6 ms·

Microsoft Signing Key Stolen by Chinese

79 points by DemiGuru 3y ago

freedude 3y ago
Senator Wyden thinks that the Solarwinds breach could have provided valuable insight to prevent incidents like this one. " On May 12, 2021, President Biden issued Executive Order 14028, which among other things, created a Cyber Safety Review Board, whose first task would be to study the SolarWinds incident. That review never took place — the Board was subsequently directed by the Department of Homeland Security to study another hacking incident. I have repeatedly pushed CISA and DHS to direct the Board to study the SolarWinds incident, but have been rebuffed. Had that review taken place, it is quite likely that Microsoft’s poor data security practices around encryption keys would have come to light, and this most recent incident might have been averted. " [PDF] https://www.documentcloud.org/documents/23888590-wyden_letter_to_cisa-doj-ftc_re_2023_microsoft_breach https://www.documentcloud.org/documents/23888590-wyden_lette...
h2odragon 3y ago
Wise person once said: "Trust is the necessary precondition for betrayal." Big organizations like Microsoft cannot be more secure than one individual's systems; someone runs their servers and they wear pants and make mistakes, just like we do. What the big shop can do is cover up their mistakes and confuse responsibility once they're made. As well as providing an easy one stop shop for bad actors with things like GitHub ("subvert the world's infrastructure all at once!").
- _8j50 3y ago
  A) only a handful of companies can even afford to secure their infra as much as MS. Security is relative to threat actors, not absolute. One individual cannot defend themselves against an APT team (P=persistent). B)I don't know if you heard about infamous mass-exploitations like the recent moveit or russia with solarwinds but an APT will still pwn everyone. One stop shop or not. Having one place is actually good because you won't have 1000+ incident responses and remediation is also a one stop action as is figuring out scope and impact.
  - fatfingerd 3y ago
    I'm not really sure about this logic. Is an APT going to use anything but old vulnerabilities against an off cloud shop that might have unique auditing to burn them? Are they going to develop a new one for such a shop when the payout couldn't be a fraction of what a success would return from even a minor cloud vendor? On top of that you also have all the same regular vectors of desktop/mobile OSes, etc. So the cloud isn't really an adequate defense if you are a real target and is just one much more handy cookie cutter vector that will almost certainly trawl your data accidentally to an APT group when a mistake makes it practically free.
    - _8j50 3y ago
      Going back to moveit as an example, they used a zeroday and mass-ransomed people. The cloud isn't an adequate defense, it is just better than the defense less resourced companies and people can put together. With APTs it is all a competition of resources. If you can self-host and spend more resources than say Microsoft or Google on securing it, go for it. There is nothing more or less secure about doing cloud or self-hosting, what matters is how much money you can put into it but more importantly, how much talent you can attract. Not only do MS and Google have hefty bounties for finding vulns, skilled people flock to them for the opportunity to work there, even at lower salaries! Likewise, intel agencies and gov/mil units are coveted by skilled people. To use a real world analogy, a chinese specialops unit might invade your small town and the argument here is to buy guns and practice shooting using the locals (self-host) vs calling in the army (NSA -- i blame them!) or paying a mercenary group (because the army won't dedicate a unit to your small town only). It doesn't matter if everyone in your town is ex-military, even if you defeat the chinese specialops unit, their mission will remain,they will just keep sending more people and more firepower and better strategies until they win. And just because a mercenary group lost to a chinese specialops unit does not mean you should have been using civilians to begin with, that's a false equivalency.
