinating with colleagues on when everyone will be in the office. It's a problem that emerged with the increase in hybrid and flexible work after the recent covid-19 pandemic, with workers spending less time in the office. Microsoft Places is an AI-powered app that goes into preview today and should help businesses that rely on Outlook and Microsoft Teams to better coordinate in-office time together. "When employees get to the office, they don't want to be greeted by a sea of empty desks -- they want face-time with their manager and the coworkers they collaborate with most frequently," says Microsoft's corporate vice president of AI at work, Jared Spataro, in a blog post. "With Places, you can more easily coordinate across coworkers and spaces in the office."

Read more of this story at Slashdot.

Microsoft is Finally Changing Word's Annoying Default Paste Behavior

By: msmash
13 May 2024 at 14:08
An anonymous reader shares a report: The default pasting behavior of Microsoft Word is a nightmare, and has been forever. If you want to add a text or image using the standard option, you can easily mess up the entire formatting in the text if a completely different font suddenly appears. After many years of complaints, Microsoft is finally listening to user feedback and changing the default behavior when pasting in Word. From now on, the source's formatting will no longer be automatically retained. Instead, "Merge formatting" will be the new default for everyone, as Microsoft explained in a blog post this week. This means that after the update, newly pasted text will take on the font size, font type, and color of the text written in Word. However, special features such as lists or italicized elements will be retained. If you want these elements to be automatically adapted to the Word text, you must select the option "Keep text only."

Read more of this story at Slashdot.

Microsoft Set To Face EU Competition Charges Over Teams Software

By: msmash
13 May 2024 at 10:43
The European Commission is set to issue new antitrust charges [non-paywalled link] against Microsoft over concerns that the tech giant is undermining competitors to its videoconferencing app Teams, according to FT. The move comes after Microsoft offered concessions last month, including a global plan to unbundle Teams from other software such as Office, in an attempt to avoid regulatory action. The EU officials remain concerned that the company's efforts do not sufficiently ensure fairness in the market, the newspaper said. Rivals worry that Microsoft will make Teams run more compatibly with its own software compared to competitor apps, and that the lack of data portability makes it difficult for existing Teams users to switch to alternatives. The case, which originated from a formal complaint submitted by Slack (now owned by Salesforce) in 2020, is now escalating with the Commission's impending formal charge sheet against Microsoft.

Read more of this story at Slashdot.

Report: Microsoft to face antitrust case over Teams

13 May 2024 at 10:03
Report: Microsoft to face antitrust case over Teams

Enlarge (credit: Microsoft)

Brussels is set to issue new antitrust charges against Microsoft over concerns that the software giant is undermining rivals to its videoconferencing app Teams.

According to three people with knowledge of the move, the European Commission is pressing ahead with a formal charge sheet against the world’s most valuable listed tech company over concerns it is restricting competition in the sector.

Microsoft last month offered concessions as it sought to avoid regulatory action, including extending a plan to unbundle Teams from other software such as Office, not just in Europe but across the world.

Read 13 remaining paragraphs | Comments

How Microsoft Employees Pressured the Company Over Its Oil Industry Ties

13 May 2024 at 07:34
The non-profit environmental site Grist reports on "an internal, employee-led effort to raise ethical concerns about Microsoft's work helping oil and gas producers boost their profits by providing them with cloud computing resources and AI software tools." There's been some disappointments — but also some successes, starting with the founding of an internal sustainability group within Microsoft that grew to nearly 10,000 employees: Former Microsoft employees and sources familiar with tech industry advocacy say that, broadly speaking, employee pressure has had an enormous impact on sustainability at Microsoft, encouraging it to announce industry-leading climate goals in 2020 and support key federal climate policies. But convincing the world's most valuable company to forgo lucrative oil industry contracts proved far more difficult... Over the past seven years, Microsoft has announced dozens of new deals with oil and gas producers and oil field services companies, many explicitly aimed at unlocking new reserves, increasing production, and driving up oil industry profits... As concerns over the company's fossil fuel work mounted, Microsoft was gearing up to make a big sustainability announcement. In January 2020, the company pledged to become "carbon negative" by 2030, meaning that in 10 years, the tech giant would pull more carbon out of the air than it emitted on an annual basis... For nearly two years, employees watched and waited. Following its carbon negative announcement, Microsoft quickly expanded its internal carbon tax, which charges the company's business groups a fee for the carbon they emit via electricity use, employee travel, and more. It also invested in new technologies like direct air capture and purchased carbon removal contracts from dozens of projects worldwide. But Microsoft's work with the oil industry continued unabated, with the company announcing a slew of new partnerships in 2020 and 2021 aimed at cutting fossil fuel producers' costs and boosting production. The last straw for one technical account manager was a 2023 LinkedIn post by a Microsoft technical architect about the company's work on oil and gas industry automation. The post said Microsoft's cloud service was "unlocking previously inaccessible reserves" for the fossil fuel industry, promising that with Microsoft's Azure service, "the future of oil and gas exploration and production is brighter than ever." The technical account manager resigned from the position they'd held for nearly a decade, citing the blog post in a resignation letter which accused Microsoft of "extending the age of fossil fuels, and enabling untold emissions." Thanks to Slashdot reader joshuark for sharing the news.

