5 ms·

Let me get this straight: They were able to use a single helpdesk account password for six months to read arbitrary emails from arbitrary user accounts. There w

by saulrh 8y ago

Let me get this straight: They were able to use a single helpdesk account password for six months to read arbitrary emails from arbitrary user accounts. There was no 2fa. There was no auditing. There was no integration with any sort of ticketing system ("you can only access an account if you're working on that specific user's ticket") or paperwork ("reason for access:"). There wasn't a single piece of automated monitoring to detect this account accessing accounts off-hours or accessing multiple accounts simultaneously. And this went on for six months. Did I misread something?

bovermyer 8y ago
You understood it correctly. There are a great many failures of process here.
tialaramex 8y ago
I've built systems which required "helpdesk" type access and had auditing, but the problem is where do think "audit summary report" is on the TODO pile for the people getting those summaries? I'm guessing it's between "Delete unread" and "I really ought to get around to it but I'm too busy so I never do". Even when it comes to third party audit, those are ring binder driven processes. Does the audit report get generated? Yes, check. Does the person it goes to have a requirement to check it? Yes, check. Done, pass. Auditors _might_ ask to see an example report, but they definitely aren't going to add bogus entries to see what happens for example. Spot checks aren't a thing in almost any industry. "Chaos Monkey" style checks aren't a thing anywhere at all. So it's easily possible that for six months (or three months) Microsoft was generating internal reports that said "Bob the Helpdesk worker has accessed ten times more user emails today than anybody else" and nobody was asking "Wait, why is Bob an outlier?". With a targeted attack like this one, your suggestion about requiring a ticket doesn't help very much, the attacker is motivated to jump through hoops unlike script kiddies looking for low-hanging fruit. Insider fraud at banks has been known to go as far as a fake "customer" phoning up to authorize the steps that the bad guys want to take, so that there's an authorization on record when they do them and it won't immediately be flagged as a problem. The real customer may later convince a court that it wasn't them, but that's not real time, the insiders are long gone and so is the money. Now, you can build systems where it's just impossible for even your own people to get access. But that has a high cost, as you will see in every thread where people castigate Google because they got locked out of something. Why can't Google just hire helpdesk people who have super-user access, they ask...
- 0xffff2 8y ago
  >Now, you can build systems where it's just impossible for even your own people to get access. But that has a high cost, as you will see in every thread where people castigate Google because they got locked out of something. Why can't Google just hire helpdesk people who have super-user access, they ask... I don't see how allowing helpdesk operators to help users recover access to their accounts has any relation at all to the helpdesk operators having access to the account itself. They need to be able to access and update account metadata, not the account itself.
  - deleted 8y ago
    [deleted]
  - tialaramex 8y ago
    > I don't see how allowing helpdesk operators to help users recover access to their accounts has any relation at all to the helpdesk operators having access to the account itself. They need to be able to access and update account metadata, not the account itself. So in your system the bad guy can't read my email because he only has the ability to access and update account metadata such as my password and the helpdesk system doesn't give him access to the actual email? That would work, unless any of the bad guys is smarter than you and realises that they can use this metadata to... log into my account and read my email.
    - theaustinseven 8y ago
      If the password is stored in plaintext or can be changed by an admin(in a method other than a reset where the user still sets the new password), we've got other problems.
    - 0xffff2 8y ago
      >That would work, unless any of the bad guys is smarter than you and realises that they can use this metadata to... log into my account and read my email. No need to be so rude and disrespectful. Obviously there needs to be a password reset mechanism. That mechanism can absolutely be designed in a way that does not involve the helpdesk operator having access to the password or the account.
runn1ng 8y ago
Microsoft claims it was just 3 months. Otherwise, on point.
- dsfyu404ed 8y ago
  90 days is a pretty typical rotation period for credentials. They probably noticed this when they rotated the password and the account got locked from wrong password attempts in short order.
NullPrefix 8y ago
>And this went on for six months By "this" you mean "Someone had access to that particular help desk account", not the whole system ?
wnevets 8y ago
Surely gmail doesn't have something this terrible, right?
- judge2020 8y ago
  There's a blog post titled Into The Borg[0] that states: > There is also a user “legal-discovery@prod.google.com” that has permission “auth.impersonation.impersonateNormalUser” So it exists, but hopefully Google doesn't have the same issues with giving helpdesk employees access to impersonation. 0: https://opnsec.com/2018/07/into-the-borg-ssrf-inside-google-production-network/ https://opnsec.com/2018/07/into-the-borg-ssrf-inside-google-...
cheeze 8y ago
Sounds like Microsoft...
packet_nerd 8y ago
Not surprised at all. This is the way enterprise systems are. It's a little depressing to go to work and try to deal with the atrocious stuff I have to deal with, and then think how much of my life is online at companies probably just as bad as my own.

