7 ms·

Microsoft takes pains to obscure role in 0-days that caused email breach

228 points by fauigerzigerk 3y ago

mcpackieh 3y ago
Shouldn't the use of zero days slightly vindicate Microsoft? It's certainly not a good look, but at least they weren't willfully neglecting to patch issues known to them.
Veserv 3y ago
0-day is such a poor word. We should really be calling it by the generic cross-domain term, a defect, in this case a security defect. Microsoft is selling a defective product where new defects are regularly identified and regularly cause failures and harm. It is generally frowned upon or illegal to sell defective products. In many other industrys the discovery of multiple, repeated defects in a product allows the customer to get a full refund with protection from retaliation. Only in software do we call defects a oopsie and throw our hands up in the air as if nothing could be done and let companys off the hook. Normalizing this process by handling trillion dollar companys with kids gloves is ridiculous. They are selling defective products and should be treated like it.
- Jedd 3y ago
  As someone with opinions on english usage (I was just eye-twitching at another front page HN story - the misused possessive on 'pilot's licence') I can see why '0 day' may not perfectly capture or convey a certain type of exploit, but I don't think this would improve clarity. I've always distinguished a defect as a fault that was known prior to shipping (and hopefully documented) and a bug is a fault discovered after shipping. Draw your own analogies for SaaS, I guess. But given another popular distinction between defect and bug is more around design vs unexpected failures, it may be hubris to overload either of those terms with all the extra meaning that's already captured by '0 day'. As TFA notes, it'd be preferable if Microsoft didn't weasel away from commonly used and well understood words like vulnerability & exploit, or if they didn't eschew industry standard CVE reporting.
  - Veserv 3y ago
    A defect is a fault or flaw that prevents the stated usage of a product. That is the plain meaning in literally every industry. A defective product is one fails to achieve its stated specifications, guarantees, or use. A airbag that, unknowingly at the time of manufacture, explodes after exposure to high heat or humidity has a defect. The product, now knowing that it contains a material defect, is defective. The use of bug, 0-day, vulnerability, exploit, etc. when making PR statements about security defects in software is a deliberate effort to downplay the severity of their failures. They deliberately avoid the use of the word “defect” because in many industrys that has literal legal consequences. At many companys, putting the word defect in a email has the general counsel descend, that is how serious it is. In contrast, calling a flaw that prevents the stated usage of your product a “bug” lets you sidestep all of that by mischaracterizing it as a legally meaningless “oopsie”. These flaws are defects. They clearly cause the products to not achieve their stated goal and the failures cause demonstrable harm. Calling them anything less is just handling these trillion dollar companys with kid gloves which is how we got into this systemically incompetent security mess. They need to be held to the same standards we hold other companys to and fix their damn products or get out of the businesses that they are too incapable to do acceptably.
    - NoZebra120vClip 3y ago
      > not achieve their stated goal What is the stated goal of software packages whose EULA often includes a disclaimer, "NO WARRANTY OF FITNESS FOR ANY PURPOSE"?
      - Veserv 3y ago
