Tag: Recent News

The new school year is beginning for many across the globe and, although COVID-19 continues to necessitate at least some distance-learning, the realities of bullying – both online and off – remain. A new Microsoft study shows 4 in 10 teens in 32 countries report being “involved” in a bullying incident and, perhaps surprisingly, nearly the same percentage of adults, as well.

Some 40% of teenagers in 32 countries¹ say they’ve been involved in a bullying incident as the target of the bullying, someone who displayed bullying behaviors or as a bystander. Meanwhile, 37% of adults said they were involved in a “bullying” incident. Combining both teens and adults, 38% of respondents say they were involved, with 19% identifying as the “target,” 21% as a “bystander” and 1% each as both “contributor” and “bully.” Respondents were asked about both online and offline bullying, and adults were asked about “bullying” (perhaps better termed “harassment”) both inside and outside the workplace.

Interestingly, those who admitted to either contributing to or exhibiting bullying behaviors responded overwhelmingly that they felt social pressure to act (68%) and they said that they regret their actions (79%). Among those who felt significant pressure to act, regret was even higher at nearly 9 in 10 (89%).

The findings are from Microsoft’s latest research into aspects of digital civility ­– encouraging safer, healthier and more respectful online interactions among all people. The study, “Civility, Safety and Interaction Online ­­– 2020,” polled teens ages 13-17 and adults ages 18-74 about their exposure to 21² different online risks. This latest research builds on similar studies undertaken annually from 2016 to 2019. Previous years’ projects polled the same demographic groups in 14, 22, 23 and 25 countries, respectively. A total of 16,051 individuals participated in this latest study, and we have surveyed more than 58,000 people over the last five years. Full results from this latest installment will be made available on international Safer Internet Day 2020 on Feb. 9.

Most common response: block “bullies”

For nearly a decade, young people around the world have been advised to “Stop, Block and Tell” when it comes to online bullying, and that was the predominant response reported in this study. Two-thirds of respondents (66%) said they blocked the instigator while more than half (54%) said they talked to a friend, and more than 4 in 10 either ignored the person (44%) or told a trusted adult (42%). Sadly, given the importance of reporting unwelcome behavior to tech companies to help keep online communities safe and collegial, less than a third of respondents (30%) said they told a service provider, such as a social media company, about the incident.

We’ve all seen various webforms and online tools for reporting instances of cyberbullying, harassment, or other forms of digital abuse to tech companies. But how many of us have experienced or witnessed cruel or malicious treatment online or stumbled upon harmful content and actually submitted a report? In addition to specific in-product or service links to report abuse or concerns to Microsoft, we also make available a series of topic-specific webforms to report non-consensual pornography (unartfully referred to as “revenge porn”), terrorist content and hate speech. These issues, as well as bullying, harassment and other inappropriate behavior are all violations of Microsoft’s Code of Conduct as detailed in the Microsoft Services Agreement. On the other hand, if consumers feel their content was removed or their account was closed in error, they can complete this form to request reinstatement.

Microsoft and other online service providers have a business interest in protecting our customers and the integrity of our services by removing illegal and harmful content and addressing prohibited conduct. Furthermore, customer-reporting plays an important role in achieving those aims. So, we encourage people who participate in our communities to make us aware of content that is illegal or violates our code of conduct. General research shows that many users are reluctant to report terms-of-service violations because they feel their reports will go unnoticed or they would simply prefer to let someone else do the reporting.

At Microsoft, reports are reviewed, evaluated and actioned as appropriate. Depending on the severity of the offense, different Microsoft consumer services undertake different enforcement actions.

So, as the new – largely virtual – school year begins, pledge to be an “upstander.” Embrace the Microsoft Digital Civility Challenge and, if it’s safe and prudent to do so, stand up for yourself and others online who may be targeted for abuse or cruel treatment. Make use of technology companies’ reporting features, and promote good digital citizenship and digital civility in all communities.

To learn more about responding to online bullying and harassment, consult this resource, and for more on digital safety and digital civility generally, visit our website and resources page.