Read more of this story at Slashdot.

Microsoft's Xbox Is Planning More Cuts After Studio Closings

By: msmash
9 May 2024 at 10:15
The sudden closure of several video-game studios at Microsoft's Xbox division was the result of a widespread cost-cutting initiative that still isn't finished. From a report: This week, Xbox began offering voluntary severance agreements to producers, quality assurance testers and other staff at ZeniMax, which it purchased in 2020 for $7.5 billion, according to people familiar with the company's plans. Others across the Xbox organization have been told that more cuts are on the way. Employees were shocked by the unexpected shuttering Tuesday of three Xbox subsidiaries and the absorption of a fourth. The closures included Tokyo-based Tango Gameworks, which last year released the critically acclaimed action game Hi-Fi Rush. Tango was in the process of pitching a sequel, said the people, who asked not to be identified discussing nonpublic information. During a town hall with ZeniMax staff on Wednesday morning, Xbox president Matt Booty praised Hi-Fi Rush but did not specify why the company had shut down the development studio behind it, according to three people who were in attendance. Speaking about the closures more broadly, Booty said that the company's studios had been spread too thin -- like "peanut butter on bread" -- and that leaders across the division had felt understaffed. They decided to close these studios to free up resources elsewhere, he said. Booty added that the shutdown of subsidiary Arkane Austin, the longtime developer of games such as Prey, was not connected to the performance of its new multiplayer game, Redfall, a critical and commercial flop.

Read more of this story at Slashdot.

Microsoft launches AI chatbot for spies

7 May 2024 at 15:22
A person using a computer with a computer screen reflected in their glasses.

Enlarge (credit: Getty Images)

Microsoft has introduced a GPT-4-based generative AI model designed specifically for US intelligence agencies that operates disconnected from the Internet, according to a Bloomberg report. This reportedly marks the first time Microsoft has deployed a major language model in a secure setting, designed to allow spy agencies to analyze top-secret information without connectivity risks—and to allow secure conversations with a chatbot similar to ChatGPT and Microsoft Copilot. But it may also mislead officials if not used properly due to inherent design limitations of AI language models.

GPT-4 is a large language model (LLM) created by OpenAI that attempts to predict the most likely tokens (fragments of encoded data) in a sequence. It can be used to craft computer code and analyze information. When configured as a chatbot (like ChatGPT), GPT-4 can power AI assistants that converse in a human-like manner. Microsoft has a license to use the technology as part of a deal in exchange for large investments it has made in OpenAI.

According to the report, the new AI service (which does not yet publicly have a name) addresses a growing interest among intelligence agencies to use generative AI for processing classified data, while mitigating risks of data breaches or hacking attempts. ChatGPT normally  runs on cloud servers provided by Microsoft, which can introduce data leak and interception risks. Along those lines, the CIA announced its plan to create a ChatGPT-like service last year, but this Microsoft effort is reportedly a separate project.

Read 4 remaining paragraphs | Comments

Microsoft shuts down Bethesda’s Hi-Fi Rush, Redfall studios

7 May 2024 at 11:28
Artist's conception of Microsoft telling <em>Hi-Fi Rush</em> maker Tango Gameworks they no longer exist as a studio.

Enlarge / Artist's conception of Microsoft telling Hi-Fi Rush maker Tango Gameworks they no longer exist as a studio. (credit: Tango Gameworks)

Microsoft is shutting down four studios within its Bethesda Softworks subsidiary, according to a staff email obtained by IGN. The closures include Redfall developer Arkane Austin and Hi-Fi Rush studio Tango Gameworks. While some team members will be reassigned to other parts of the company, head of Xbox Game Studios Matt Booty said in a letter to staffers "that some of our colleagues will be leaving us."