        Same as for any physical product. If you are selling to a general consumer via a one-sided contract then there are implicit guarantees of fitness for the plainly advertised purpose that can almost never be waived at least in the US. Note that this does not usually apply to gifts so non-commercial OSS is likely unaffected. If you are selling to a business customer then they are accepting those terms. If they wish to then go on and use that product in their delivery to a general consumer then they are accepting the liability of verifying or making it fit for their purpose. If they wish to provide other guarantees then they are also responsible for those.
2OEH8eoCRo0 3y ago
Victim blaming. Microsoft can do better but practically no organization can withstand the cyber onslaught coming out of China.
- killjoywashere 3y ago
  I think the real issue this particular post was raising was the pay-to-play scheme for the rights to examine your own log files.
  - hulitu 3y ago
    The point is that telemetry is Microsoft's data. Some people still don't underestand what "cloud" means from a data perspective. (Look, we encrypt your data. With our key :)) )
- croes 3y ago
  The victims are the MS customers, MS is as much a victim as KIA because of their USB hack.
- hulitu 3y ago
  You're right. Microsoft can not withstand _any_ cyber onslaught. After 20 years of "improved security" they still don't get it right. But as long as the management loves Microsoft, i guess we are stuck with it.
nazgulsenpai 3y ago
I thought the issue was that the attackers had an Azure AD signing key.[0] I was under the impression it was an inside job. [0] https://www.bleepingcomputer.com/news/microsoft/microsoft-still-unsure-how-hackers-stole-azure-ad-signing-key/ https://www.bleepingcomputer.com/news/microsoft/microsoft-st...
- jsnell 3y ago
  No, and your own link says otherwise, i.e. that it was an "inactive Microsoft account (MSA) consumer signing key". But in addition to letting the key get compromised, their code for validating the signatures had vulnerabilities and allowed a consumer signing key to be used to sign AD tokens.
  - nazgulsenpai 3y ago
    Inactive but not revoked. They revoked it on June 27th. Still I do see there was a flaw in the GetAccessTokenForResource API. > "No key-related actor activity has been observed since Microsoft invalidated the actor-acquired MSA signing key," Microsoft said.
    - croes 3y ago
      Yep, MS botched it, again >The actor used an acquired MSA key to forge tokens to access OWA and Outlook.com. MSA (consumer) keys and Azure AD (enterprise) keys are issued and managed from separate systems and should only be valid for their respective systems. The actor exploited a token validation issue to impersonate Azure AD users and gain access to enterprise mail. https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/ https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-...
jsnell 3y ago
It's starting to feel to me like modern day Microsoft has some kind of a Teflon coating. In the last month alone they've had their flagship cloud services down for extended periods of time due to DDoS attacks, had their auth cookie signing keys compromised and abused at scale, and had a lawsuit reveal emails about how they were planning to use their cash at hand to buy all the content and destroy's Sony's gaming business. And none of it has any impact, nobody seems to care. The comments in this thread are crazy to me. Yes, dealing with targeted attacks by nation states is hard, and occasionally you'll fail. But that's part of the reason to pay Microsoft rather than try to host your own. In that situation the absolute minimum expectation is for MS to follow basic best practices. Nothing about this story suggests they've been doing that, it's just one wtf after another. And their communication on this has been so bad an unclear that it has to have been intentionally obfuscatory.
