6 ms·

> The hack involves the NTIA’s office software, Microsoft’s Office 365. Staff emails at the agency were monitored by the hackers for months, sources said. > Th

> The hack involves the NTIA’s office software, Microsoft’s Office 365. Staff emails at the agency were monitored by the hackers for months, sources said. > The hackers are “highly sophisticated” and have been able to trick the Microsoft platform’s authentication controls, according to a person familiar with the incident, who spoke on condition of anonymity because they were not allowed to speak to the press. > “This is a nation state,” said a different person briefed on the matter. “We just don’t know which one yet.” I bet it was someone on r/wallstreetbets

Animats 6y ago
Microsoft Office. Of course.
qz2 6y ago
Unexpected cloud security benefit, for foreign government!
gao8a 6y ago
they wanted to restart the print job?
- volkfish55 6y ago
  That's a good one! :D
syshum 6y ago
>"able to trick the Microsoft platform’s authentication" So they social engineered the password, and if MFA was on it was push based MFA and the user just clicked OK to all popups on their phone?
- Spooky23 6y ago
  Depends on how they do things. Clicking “yes” on a phone wouldn’t be happening at higher trust levels. If they offload auth to a on-prem or third party IdP (common in big hybrid O365 tenants), there are often different paths, implementation screwups or bugs that let you bypass MFA. Microsoft’s position is “buy Azure AD, Buy M365, Buy ATP” and other paths are poorly tested, or they explicitly tell you to F off. Also remember that federal agencies are bigger than most fortune 50 companies, are usually global in scope and have lots of collaborations with other agencies and other third parties, and may have independent pockets within the agency. Those friction points are where problems tend to happen!
- jiggawatts 6y ago
  This is my experience with Microsoft: they view all security features as binary. As in: Encryption: Yes. Multi-factor authentication: Yes. Do they care if the MFA is simply the user pecking at buttons like a bird trained with seeds: No. There is a real problem with Azure AD MFA. Unlike the consumer MFA, it shows you exactly zero information about the source of the information. None. You get a choice of "approve" or "do not approve". You don't get any input information for making this decision. Hacking this is trivial. If you know someone's password, you just have to occasionally try logging in. Eventually the user will accidentally click approve even though they didn't trigger the authentication. You'd assume that nobody would ever fall for something like this, because surely nobody would be so stupid as to approve an MFA prompt they didn't trigger. Meanwhile, my Microsoft Authenticator app triggers randomly about 5-10 times per day because every single MS app insists on "reauthenticating" me every 24 hours. So I'll be sitting at my desk and my phone will pop it up randomly. I'll look up, and sure enough, Teams wants me to re-MFA for some stupid reason. I'm paranoid enough that I'll always reject these MFA prompts and then start the login cycle manually, but most people would just peck the button like a trained bird. Similarly, I've run scripts before that needed 6 MFA prompts to complete (don't ask). I ran the script once and it asked 7 times... uh-oh. Is this an Azure bug, or a hacker from China? How could I possibly know?! The information is not provided to me! This is Microsoft's fault, 110%, and I dare anyone here to argue otherwise. So instead of reaching for the downvote button, make your case on how "yes, yes, yes, yes" is not a security disaster below in the comments please.
  - Spooky23 6y ago
    That isn’t Microsoft’s fault. They are providing a tool and your admins did not set it up in the most secure or sensible way. Your actions may make it some If these things happen as well. I can think of a few organizations where your script would have resulted in your account being locked down and a security incident.
    - bambataa 6y ago
      How is it not Microsoft's fault if they don't provide the user with any information to decide whether the MFA request is legit?
- katbyte 6y ago
  Your assuming they had mfa enabled!
JKCalhoun 6y ago
>> “This is a nation state,” > I bet it was someone on r/wallstreetbets Both could be true? ;-)
chad_strategic 6y ago
r/wallstreebets only skill is making really funny Memes and is exposing the Federal Reserve and printing machine. So now that I think about it maybe they did do it... That's the only way to find out what the Fed is up to next. Hack a hot stock tip.
edkennedy 6y ago
My first thought on this was that it was an EvilginX hack, ala https://www.thecloudtechnologist.com/office-365s-mfa-is-vulnerable-to-evilginx2/ https://www.thecloudtechnologist.com/office-365s-mfa-is-vuln...
swiley 6y ago
Yeah I had friends in college that did this kind of thing for fun.