Tango Gameworks confirmed in a short social media message that "Hi-Fi Rush, along with Tango's previous titles [like The Evil Within], will remain available and playable everywhere they are today." But the closure of Arkane Austin means that "development will not continue on Redfall," the company wrote in its own social media update. "Arkane Lyon will continue their focus on immersive experiences where they are hard at work on their upcoming project [Marvel's Blade]."

In his note to staff, Booty said that [Redfall] “will remain online for players to enjoy and we will provide make-good offers to players who purchased the Hero DLC.”

Read 7 remaining paragraphs | Comments

New Microsoft AI model may challenge GPT-4 and Google Gemini

6 May 2024 at 15:51
Mustafa Suleyman, co-founder and chief executive officer of Inflection AI UK Ltd., during a town hall on day two of the World Economic Forum (WEF) in Davos, Switzerland, on Wednesday, Jan. 17, 2024.

Enlarge / Mustafa Suleyman, co-founder and chief executive officer of Inflection AI UK Ltd., during a town hall on day two of the World Economic Forum (WEF) in Davos, Switzerland, on Wednesday, Jan. 17, 2024. Suleyman joined Microsoft in March. (credit: Getty Images)

Microsoft is working on a new large-scale AI language model called MAI-1, which could potentially rival state-of-the-art models from Google, Anthropic, and OpenAI, according to a report by The Information. This marks the first time Microsoft has developed an in-house AI model of this magnitude since investing over $10 billion in OpenAI for the rights to reuse the startup's AI models. OpenAI's GPT-4 powers not only ChatGPT but also Microsoft Copilot.

The development of MAI-1 is being led by Mustafa Suleyman, the former Google AI leader who recently served as CEO of the AI startup Inflection before Microsoft acquired the majority of the startup's staff and intellectual property for $650 million in March. Although MAI-1 may build on techniques brought over by former Inflection staff, it is reportedly an entirely new large language model (LLM), as confirmed by two Microsoft employees familiar with the project.

With approximately 500 billion parameters, MAI-1 will be significantly larger than Microsoft's previous open source models (such as Phi-3, which we covered last month), requiring more computing power and training data. This reportedly places MAI-1 in a similar league as OpenAI's GPT-4, which is rumored to have over 1 trillion parameters (in a mixture-of-experts configuration) and well above smaller models like Meta and Mistral's 70 billion parameter models.

Read 3 remaining paragraphs | Comments

Microsoft plans to lock down Windows DNS like never before. Here’s how.

3 May 2024 at 19:42
Microsoft plans to lock down Windows DNS like never before. Here’s how.

Enlarge (credit: Getty Images)

Translating human-readable domain names into numerical IP addresses has long been fraught with gaping security risks. After all, lookups are rarely end-to-end encrypted. The servers providing domain name lookups provide translations for virtually any IP address—even when they’re known to be malicious. And many end-user devices can easily be configured to stop using authorized lookup servers and instead use malicious ones.

Microsoft on Friday provided a peek at a comprehensive framework that aims to sort out the Domain Name System (DNS) mess so that it’s better locked down inside Windows networks. It’s called ZTDNS (zero trust DNS). Its two main features are (1) encrypted and cryptographically authenticated connections between end-user clients and DNS servers and (2) the ability for administrators to tightly restrict the domains these servers will resolve.

Clearing the minefield

One of the reasons DNS has been such a security minefield is that these two features can be mutually exclusive. Adding cryptographic authentication and encryption to DNS often obscures the visibility admins need to prevent user devices from connecting to malicious domains or detect anomalous behavior inside a network. As a result, DNS traffic is either sent in clear text or it's encrypted in a way that allows admins to decrypt it in transit through what is essentially an adversary-in-the-middle attack.

Read 12 remaining paragraphs | Comments

Microsoft overhaul treats security as ‘top priority’ after a series of failures

3 May 2024 at 17:01

Microsoft is making security its number one priority for every employee, following years of security issues and mounting criticisms. After a scathing report from the US Cyber Safety Review Board recently concluded that “Microsoft’s security culture was inadequate and requires an overhaul,” it’s doing just that by outlining a set of security principles and goals that are tied to compensation packages for Microsoft’s senior leadership team.