- andromaton 3y ago
  I used to consider their cloud products secure. When bings home page (plus i don't know how many tenants) was found incorrectly protected a few months ago i stopped. Google will discontinue your product or lock you out. Microsoft will let third parties in . We need better "office" platform vendors.
  - lockhouse 3y ago
    Google Cloud if you want to live dangerously Azure if you're a .NET shop and want good integration with Visual Studio AWS for everyone else
    - bradleyjg 3y ago
      Azure’s salespeople are really good. In reality it’s azure if your cio insists.
    - jiggawatts 3y ago
      Hilariously, Azure PaaS offerings of Microsoft products are notably worse than what is available in AWS. Examples: - SQL Server Analysis Services (SSAS) has no Azure PaaS, but there is an AWS PaaS for it. - RDS for SQL in AWS allows setting a time zone, Azure SQL Database is UTC only, breaking the majority of existing databases when migrated. (They confuse what "developers should do" with what "developers actually do".) - Azure's PaaS for Active Directory (Azure AD Domain Services) can only be linked to an Azure AD tenant, it can't be used as a standalone authoritative domain. AWS allows this scenario. Essentially, every Microsoft product you can think of is easier/cheaper/better on AWS instead of Azure. If Microsoft's CEO was still Bill Gates, heads would have rolled a long time ago.
kjellsbells 3y ago
Press coverage was also quite muted. Take a look at this from the New York Times: Chinese Hackers Targeted Commerce Secretary and Other U.S. Officials https://www.nytimes.com/2023/07/12/us/politics/china-state-department-emails-microsoft-hack.html https://www.nytimes.com/2023/07/12/us/politics/china-state-d...
yyyk 3y ago
IMHO, Azure AD has problems with AuthZ: It's too easy to accidentally only do AuthN*, it's too underdocumented, customization is non-trivial... In general, you're much better off only taking the AuthN part, and implementing AuthZ yourself. It's not as if the lower tier Azure AD allows you to look at useful logs anyway. * The bug here being too wide a scope, or more likely, the scope not being checked at all. Not the first time this class of bug has happened with a Microsoft product on Azure: https://news.ycombinator.com/item?id=35364383 https://news.ycombinator.com/item?id=35364383
predictabl3 3y ago
Oh I looove that it's some access token exchange API that is likely at the heart of this. After the constant nightmares that AD caused Azure for ages, this is just too perfect.
Woodi 3y ago
Microsofti is 0-day, even permament and unlimited set of 0-days. When do we have alternative hw, os and apps stack ? You know, equal in eyes of govs and users of all kinds. Yes, Excel alternative and rest. END SWITCH OFF THAT IDIOCY CALLED Exchange !! /caps must stay Edit: Wait, do thay wait with announcing this gov-level discredit until FCC allow them to buy Blizzard ?
hedora 3y ago
Well, if it wasn't a zero day, then it means they aren't patching their own services in a timely fashion. It's also possible that they have to word things carefully because international diplomacy happens in a language that looks like english, but is not. (In the same way the legal documents are not quite english.) For instance, "China exploited zero days in our cloud services and targeted US gov't communications. We are addressing the situation." could mean "China has committed an act of war against the US, and we are responding in kind on behalf of the US government." The last time I checked, Microsoft did all sorts of shady clandestine stuff for the US military and intelligence communities (they even supported the US CLOUD Act). Also, they manufacture stuff in China. I'm sure they have to be very careful with this sort of press release.