      - fatfingerd 3y ago
        Doesn't a service like moveit just blur the lines between cloud and on premises? I mean how exactly did they find these 400 orgs fast enough, was it a centralized command center? You lost me entirely on the second paragraph. Some kind of militia attitude or trusting private armies probably means you are getting well beyond normal civilian behavior. You buy locks, you compare lock manufacturers, if you aren't the easiest of targets or the most valuable you represent a waste of time.
jhoelzel 3y ago
Its almost like centralizing software to mayor clouds is not such a good idea after all ;) Governments should own their own datacenters and access should be highly regulated. If you can spend billions on military projects that go nowhere, you should be able to spend a couple of million on people that create a networking structure for your that is based on RBAC, that is not owned by somebody else
- DemiGuru 3y ago
  I would go even further and say that governments should consider having their own OS. There is no reason why Windows 10 and 11, with their ever increasing number of ads and information sieve, would belong there.
  - fsociety 3y ago
    If it doesn’t belong there then it doesn’t belong here.
- lockhouse 3y ago
  Sadly, the federal government doesn’t have a great track record here either… https://en.m.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.m.wikipedia.org/wiki/Office_of_Personnel_Manageme...
  - toomuchtodo 3y ago
    It's duct tape and hope all the way down. (infosec/grc practitioner)
- landemva 3y ago
  > Governments should own their own datacenters Most government data should be on local in-country leased infrastructure. Government should not be building palaces and isolated from the people. It's my government and for the most part should be open.
- _8j50 3y ago
  A nation state compromises a cloud infra and that's your takeaway? Was your takeaway after solarwinds the opposite? To move it to the cloud? It's almost as if it is very easy to make reductionist statements without considering the nuances of the subject. While you're at it, stop using gmail and other webmail and selfhost. I am sure it will be more secure? Lol.
svaha1728 3y ago
Microsoft really needs to split like Google and Alphabet. Having the top leadership rush full on into AI and Low Code / No Code solutions is counter to running a successful cloud business.
- Dudester230602 3y ago
  Wasn't Pichai rushing somewhere this very summer? The sort of rushing that starts when you lag behind?
- isanjay 3y ago
  Two of the most user hostile companies of our times.
deleted 3y ago
[deleted]
jsnell 3y ago
Previous discussions below. Scheier's claim that this is related to SolarWinds is new AFAIK, but also seems like it's entirely speculation? https://news.ycombinator.com/item?id=36740133 https://news.ycombinator.com/item?id=36740133 https://news.ycombinator.com/item?id=36770235 https://news.ycombinator.com/item?id=36770235 https://news.ycombinator.com/item?id=36823007 https://news.ycombinator.com/item?id=36823007 https://news.ycombinator.com/item?id=36979532 https://news.ycombinator.com/item?id=36979532 https://news.ycombinator.com/item?id=36731731 https://news.ycombinator.com/item?id=36731731
tempnow987 3y ago
I don't understand how they extracted the key from the HSM. How is this even possible - the vendor of the HSM should be named!
rickstanley 3y ago
I don't understand, is this a breach in MS Azure accounts or personal accounts or both? I mean, I use Authenticator to log in from my phone and I have disabled the password as a way to log in; am I also a potential victim of this attack?