↫ Tom Warren at The Verge

The devil is in the details regarding tying executive pay to security performance, but it we take it at face value and assume good intent – which is a laughable assumption in our corporatist world, but alas – I would like to see more of this. It’s high time executives start paying – literally and figuratively – for the failings of the companies and teams they claim to run.

Microsoft ties executive pay to security following multiple failures and breaches

3 May 2024 at 16:25
A PC running Windows 11.

Enlarge / A PC running Windows 11. (credit: Microsoft)

It's been a bad couple of years for Microsoft's security and privacy efforts. Misconfigured endpoints, rogue security certificates, and weak passwords have all caused or risked the exposure of sensitive data, and Microsoft has been criticized by security researchers, US lawmakers, and regulatory agencies for how it has responded to and disclosed these threats.

The most high-profile of these breaches involved a China-based hacking group named Storm-0558, which breached Microsoft's Azure service and collected data for over a month in mid-2023 before being discovered and driven out. After months of ambiguity, Microsoft disclosed that a series of security failures gave Storm-0558 access to an engineer's account, which allowed Storm-0558 to collect data from 25 of Microsoft's Azure customers, including US federal agencies.

In January, Microsoft disclosed that it had been breached again, this time by Russian state-sponsored hacking group Midnight Blizzard. The group was able "to compromise a legacy non-production test tenant account" to gain access to Microsoft's systems for "as long as two months."

Read 8 remaining paragraphs | Comments

Microsoft Overhauls Cybersecurity Strategy After Scathing CSRB Report

3 May 2024 at 13:47

Microsoft security chief Charlie Bell pledges significant reforms and a strategic shift to prioritize security above all other product features.

The post Microsoft Overhauls Cybersecurity Strategy After Scathing CSRB Report appeared first on SecurityWeek.

At Microsoft, years of security debt come crashing down

2 May 2024 at 17:47

Years of accumulated security debt at Microsoft are seemingly crashing down upon the company in a manner that many critics warned about, but few ever believed would actually come to light. 

Microsoft is an entrenched enterprise provider, owning nearly one-quarter of the global cloud infrastructure services market and, as of Q1 last year, nearly 20% of the worldwide SaaS application market, according to Synergy Research Group.

Though not immune to scandal, in the wake of two major nation-state breaches of its core enterprise platforms, Microsoft is facing one of its most serious reputational crises.

↫ David Jones at Cybersecurity Dive

It’s almost like having the entire US government dependent on a single vendor is a bad idea.

Just spitballing here.

April updates for Windows 10 and 11 break some VPN software, Microsoft says

2 May 2024 at 10:41
April updates for Windows 10 and 11 break some VPN software, Microsoft says

Enlarge (credit: Microsoft)

Microsoft is currently investigating a bug in its most recent batch of Windows 10 and Windows 11 updates that is preventing some VPN software from working properly. The company updated its list of known Windows issues to say that it has recreated the issue on its end and that it's currently working on a fix.

The VPN issue affects all currently supported versions of Windows: Windows 10 21H2 and 22H2; Windows 11 versions 21H2, 22H2, and 23H2; and Windows Server 2008, 2008 R2, 2012, 2012 R2, 2016, 2019, and 2022.

Microsoft says the problem was caused by update KB5036893, which was initially released on April 9, 2024. The update makes "miscellaneous security improvements to internal OS functionality," among a few other minor changes. The company hasn't provided specific information on what's been broken or what needs fixing, noting only that PCs "might face VPN connection failures" after installing the update.

Read 1 remaining paragraphs | Comments

Email Microsoft didn’t want seen reveals rushed decision to invest in OpenAI

1 May 2024 at 15:05
Email Microsoft didn’t want seen reveals rushed decision to invest in OpenAI

Enlarge (credit: HJBC | iStock Editorial / Getty Images Plus)

In mid-June 2019, Microsoft co-founder Bill Gates and CEO Satya Nadella received a rude awakening in an email warning that Google had officially gotten too far ahead on AI and that Microsoft may never catch up without investing in OpenAI.

With the subject line "Thoughts on OpenAI," the email came from Microsoft's chief technology officer, Kevin Scott, who is also the company’s executive vice president of AI. In it, Scott said that he was "very, very worried" that he had made "a mistake" by dismissing Google's initial AI efforts as a "game-playing stunt."