228 points by fauigerzigerk 3y ago

Shouldn't the use of zero days slightly vindicate Microsoft? It's certainly not a good look, but at least they weren't willfully neglecting to patch issues known to them.

Veserv 3y ago

0-day is such a poor word. We should really be calling it by the generic cross-domain term, a defect, in this case a security defect. Microsoft is selling a defective product where new defects are regularly identified and regularly cause failures and harm. It is generally frowned upon or illegal to sell defective products. In many other industrys the discovery of multiple, repeated defects in a product allows the customer to get a full refund with protection from retaliation. Only in software do we call defects a oopsie and throw our hands up in the air as if nothing could be done and let companys off the hook. Normalizing this process by handling trillion dollar companys with kids gloves is ridiculous. They are selling defective products and should be treated like it.

Jedd 3y ago
As someone with opinions on english usage (I was just eye-twitching at another front page HN story - the misused possessive on 'pilot's licence') I can see why '0 day' may not perfectly capture or convey a certain type of exploit, but I don't think this would improve clarity. I've always distinguished a defect as a fault that was known prior to shipping (and hopefully documented) and a bug is a fault discovered after shipping. Draw your own analogies for SaaS, I guess. But given another popular distinction between defect and bug is more around design vs unexpected failures, it may be hubris to overload either of those terms with all the extra meaning that's already captured by '0 day'. As TFA notes, it'd be preferable if Microsoft didn't weasel away from commonly used and well understood words like vulnerability & exploit, or if they didn't eschew industry standard CVE reporting.
- Veserv 3y ago
  A defect is a fault or flaw that prevents the stated usage of a product. That is the plain meaning in literally every industry. A defective product is one fails to achieve its stated specifications, guarantees, or use. A airbag that, unknowingly at the time of manufacture, explodes after exposure to high heat or humidity has a defect. The product, now knowing that it contains a material defect, is defective. The use of bug, 0-day, vulnerability, exploit, etc. when making PR statements about security defects in software is a deliberate effort to downplay the severity of their failures. They deliberately avoid the use of the word “defect” because in many industrys that has literal legal consequences. At many companys, putting the word defect in a email has the general counsel descend, that is how serious it is. In contrast, calling a flaw that prevents the stated usage of your product a “bug” lets you sidestep all of that by mischaracterizing it as a legally meaningless “oopsie”. These flaws are defects. They clearly cause the products to not achieve their stated goal and the failures cause demonstrable harm. Calling them anything less is just handling these trillion dollar companys with kid gloves which is how we got into this systemically incompetent security mess. They need to be held to the same standards we hold other companys to and fix their damn products or get out of the businesses that they are too incapable to do acceptably.
  - NoZebra120vClip 3y ago
    > not achieve their stated goal What is the stated goal of software packages whose EULA often includes a disclaimer, "NO WARRANTY OF FITNESS FOR ANY PURPOSE"?
    - Veserv 3y ago
      Same as for any physical product. If you are selling to a general consumer via a one-sided contract then there are implicit guarantees of fitness for the plainly advertised purpose that can almost never be waived at least in the US. Note that this does not usually apply to gifts so non-commercial OSS is likely unaffected. If you are selling to a business customer then they are accepting those terms. If they wish to then go on and use that product in their delivery to a general consumer then they are accepting the liability of verifying or making it fit for their purpose. If they wish to provide other guarantees then they are also responsible for those.

2OEH8eoCRo0 3y ago

Victim blaming. Microsoft can do better but practically no organization can withstand the cyber onslaught coming out of China.

killjoywashere 3y ago
I think the real issue this particular post was raising was the pay-to-play scheme for the rights to examine your own log files.
- hulitu 3y ago
  The point is that telemetry is Microsoft's data. Some people still don't underestand what "cloud" means from a data perspective. (Look, we encrypt your data. With our key :)) )
croes 3y ago
The victims are the MS customers, MS is as much a victim as KIA because of their USB hack.
hulitu 3y ago
You're right. Microsoft can not withstand _any_ cyber onslaught. After 20 years of "improved security" they still don't get it right. But as long as the management loves Microsoft, i guess we are stuck with it.

nazgulsenpai 3y ago

I thought the issue was that the attackers had an Azure AD signing key.[0] I was under the impression it was an inside job. [0] https://www.bleepingcomputer.com/news/microsoft/microsoft-still-unsure-how-hackers-stole-azure-ad-signing-key/ https://www.bleepingcomputer.com/news/microsoft/microsoft-st...

jsnell 3y ago
No, and your own link says otherwise, i.e. that it was an "inactive Microsoft account (MSA) consumer signing key". But in addition to letting the key get compromised, their code for validating the signatures had vulnerabilities and allowed a consumer signing key to be used to sign AD tokens.
- nazgulsenpai 3y ago
  Inactive but not revoked. They revoked it on June 27th. Still I do see there was a flaw in the GetAccessTokenForResource API. > "No key-related actor activity has been observed since Microsoft invalidated the actor-acquired MSA signing key," Microsoft said.
  - croes 3y ago
    Yep, MS botched it, again >The actor used an acquired MSA key to forge tokens to access OWA and Outlook.com. MSA (consumer) keys and Azure AD (enterprise) keys are issued and managed from separate systems and should only be valid for their respective systems. The actor exploited a token validation issue to impersonate Azure AD users and gain access to enterprise mail. https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/ https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-...