by saulrh 8y ago

bovermyer 8y ago

You understood it correctly. There are a great many failures of process here.

tialaramex 8y ago

I've built systems which required "helpdesk" type access and had auditing, but the problem is where do think "audit summary report" is on the TODO pile for the people getting those summaries? I'm guessing it's between "Delete unread" and "I really ought to get around to it but I'm too busy so I never do". Even when it comes to third party audit, those are ring binder driven processes. Does the audit report get generated? Yes, check. Does the person it goes to have a requirement to check it? Yes, check. Done, pass. Auditors _might_ ask to see an example report, but they definitely aren't going to add bogus entries to see what happens for example. Spot checks aren't a thing in almost any industry. "Chaos Monkey" style checks aren't a thing anywhere at all. So it's easily possible that for six months (or three months) Microsoft was generating internal reports that said "Bob the Helpdesk worker has accessed ten times more user emails today than anybody else" and nobody was asking "Wait, why is Bob an outlier?". With a targeted attack like this one, your suggestion about requiring a ticket doesn't help very much, the attacker is motivated to jump through hoops unlike script kiddies looking for low-hanging fruit. Insider fraud at banks has been known to go as far as a fake "customer" phoning up to authorize the steps that the bad guys want to take, so that there's an authorization on record when they do them and it won't immediately be flagged as a problem. The real customer may later convince a court that it wasn't them, but that's not real time, the insiders are long gone and so is the money. Now, you can build systems where it's just impossible for even your own people to get access. But that has a high cost, as you will see in every thread where people castigate Google because they got locked out of something. Why can't Google just hire helpdesk people who have super-user access, they ask...

0xffff2 8y ago
>Now, you can build systems where it's just impossible for even your own people to get access. But that has a high cost, as you will see in every thread where people castigate Google because they got locked out of something. Why can't Google just hire helpdesk people who have super-user access, they ask... I don't see how allowing helpdesk operators to help users recover access to their accounts has any relation at all to the helpdesk operators having access to the account itself. They need to be able to access and update account metadata, not the account itself.
- deleted 8y ago
  [deleted]
- tialaramex 8y ago
  > I don't see how allowing helpdesk operators to help users recover access to their accounts has any relation at all to the helpdesk operators having access to the account itself. They need to be able to access and update account metadata, not the account itself. So in your system the bad guy can't read my email because he only has the ability to access and update account metadata such as my password and the helpdesk system doesn't give him access to the actual email? That would work, unless any of the bad guys is smarter than you and realises that they can use this metadata to... log into my account and read my email.
  - theaustinseven 8y ago
    If the password is stored in plaintext or can be changed by an admin(in a method other than a reset where the user still sets the new password), we've got other problems.
  - 0xffff2 8y ago
    >That would work, unless any of the bad guys is smarter than you and realises that they can use this metadata to... log into my account and read my email. No need to be so rude and disrespectful. Obviously there needs to be a password reset mechanism. That mechanism can absolutely be designed in a way that does not involve the helpdesk operator having access to the password or the account.

runn1ng 8y ago

Microsoft claims it was just 3 months. Otherwise, on point.

dsfyu404ed 8y ago
90 days is a pretty typical rotation period for credentials. They probably noticed this when they rotated the password and the account got locked from wrong password attempts in short order.

NullPrefix 8y ago

>And this went on for six months By "this" you mean "Someone had access to that particular help desk account", not the whole system ?

wnevets 8y ago

Surely gmail doesn't have something this terrible, right?

judge2020 8y ago
There's a blog post titled Into The Borg[0] that states: > There is also a user “legal-discovery@prod.google.com” that has permission “auth.impersonation.impersonateNormalUser” So it exists, but hopefully Google doesn't have the same issues with giving helpdesk employees access to impersonation. 0: https://opnsec.com/2018/07/into-the-borg-ssrf-inside-google-production-network/ https://opnsec.com/2018/07/into-the-borg-ssrf-inside-google-...

cheeze 8y ago

Sounds like Microsoft...

packet_nerd 8y ago

Not surprised at all. This is the way enterprise systems are. It's a little depressing to go to work and try to deal with the atrocious stuff I have to deal with, and then think how much of my life is online at companies probably just as bad as my own.