Animats 6y ago

Microsoft Office. Of course.

qz2 6y ago

Unexpected cloud security benefit, for foreign government!

gao8a 6y ago

they wanted to restart the print job?

volkfish55 6y ago
That's a good one! :D

syshum 6y ago

>"able to trick the Microsoft platform’s authentication" So they social engineered the password, and if MFA was on it was push based MFA and the user just clicked OK to all popups on their phone?

Spooky23 6y ago
Depends on how they do things. Clicking “yes” on a phone wouldn’t be happening at higher trust levels. If they offload auth to a on-prem or third party IdP (common in big hybrid O365 tenants), there are often different paths, implementation screwups or bugs that let you bypass MFA. Microsoft’s position is “buy Azure AD, Buy M365, Buy ATP” and other paths are poorly tested, or they explicitly tell you to F off. Also remember that federal agencies are bigger than most fortune 50 companies, are usually global in scope and have lots of collaborations with other agencies and other third parties, and may have independent pockets within the agency. Those friction points are where problems tend to happen!
jiggawatts 6y ago
This is my experience with Microsoft: they view all security features as binary. As in: Encryption: Yes. Multi-factor authentication: Yes. Do they care if the MFA is simply the user pecking at buttons like a bird trained with seeds: No. There is a real problem with Azure AD MFA. Unlike the consumer MFA, it shows you exactly zero information about the source of the information. None. You get a choice of "approve" or "do not approve". You don't get any input information for making this decision. Hacking this is trivial. If you know someone's password, you just have to occasionally try logging in. Eventually the user will accidentally click approve even though they didn't trigger the authentication. You'd assume that nobody would ever fall for something like this, because surely nobody would be so stupid as to approve an MFA prompt they didn't trigger. Meanwhile, my Microsoft Authenticator app triggers randomly about 5-10 times per day because every single MS app insists on "reauthenticating" me every 24 hours. So I'll be sitting at my desk and my phone will pop it up randomly. I'll look up, and sure enough, Teams wants me to re-MFA for some stupid reason. I'm paranoid enough that I'll always reject these MFA prompts and then start the login cycle manually, but most people would just peck the button like a trained bird. Similarly, I've run scripts before that needed 6 MFA prompts to complete (don't ask). I ran the script once and it asked 7 times... uh-oh. Is this an Azure bug, or a hacker from China? How could I possibly know?! The information is not provided to me! This is Microsoft's fault, 110%, and I dare anyone here to argue otherwise. So instead of reaching for the downvote button, make your case on how "yes, yes, yes, yes" is not a security disaster below in the comments please.
- Spooky23 6y ago
  That isn’t Microsoft’s fault. They are providing a tool and your admins did not set it up in the most secure or sensible way. Your actions may make it some If these things happen as well. I can think of a few organizations where your script would have resulted in your account being locked down and a security incident.
  - bambataa 6y ago
    How is it not Microsoft's fault if they don't provide the user with any information to decide whether the MFA request is legit?
katbyte 6y ago
Your assuming they had mfa enabled!

JKCalhoun 6y ago

>> “This is a nation state,” > I bet it was someone on r/wallstreetbets Both could be true? ;-)

chad_strategic 6y ago

r/wallstreebets only skill is making really funny Memes and is exposing the Federal Reserve and printing machine. So now that I think about it maybe they did do it... That's the only way to find out what the Fed is up to next. Hack a hot stock tip.

edkennedy 6y ago

My first thought on this was that it was an EvilginX hack, ala https://www.thecloudtechnologist.com/office-365s-mfa-is-vulnerable-to-evilginx2/ https://www.thecloudtechnologist.com/office-365s-mfa-is-vuln...

swiley 6y ago

Yeah I had friends in college that did this kind of thing for fun.