¹ Countries polled in 2020 were: Argentina, Australia*, Belgium, Brazil, Canada, Chile, Colombia, Denmark*, France, Germany, Hungary, India, Indonesia*, Ireland, Italy, Malaysia, Mexico, Netherlands, Peru, Philippines*, Poland, Russia, Sweden*, Singapore, Spain*, South Africa, Taiwan, Thailand*, Turkey, U.K., U.S., Vietnam. *Indicates country was added (or re-added) to the study in 2020

² The 21 risks span four broad categories: behavioral, sexual, reputational and personal/intrusive. Specifically: Reputational – “Doxing” and damage to personal or professional reputations; Behavioral – Being treated meanly; experiencing trolling, online harassment or bullying; encountering hate speech and microaggressions; Sexual – Sending or receiving unwanted sexting messages and making sexual solicitations; receiving unwanted sexual attention and being a victim of sextortion or non-consensual pornography (aka “revenge porn”); Personal/intrusive – Being the target of unwanted contact, experiencing discrimination, swatting, misogyny, exposure to extremist content/recruiting, or falling victim to hoaxes, scams or fraud.

Tags: bullying, COVID-19, digital civility challenge, education, Online Safety

In recent weeks, Microsoft has detected cyberattacks targeting people and organizations involved in the upcoming presidential election, including unsuccessful attacks on people associated with both the Trump and Biden campaigns, as detailed below. We have and will continue to defend our democracy against these attacks through notifications of such activity to impacted customers, security features in our products and services, and legal and technical disruptions. The activity we are announcing today makes clear that foreign activity groups have stepped up their efforts targeting the 2020 election as had been anticipated, and is consistent with what the U.S. government and others have reported. We also report here on attacks against other institutions and enterprises worldwide that reflect similar adversary activity.

We have observed that:

• Strontium, operating from Russia, has attacked more than 200 organizations including political campaigns, advocacy groups, parties and political consultants
• Zirconium, operating from China, has attacked high-profile individuals associated with the election, including people associated with the Joe Biden for President campaign and prominent leaders in the international affairs community
• Phosphorus, operating from Iran, has continued to attack the personal accounts of people associated with the Donald J. Trump for President campaign

The majority of these attacks were detected and stopped by security tools built into our products. We have directly notified those who were targeted or compromised so they can take action to protect themselves. We are sharing more about the details of these attacks today, and where we’ve named impacted customers, we’re doing so with their support.

What we’ve seen is consistent with previous attack patterns that not only target candidates and campaign staffers but also those they consult on key issues. These activities highlight the need for people and organizations involved in the political process to take advantage of free and low-cost security tools to protect themselves as we get closer to election day. At Microsoft, for example, we offer AccountGuard threat monitoring, Microsoft 365 for Campaigns and Election Security Advisors to help secure campaigns and their volunteers. More broadly, these attacks underscore the continued importance of work underway at the United Nations to protect cyberspace and initiatives like the Paris Call for Trust and Security in Cyberspace.

Strontium

Strontium is an activity group operating from Russia whose activities Microsoft has tracked and taken action to disrupt on several previous occasions. It was also identified in the Mueller report as the organization primary responsible for the attacks on the Democratic presidential campaign in 2016. Microsoft’s Threat Intelligence Center (MSTIC) has observed a series of attacks conducted by Strontium between September 2019 and today. Similar to what we observed in 2016, Strontium is launching campaigns to harvest people’s log-in credentials or compromise their accounts, presumably to aid in intelligence gathering or disruption operations. Many of Strontium’s targets in this campaign, which has affected more than 200 organizations in total, are directly or indirectly affiliated with the upcoming U.S. election as well as political and policy-related organizations in Europe. These targets include:

• U.S.-based consultants serving Republicans and Democrats;
• Think tanks such as The German Marshall Fund of the United States and advocacy organizations;
• National and state party organizations in the U.S.; and
• The European People’s Party and political parties in the UK.

Others that Strontium targeted recently include businesses in the entertainment, hospitality, manufacturing, financial services and physical security industries.

