That’s the strongest truthful statement any company can give you. You can never be 100% sure you aren’t hacked. You can only be sure, that as far as you know, no one hacked you.

When Bloomberg implicated Apple in The Big Hack, Apple gave way stronger denials. So did Amazon.

> Apple has never found malicious chips, “hardware manipulations” or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement.

Exactly - Apple never said "we weren't hacked, 100% sure". They said, that all the data they have shows no evidence, plus pointed out some BS in the story.

Interesting that they only mention server. What about their employee devices, networking hardware, and every other internet connected thing? Not saying I buy this theory, but that denial leaves a lot of technically correct room to lie through their teeth.

Thats because the entirety of Bloomberg's nonsense focused on a supposed server. So there wasn't any need to disown employee devices, mobile phones, iot, etc

> That’s the strongest truthful statement any company can give you.

Oh, I agree that no company will ever make a categorical denial of something like this; I just don't think that justifies promoting a lesser denial into a categorical one.

If Microsoft's statement is honest, it certainly raises doubts about this story. What "people familiar with the matter" know more than Microsoft themselves?

Even if the information was discovered during a government or private investigation of the hacks that didn't include Microsoft, the investigators likely would have notified Microsoft immediately.

Given the SEC implications of an officer of the company lying about something that could materially affect share prices, you can certainly believe that Microsoft thinks his statements are true. Literally anyone can tell a journalist that they're "familiar with the matter". Given reuters track record on security coupled with the lack of update about Microsoft's public statement, I'm inclined to be pretty skeptical about the quality of those sources.

>SEC implications

Don't apply to matters of national security. Seeing as solar winds supplied every branch of government and just about every company that matters in the U.S., I would imagine that there are a lot of people under gag orders, or prohibited from talking about classified Intel with people that don't have clearance. To be safe, it'd be wise to not have company officers who also hold clearances.

Do you have a citation for that? I'm not aware of anything about having a clearance which indemnifies you for fraud.

I am not a lawyer and merely [poorly] paraphrasing what I've heard in discussion about this legal quandary. The problem as I see it is that in order for a judge to not immediately dismiss a case the aggrieved party needs to have some evidence that these statements were made falsely. Considering the CISA opsec guidelines, there should not be a corporate paper trail detailing officials knowledge, so where and how do you get evidence that can be admitted to court? Witnesses would presumably be under similar NATSEC restrictions, have questionable custody of the evidence, or worse, they can only provide hearsay.

You mentioned gag orders, you should know there's largely no such thing in the US, outside of NSLs which don't apply here. The United States does not have an equivalent of the official secrets act in the UK. In order to be restrained from talking about national security information, you would need to have signed an NDA ahead of time.

The statement about supposed CISA opsec guidelines is equally confusing, can you please cite the specific guidance you're referring to which would keep executives in the dark? I'm pretty familiar with the guidance CISA has issued and I don't believe any such advice has ever been given.

Before an executive would talk to the media about a subject like this, they would absolutely have gotten details from their internal security team.

Reminds me of the Supermicro hardware trojan horse implant crap from a couple years ago. That story blew up but seemed to have almost no foundation at all, and was outright denied by all parties who would actually know.

It's a strong statement but it definitely leaves the door open. Given that there's so much at stake I can't imagine a different statement.

On the other hand, if you read the CISA alert[1], it's clear that (1) many industrial targets were compromised, given the ubiquity of the Orion product and the amount of time that transpired; and (2) the attackers had their merry f'ing way with MS products like AD. So at this point I think it would be more surprising if they were not compromised than if they were.

[1]https://us-cert.cisa.gov/ncas/alerts/aa20-352a

Are you saying that the attacker's skill with AD indicates that they were able to plant code in AD? Steal the source and learn vulnerabilities from it? Or just that, given that MS uses AD, they were vulnerable too?

I believe Brad Smith was chief of legal counsel before he was president. It would make sense for him to be very careful with his words here

That statement doesn't even say whether they were actually checking. It's easy to have no knowledge when you aren't looking.

I don't think the statement was meant that way, but it just shows how defensive the wording is.

That's still a non-denial denial, right? "We never said we weren't breached, we just said we had no indication of being breached [...]" (Not that you can really give any more information in a public forum)

Or even we have no indication of this specific breach that you are talking about.