Hillicon Valley: US, UK authorities say Russian hackers exploited Microsoft vulnerabilities | Lawmakers push for more cyber funds in annual appropriations | Google child care workers ask for transportation stipend
Welcome to Hillicon Valley, The Hill’s newsletter detailing all you need to know about the tech and cyber news from Capitol Hill to Silicon Valley. If you don’t already, be sure to sign up for our newsletter by clicking HERE.
Welcome! Follow our cyber reporter, Maggie Miller (@magmill95), and tech team, Chris Mills Rodrigo (@chrisismills) and Rebecca Klar (@rebeccaklar_), for more coverage.
American and British authorities said Friday that Russian state-sponsored hackers exploited major vulnerabilities in Microsoft’s Exchange Server, which were previously used by at least one Chinese state-sponsored hacking group to compromise potentially thousands of organizations. Meanwhile, lawmakers on both sides of the aisle are pushing hard for more cyber funding in the annual appropriations bills, and Google child care workers are pushing for a transportation stipend from the company.
TWO HACKS COLLIDE: Russian state-sponsored hackers were among those to exploit recently uncovered vulnerabilities in Microsoft’s Exchange Server email application, which potentially compromised thousands of organizations, a coalition of American and British federal agencies warned Friday.
The finding was part of a joint advisory released Friday by the FBI, the National Security Agency, the Cybersecurity and Infrastructure Security Agency and the United Kingdom’s National Cyber Security Centre that detailed cybersecurity tactics and techniques Russia’s Foreign Intelligence Service, or SVR, uses to hack global organizations.
The agencies warned that the SVR had been “observed making use of numerous vulnerabilities, most recently the widely reported Microsoft Exchange vulnerability,” and that the Russian hackers deploy webshells on servers they are able to breach, along with using them for “further exploits.”
The agencies also stressed in the advisory, written by British authorities, that the SVR is “a technologically sophisticated and highly capable cyber actor” that had “developed capabilities to target organisations globally, including in the UK, US, Europe, NATO member states and Russia’s neighbours.”
Microsoft in March announced it had uncovered previously unknown vulnerabilities in its Exchange Server program, and that at least one Chinese state-sponsored hacking group was exploiting the vulnerabilities to access thousands of organizations around the world for at least two months prior to discovery.
The incident came on the heels of the SolarWinds hack, first discovered late last year, which involved Russian hackers compromising software from the IT group to breach nine federal agencies and at least 100 private sector groups.
Read more about the alert here.
SHOW CYBER THE MONEY: Lawmakers are increasingly pushing for Congress to increase funding in numerous areas to boost the nation’s cybersecurity, particularly after multiple major breaches and a year in which hackers have increasingly targeted critical infrastructure.
House Homeland Security Committee ranking member John Katko (R-N.Y.) is leading the effort, submitting a budget proposal this week, provided to The Hill, that calls for increasing the Cybersecurity and Infrastructure Security Agency’s (CISA) budget by 25 percent in the next fiscal year.
The overall amount Katko requested that Congress appropriate for CISA, the key federal agency in charge of securing critical infrastructure, was $2.5 billion, higher than President Biden’s proposed $2.1 billion for the agency’s budget in fiscal year 2021.
CISA is not the only area where House lawmakers are hoping to see increased cybersecurity investments made.
Energy and Commerce Chairman Frank Pallone (D-N.J.), ranking member Cathy McMorris Rodgers (R-Wash.), and Reps. Doris Matsui (D-Calif.) and Brett Guthrie (R-Ky.) sent a separate letter to the House Appropriations Committee on Thursday asking for funding to secure communications networks.
Read more about the funding calls here.
TRANSPORTATION ASK: A group of Google workers who provide child care services and education for other employees’ kids are circulating a petition urging the Silicon Valley giant to provide them a stipend to cover transportation costs.
Many of the 148 workers are being asked to return to in-person child care services this week after working online throughout the pandemic, but the shuttle transportation system remains offline.
“Childcare workers never expected or anticipated being called back to on-site work while Google’s transportation services are still suspended,” reads the petition, which is being circulated by the Alphabet Workers Union.
Workers who asked for assistance say they were told “transportation is just a perk, not a benefit” by Google.
The Hill has reached out to the company for comment on the petition.
Nearly 100 Alphabet workers had signed the petition as of Friday afternoon calling for child care workers to get a $1,500 per month stipend until transportation operations resume.
Alphabet reported $17.9 billion in net revenue in the first quarter of 2021.
UNBLOCKED: Texas Attorney General Ken Paxton (R) unblocked nine Twitter accounts that had been critical of him amid a lawsuit, attorneys representing the users said Thursday.
The users behind the nine previously blocked accounts, including students, a journalist, a leader of a progressive political group and a veteran, were represented by the American Civil Liberties Union (ACLU) of Texas and the Knight First Amendment Institute at Columbia University in the lawsuit arguing Paxton violated First and 14th Amendment rights by allegedly blocking critics on Twitter.
Kate Huddlesteon, an attorney for the ACLU of Texas, said the unblocking “is a step in the right direction.”
“Attorney General Paxton cannot prevent Texans from exercising their First Amendment rights, including their right to criticize his policies and qualifications in their responses to his tweets,” Huddleston said in a statement. “It remains to be seen, however, whether the attorney general will unblock other Texans whose speech he’s suppressed. It shouldn’t take a lawsuit for Attorney General Paxton to comply with the Constitution.”
Lighter click: welcome <3
An op-ed to chew on: Small businesses barely survive cyberattacks–the US must help to secure them
NOTABLE LINKS FROM AROUND THE WEB:
How Google interns fought for more cash — and won (Protocol / Anna Kramer)
The chip shortage is making cars more expensive (The Verge / Sean O’Kane)
The Fortnite trial is exposing details about the biggest iPhone hack on record (Vice Motherboard / Lorenzo Franceschi-Bicchierai)
Where have all the Uber drivers gone? (The Washington Post / Faiz Siddiqui)
Copyright 2023 Nexstar Media Inc. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.
