4 ms·
Some (pretty interesting) details here: https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/ https://blogs.microsof
by nl 6y ago
Some (pretty interesting) details here: https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/ https://blogs.microsoft.com/on-the-issues/2020/12/13/custome...
They used a an on-premises compromise to gain access to an organization’s trusted SAML token- signing certificate. This enables them to forge SAML tokens that impersonate any of the organization’s existing users and accounts, including highly privileged accounts
Note the on-premises compromise (!!)
Microsoft credits it to a nation state.
- thu2111 6y agoI think that just means they hacked a machine running in the offices, not that they were literally physically on-premises. There's a rather large opaque black hole in the middle of this assertion: how are the attackers obtaining administrator credentials to the SSO systems? There seems to be a pretty big leap here from "get code inside the firewall via Orion" and "oops, now your SSO ticket private key is pwned". They say administrator credential compromise, OK, that's a pretty general class of techniques. The details would be good because otherwise there seems to be a missing link here.
- syshum 6y agoI am sure since they are classing in as a "nation state hack" the government will move quickly to classify the details for "national security". So then the question becomes was it really a nation state, or just incompetence being covered by claims of "nation state" hacking
- Proven 6y agoTime to cross reference that Shanghai CCP member database...
- delfinom 6y agoSounds like somebody was running around with domain admin accounts improperly at SolarWinds.
- SV_BubbleTime 6y agoRight. When the implication is spies, lockpicking, laser limbo.... The more likely scenarios are a CFO that thinks they are also a CTO, a sr tech that was given admin credentials to fix a problem that kept coming up for some reason, or some inconsequential service bot account was given admin privileges in development and never fixed later.
- weare138 6y agoConsidering someone at SolarWinds uploaded FTP credentials to their public Github and left it exposed for almost 2 years, I could definitely see that happening. https://savebreach.com/solarwinds-exposed-ftp-credentials-back-in-2018-says-security-researcher-vinoth/ https://savebreach.com/solarwinds-exposed-ftp-credentials-ba...