jsnell 3y ago

It's starting to feel to me like modern day Microsoft has some kind of a Teflon coating. In the last month alone they've had their flagship cloud services down for extended periods of time due to DDoS attacks, had their auth cookie signing keys compromised and abused at scale, and had a lawsuit reveal emails about how they were planning to use their cash at hand to buy all the content and destroy's Sony's gaming business. And none of it has any impact, nobody seems to care. The comments in this thread are crazy to me. Yes, dealing with targeted attacks by nation states is hard, and occasionally you'll fail. But that's part of the reason to pay Microsoft rather than try to host your own. In that situation the absolute minimum expectation is for MS to follow basic best practices. Nothing about this story suggests they've been doing that, it's just one wtf after another. And their communication on this has been so bad an unclear that it has to have been intentionally obfuscatory.

andromaton 3y ago
I used to consider their cloud products secure. When bings home page (plus i don't know how many tenants) was found incorrectly protected a few months ago i stopped. Google will discontinue your product or lock you out. Microsoft will let third parties in . We need better "office" platform vendors.
- lockhouse 3y ago
  Google Cloud if you want to live dangerously Azure if you're a .NET shop and want good integration with Visual Studio AWS for everyone else
  - bradleyjg 3y ago
    Azure’s salespeople are really good. In reality it’s azure if your cio insists.
  - jiggawatts 3y ago
    Hilariously, Azure PaaS offerings of Microsoft products are notably worse than what is available in AWS. Examples: - SQL Server Analysis Services (SSAS) has no Azure PaaS, but there is an AWS PaaS for it. - RDS for SQL in AWS allows setting a time zone, Azure SQL Database is UTC only, breaking the majority of existing databases when migrated. (They confuse what "developers should do" with what "developers actually do".) - Azure's PaaS for Active Directory (Azure AD Domain Services) can only be linked to an Azure AD tenant, it can't be used as a standalone authoritative domain. AWS allows this scenario. Essentially, every Microsoft product you can think of is easier/cheaper/better on AWS instead of Azure. If Microsoft's CEO was still Bill Gates, heads would have rolled a long time ago.

kjellsbells 3y ago

Press coverage was also quite muted. Take a look at this from the New York Times: Chinese Hackers Targeted Commerce Secretary and Other U.S. Officials https://www.nytimes.com/2023/07/12/us/politics/china-state-department-emails-microsoft-hack.html https://www.nytimes.com/2023/07/12/us/politics/china-state-d...

yyyk 3y ago

IMHO, Azure AD has problems with AuthZ: It's too easy to accidentally only do AuthN*, it's too underdocumented, customization is non-trivial... In general, you're much better off only taking the AuthN part, and implementing AuthZ yourself. It's not as if the lower tier Azure AD allows you to look at useful logs anyway. * The bug here being too wide a scope, or more likely, the scope not being checked at all. Not the first time this class of bug has happened with a Microsoft product on Azure: https://news.ycombinator.com/item?id=35364383 https://news.ycombinator.com/item?id=35364383

predictabl3 3y ago

Oh I looove that it's some access token exchange API that is likely at the heart of this. After the constant nightmares that AD caused Azure for ages, this is just too perfect.

Woodi 3y ago

Microsofti is 0-day, even permament and unlimited set of 0-days. When do we have alternative hw, os and apps stack ? You know, equal in eyes of govs and users of all kinds. Yes, Excel alternative and rest. END SWITCH OFF THAT IDIOCY CALLED Exchange !! /caps must stay Edit: Wait, do thay wait with announcing this gov-level discredit until FCC allow them to buy Blizzard ?

hedora 3y ago

Well, if it wasn't a zero day, then it means they aren't patching their own services in a timely fashion. It's also possible that they have to word things carefully because international diplomacy happens in a language that looks like english, but is not. (In the same way the legal documents are not quite english.) For instance, "China exploited zero days in our cloud services and targeted US gov't communications. We are addressing the situation." could mean "China has committed an act of war against the US, and we are responding in kind on behalf of the US government." The last time I checked, Microsoft did all sorts of shady clandestine stuff for the US military and intelligence communities (they even supported the US CLOUD Act). Also, they manufacture stuff in China. I'm sure they have to be very careful with this sort of press release.