It turned out, Scott suggested, that instead of goofing around, Google had been building critical AI infrastructure that was already paying off, according to a competitive analysis of Google's products that Scott said showed that Google was competing even more effectively in search. Scott realized that while Google was already moving on to production for "larger scale, more interesting" AI models, it might take Microsoft "multiple years" before it could even attempt to compete with Google.

Read 17 remaining paragraphs | Comments

The BASIC programming language turns 60

1 May 2024 at 12:17
Part of the cover illustration from

Enlarge / Part of the cover illustration from "The Applesoft Tutorial" BASIC manual that shipped with the Apple II computer starting in 1981. (credit: Apple, Inc.)

Sixty years ago, on May 1, 1964, at 4 am in the morning, a quiet revolution in computing began at Dartmouth College. That's when mathematicians John G. Kemeny and Thomas E. Kurtz successfully ran the first program written in their newly developed BASIC (Beginner's All-Purpose Symbolic Instruction Code) programming language on the college's General Electric GE-225 mainframe.

Little did they know that their creation would go on to democratize computing and inspire generations of programmers over the next six decades.

What is BASIC?

In its most traditional form, BASIC is an interpreted programming language that runs line by line, with line numbers. A typical program might look something like this:

Read 13 remaining paragraphs | Comments

How not to release historic source code

26 April 2024 at 20:31

Regarding the release of the MS-DOS 4.00 source code, Michal Necasek makes an excellent point about how just dumping the code in git is a terrible and destructive way to release older source code.

It’s terrific that the source code for DOS 4.00/4.01 was released! But don’t expect to build the source code mutilated by git without problems.

Historic source code should be released simply as an archive of files, ZIP or tar or 7z or whatever, with all timestamps preserved and every single byte kept the way it was. Git is simply not a suitable tool for this.

↫ Michal Necasek at OS/2 Museum

The problems caused by dumping the code in git are quite real. Timestamps are not preserved, and the conversion to UTF-8 is deeply destructive, turning some parts of the code to literal gibberish. It’s a bit of a mess, and the people responsible for these release should be more careful and considerate.

Microsoft open-sources MS-DOS 4.00, releases early beta of MS-DOS 4.0 (multitasking)

26 April 2024 at 14:32

Today, in partnership with IBM and in the spirit of open innovation, we’re releasing the source code to MS-DOS 4.00 under the MIT license. There’s a somewhat complex and fascinating history behind the 4.0 versions of DOS, as Microsoft partnered with IBM for portions of the code but also created a branch of DOS called Multitasking DOS that did not see a wide release.

↫ Scott Hanselman

Not only did they release the source code to MS-DOS 4.00, they also released disk images of a very early version of Multitasking DOS, which did not see a wide release, as the article states. I’ve only vaguely heard of MT-DOS over the decades, so I had to do some minor reading and research to untangle what, exactly, MT-DOS really is. Much of this information is probably table stakes for the many older readers we have, but bear with me.

MT-DOS, which has the official name MS-DOS 4.0 (often further specified by adding “multitasking” in brackets after the version number) was a version of MS-DOS developed by Microsoft based on MS-DOS 2.0, whose headlining feature was pre-emptive multitasking, which allowed specifically written applications to continue to run in a special background mode. Interestingly enough, it had to perform this multitasking with the same 640k memory limitation as other versions of DOS. Very few OEMs ended up licensing it, and most notably IBM wasn’t interested, so after one or two more OEM-specific versions, it was quickly abandoned by Microsoft.

MS-DOS 4.0 (multitasking) is entirely unrelated to the “real” versions 4 of MS-DOS that followed later. The actual version 4 was called MS-DOS 4.00, and it’s the source code to this specific version that’s being released as open source today. MS-DOS 4.00 was quickly followed by 4.01 and 4.01a, but apparently OEMs would confusingly still label 4.01 disks as “MS-DOS 4.0”. The whole MS-DOS 4 saga is quite convoluted and messy, and I’m probably oversimplifying a great deal.

Regardless, this code joins the open source releases of MS-DOS 1.25 and 2.0 that Microsoft released years ago.

Microsoft and Security Incentives

23 April 2024 at 07:09

Former senior White House cyber policy director A. J. Grotto talks about the economic incentives for companies to improve their security—in particular, Microsoft:

Grotto told us Microsoft had to be “dragged kicking and screaming” to provide logging capabilities to the government by default, and given the fact the mega-corp banked around $20 billion in revenue from security services last year, the concession was minimal at best.