Microsoft has been monitoring these attacks and notifying targeted customers for several months, but only recently reached a point in our investigation where we can attribute the activity to Strontium with high confidence. MSTIC’s investigation revealed that Strontium has evolved its tactics since the 2016 election to include new reconnaissance tools and new techniques to obfuscate their operations. In 2016, the group primarily relied on spear phishing to capture people’s credentials. In recent months, it has engaged in brute force attacks and password spray, two tactics that have likely allowed them to automate aspects of their operations. Strontium also disguised these credential harvesting attacks in new ways, running them through more than 1,000 constantly rotating IP addresses, many associated with the Tor anonymizing service. Strontium even evolved its infrastructure over time, adding and removing about 20 IPs per day to further mask its activity.

We are also working with our customers to assist them in proactively hunting for these types of threats in their environments and have published additional detail and guidance on Strontium activity.

Zirconium

Zirconium, operating from China, has attempted to gain intelligence on organizations associated with the upcoming U.S. presidential election. We’ve detected thousands of attacks from Zirconium between March 2020 and September 2020 resulting in nearly 150 compromises. Its targets have included individuals in two categories.

First, the group is targeting people closely associated with U.S. presidential campaigns and candidates. For example, it appears to have indirectly and unsuccessfully targeted the Joe Biden for President campaign through non-campaign email accounts belonging to people affiliated with the campaign. The group has also targeted at least one prominent individual formerly associated with the Trump Administration.

Second, the group is targeting prominent individuals in the international affairs community, academics in international affairs from more than 15 universities, and accounts tied to 18 international affairs and policy organizations including the Atlantic Council and the Stimson Center.

Zirconium is using what are referred to as web bugs, or web beacons, tied to a domain they purchased and populated with content. The actor then sends the associated URL in either email text or an attachment to a targeted account. Although the domain itself may not have malicious content, the web bug allows Zirconium to check if a user attempted to access the site. For nation-state actors, this is a simple way to perform reconnaissance on targeted accounts to determine if the account is valid or the user is active.

Phosphorus

Phosphorus is an activity group operating from Iran that MSTIC has tracked extensively for several years. The actor has operated espionage campaigns targeting a wide variety of organizations traditionally tied to geopolitical, economic or human rights interests in the Middle East region. Microsoft has previously taken legal action against Phosphorus’ infrastructure and its efforts late last year to target a U.S. presidential campaign. Last month, as part of our ongoing efforts to disrupt Phosphorus activity, Microsoft was again given permission by a federal court in Washington D.C. to take control of 25 new internet domains used by the Phosphorus. Microsoft has since taken control of these domains. To date, we have used this method to take control of 155 Phosphorus domains.

Since our last disclosure, Phosphorus has attempted to access the personal or work accounts of individuals involved directly or indirectly with the U.S. presidential election. Between May and June 2020, Phosphorus unsuccessfully attempted to log into the accounts of administration officials and Donald J. Trump for President campaign staff.

Bolstering Cybersecurity

We disclose attacks like these because we believe it’s important the world knows about threats to democratic processes. It is critical that everyone involved in democratic processes around the world, both directly or indirectly, be aware of these threats and take steps to protect themselves in both their personal and professional capacities. We report on nation-state activity to our customers and more broadly when material to the public, regardless of the actor’s nation-state affiliation. We are taking extra steps to protect customers involved in elections, government and policymaking. We’ll continue to disclose additional significant activity in our efforts to defend democracy.

We also believe more federal funding is needed in the U.S. so states can better protect their election infrastructure. While the political organizations targeted in attacks from these actors are not those that maintain or operate voting systems, this increased activity related to the U.S. electoral process is concerning for the whole ecosystem. We continue to encourage state and local election authorities in the U.S. to harden their operations and prepare for potential attacks. But as election security experts have noted, additional funding is still needed, especially as resources are stretched to accommodate the shift in COVID-19-related voting. We encourage Congress to move forward with additional funding to the states and provide them with what they need to protect the vote and ultimately our democracy.

Tags: cyberattacks, cybersecurity, Defending Democracy Program, Election Security Advisors, ElectionGuard, Microsoft 365 for Campaigns, MSTIC, security