[…]

“The government needs to focus on encouraging and catalyzing competition,” Grotto said. He believes it also needs to publicly scrutinize Microsoft and make sure everyone knows when it messes up.

“At the end of the day, Microsoft, any company, is going to respond most directly to market incentives,” Grotto told us. “Unless this scrutiny generates changed behavior among its customers who might want to look elsewhere, then the incentives for Microsoft to change are not going to be as strong as they should be.”

Breaking up the tech monopolies is one of the best things we can do for cybersecurity.

Microsoft Uncovers GooseEgg Malware: A New Weapon in Russian State Hackers’ Arsenal

By: Editorial
23 April 2024 at 07:09

GooseEgg malware

Microsoft researchers uncovered a new tool in the Russian state hackers’ arsenal that helped them gain elevated access, pilfer credentials and allowed lateral movement within compromised networks. Dubbed GooseEgg malware, this sophisticated tool exploits a vulnerability identified as CVE-2022-38028 in the Windows Print Spooler service, responsible for managing printing processes. Redmond fixed the vulnerability that gave attackers system privileges in its October 2022 Patch Tuesday stating the bug’s exploitation is “most likely.” It is yet to flag the flaw as actively exploited in its assessment. 

Hackers Leverage the GooseEgg Malware to Exploit Windows Devices

GooseEgg malware is exclusively used by a group that the tech giant tracks as “Forest Blizzard,” which the United States and United Kingdom governments closely links to the Unit 26165 of Russia’s military intelligence agency, the GRU.  Forest Blizzard, also known as Fancy Bear and APT28, has deployed GooseEgg since at least June 2020, targeting state, non-governmental, educational and transportation entities across Ukraine, Western Europe and North America, Microsoft said.  “The use of GooseEgg in Forest Blizzard operations is a unique discovery that had not been previously reported by security providers,” Redmond said. Upon gaining access to a target device, Forest Blizzard used GooseEgg to escalate privileges within the network. Although GooseEgg itself functions as a basic launcher application, it enables attackers to execute remote code, implant backdoors and traverse compromised networks laterally.

The Rise of Forest Blizzard Hackers

Forest Blizzard additionally exploits other vulnerabilities including CVE-2023-23397, which impacts all versions of Microsoft Outlook software on Windows devices and is known to be exploited. This critically rated bug allows attackers to steal the Net-NTLM hash from the victims, enabling the attackers to assume a victim identity and to move deeper into the organization.  In a December warning, Microsoft cautioned that Forest Blizzard was leveraging the Microsoft Outlook bug to illicitly access email accounts within Microsoft Exchange servers since April 2022.   Forest Blizzard primarily targets government, energy, transportation and non-governmental organizations in the United States, Europe and the Middle East but Microsoft said it had observed the GRU hackers focus shift to media, information technology, sports organizations and educational institutions worldwide.   “Forest Blizzard continually refines its footprint by employing new custom techniques and malware, suggesting that it is a well-resourced and well-trained group posing long-term challenges to attribution and tracking its activities,” Microsoft said.   Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

US Cyber Safety Review Board on the 2023 Microsoft Exchange Hack

9 April 2024 at 09:56

The US Cyber Safety Review Board released a report on the summer 2023 hack of Microsoft Exchange by China. It was a serious attack by the Chinese government that accessed the emails of senior US government officials.

From the executive summary:

The Board finds that this intrusion was preventable and should never have occurred. The Board also concludes that Microsoft’s security culture was inadequate and requires an overhaul, particularly in light of the company’s centrality in the technology ecosystem and the level of trust customers place in the company to protect their data and operations. The Board reaches this conclusion based on:

  1. the cascade of Microsoft’s avoidable errors that allowed this intrusion to succeed;
  2. Microsoft’s failure to detect the compromise of its cryptographic crown jewels on its own, relying instead on a customer to reach out to identify anomalies the customer had observed;
  3. the Board’s assessment of security practices at other cloud service providers, which maintained security controls that Microsoft did not;
  4. Microsoft’s failure to detect a compromise of an employee’s laptop from a recently acquired company prior to allowing it to connect to Microsoft’s corporate network in 2021;
  5. Microsoft’s decision not to correct, in a timely manner, its inaccurate public statements about this incident, including a corporate statement that Microsoft believed it had determined the likely root cause of the intrusion when in fact, it still has not; even though Microsoft acknowledged to the Board in November 2023 that its September 6, 2023 blog post about the root cause was inaccurate, it did not update that post until March 12, 2024, as the Board was concluding its review and only after the Board’s repeated questioning about Microsoft’s plans to issue a correction;
  6. the Board’s observation of a separate incident, disclosed by Microsoft in January 2024, the investigation of which was not in the purview of the Board’s review, which revealed a compromise that allowed a different nation-state actor to access highly-sensitive Microsoft corporate email accounts, source code repositories, and internal systems; and
  7. how Microsoft’s ubiquitous and critical products, which underpin essential services that support national security, the foundations of our economy, and public health and safety, require the company to demonstrate the highest standards of security, accountability, and transparency.

The report includes a bunch of recommendations. It’s worth reading in its entirety.

The board was established in early 2022, modeled in spirit after the National Transportation Safety Board. This is their third report.

Here are a few news articles.

EDITED TO ADD (4/15): Adam Shostack has some good commentary.

Microsoft Exchange breach from 2023 was Microsoft’s fault

4 April 2024 at 15:19

In May and June 2023, a threat actor compromised the Microsoft Exchange Online mailboxes of 22 organizations and over 500 individuals around the world. The actor—known as Storm-0558 and assessed to be affiliated with the People’s Republic of China in pursuit of espionage objectives—accessed the accounts using authentication tokens that were signed by a key Microsoft had created in 2016. This intrusion compromised senior United States government representatives working on national security matters, including the email accounts of Commerce Secretary Gina Raimondo, United States Ambassador to the People’s Republic of China R. Nicholas Burns, and Congressman Don Bacon.

[…]

The Board finds that this intrusion was preventable and should never have occurred. The Board also concludes that Microsoft’s security culture was inadequate and requires an overhaul, particularly in light of the company’s centrality in the technology ecosystem and the level of trust customers place in the company to protect their data and operations.

↫ Cyber Safety Review Board’s report

The Cyber Safety Review Board reviewed the attack on Microsoft Exchange from last year, with Microsoft’s cooperation, and it turns out it was kind of a complete and utter shitshow inside Microsoft – a cascade of failures, as the report calls it – and concludes that it was an entirely preventable attack. The report is not kind to Microsoft, and it’s a very interesting read if you’re into this sort of post mortems of security breaches.

Surveillance by the New Microsoft Outlook App

4 April 2024 at 07:07

The ProtonMail people are accusing Microsoft’s new Outlook for Windows app of conducting extensive surveillance on its users. It shares data with advertisers, a lot of data:

The window informs users that Microsoft and those 801 third parties use their data for a number of purposes, including to:

  • Store and/or access information on the user’s device
  • Develop and improve products
  • Personalize ads and content
  • Measure ads and content
  • Derive audience insights
  • Obtain precise geolocation data
  • Identify users through device scanning

Commentary.

Microsoft is working on an Xbox AI chatbot

2 April 2024 at 18:07

Microsoft is currently testing a new AI-powered Xbox chatbot that can be used to automate support tasks. Sources familiar with Microsoft’s plans tell The Verge that the software giant has been testing an “embodied AI character” that animates when responding to Xbox support queries. I understand this Xbox AI chatbot is part of a larger effort inside Microsoft to apply AI to its Xbox platform and services.

↫ Tom Warren at The Verge

I’m convinced. This is the future. Artificial intelligence, AI, no quotation marks.

Please, Microsoft. Train this AI on Xbox voice chat and messages. What could possible go wrong?

Microsoft to separate Teams and Office globally amid antitrust scrutiny

1 April 2024 at 10:10

Microsoft will sell its chat and video app Teams separately from its Office product globally, the U.S. tech giant said on Monday, six months after it unbundled the two products in Europe in a bid to avert a possible EU antitrust fine.

The European Commission has been investigating Microsoft’s tying of Office and Teams since a 2020 complaint by Salesforce-owned competing workspace messaging app Slack.

↫ Foo Yun Chee at Reuters

I honestly misread this as Microsoft selling Teams off, which would’ve been far bigger news. Unbundling Teams from Office globally is just Microsoft applying its recent European Union policy to the rest of the world. All we need now is Microsoft to stop trying to make Teams for families and friends happen, because nobody will ever want to use Teams for anything, let alone personal use.

❌
❌