79 points by DemiGuru 3y ago

Senator Wyden thinks that the Solarwinds breach could have provided valuable insight to prevent incidents like this one. " On May 12, 2021, President Biden issued Executive Order 14028, which among other things, created a Cyber Safety Review Board, whose first task would be to study the SolarWinds incident. That review never took place — the Board was subsequently directed by the Department of Homeland Security to study another hacking incident. I have repeatedly pushed CISA and DHS to direct the Board to study the SolarWinds incident, but have been rebuffed. Had that review taken place, it is quite likely that Microsoft’s poor data security practices around encryption keys would have come to light, and this most recent incident might have been averted. " [PDF] https://www.documentcloud.org/documents/23888590-wyden_letter_to_cisa-doj-ftc_re_2023_microsoft_breach https://www.documentcloud.org/documents/23888590-wyden_lette...

h2odragon 3y ago

Wise person once said: "Trust is the necessary precondition for betrayal." Big organizations like Microsoft cannot be more secure than one individual's systems; someone runs their servers and they wear pants and make mistakes, just like we do. What the big shop can do is cover up their mistakes and confuse responsibility once they're made. As well as providing an easy one stop shop for bad actors with things like GitHub ("subvert the world's infrastructure all at once!").

_8j50 3y ago
A) only a handful of companies can even afford to secure their infra as much as MS. Security is relative to threat actors, not absolute. One individual cannot defend themselves against an APT team (P=persistent). B)I don't know if you heard about infamous mass-exploitations like the recent moveit or russia with solarwinds but an APT will still pwn everyone. One stop shop or not. Having one place is actually good because you won't have 1000+ incident responses and remediation is also a one stop action as is figuring out scope and impact.
- fatfingerd 3y ago
  I'm not really sure about this logic. Is an APT going to use anything but old vulnerabilities against an off cloud shop that might have unique auditing to burn them? Are they going to develop a new one for such a shop when the payout couldn't be a fraction of what a success would return from even a minor cloud vendor? On top of that you also have all the same regular vectors of desktop/mobile OSes, etc. So the cloud isn't really an adequate defense if you are a real target and is just one much more handy cookie cutter vector that will almost certainly trawl your data accidentally to an APT group when a mistake makes it practically free.
  - _8j50 3y ago
    Going back to moveit as an example, they used a zeroday and mass-ransomed people. The cloud isn't an adequate defense, it is just better than the defense less resourced companies and people can put together. With APTs it is all a competition of resources. If you can self-host and spend more resources than say Microsoft or Google on securing it, go for it. There is nothing more or less secure about doing cloud or self-hosting, what matters is how much money you can put into it but more importantly, how much talent you can attract. Not only do MS and Google have hefty bounties for finding vulns, skilled people flock to them for the opportunity to work there, even at lower salaries! Likewise, intel agencies and gov/mil units are coveted by skilled people. To use a real world analogy, a chinese specialops unit might invade your small town and the argument here is to buy guns and practice shooting using the locals (self-host) vs calling in the army (NSA -- i blame them!) or paying a mercenary group (because the army won't dedicate a unit to your small town only). It doesn't matter if everyone in your town is ex-military, even if you defeat the chinese specialops unit, their mission will remain,they will just keep sending more people and more firepower and better strategies until they win. And just because a mercenary group lost to a chinese specialops unit does not mean you should have been using civilians to begin with, that's a false equivalency.
    - fatfingerd 3y ago
      Doesn't a service like moveit just blur the lines between cloud and on premises? I mean how exactly did they find these 400 orgs fast enough, was it a centralized command center? You lost me entirely on the second paragraph. Some kind of militia attitude or trusting private armies probably means you are getting well beyond normal civilian behavior. You buy locks, you compare lock manufacturers, if you aren't the easiest of targets or the most valuable you represent a waste of time.

jhoelzel 3y ago

Its almost like centralizing software to mayor clouds is not such a good idea after all ;) Governments should own their own datacenters and access should be highly regulated. If you can spend billions on military projects that go nowhere, you should be able to spend a couple of million on people that create a networking structure for your that is based on RBAC, that is not owned by somebody else

DemiGuru 3y ago
I would go even further and say that governments should consider having their own OS. There is no reason why Windows 10 and 11, with their ever increasing number of ads and information sieve, would belong there.
- fsociety 3y ago
  If it doesn’t belong there then it doesn’t belong here.
lockhouse 3y ago
Sadly, the federal government doesn’t have a great track record here either… https://en.m.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.m.wikipedia.org/wiki/Office_of_Personnel_Manageme...
- toomuchtodo 3y ago
  It's duct tape and hope all the way down. (infosec/grc practitioner)
landemva 3y ago
> Governments should own their own datacenters Most government data should be on local in-country leased infrastructure. Government should not be building palaces and isolated from the people. It's my government and for the most part should be open.
_8j50 3y ago
A nation state compromises a cloud infra and that's your takeaway? Was your takeaway after solarwinds the opposite? To move it to the cloud? It's almost as if it is very easy to make reductionist statements without considering the nuances of the subject. While you're at it, stop using gmail and other webmail and selfhost. I am sure it will be more secure? Lol.

svaha1728 3y ago

Microsoft really needs to split like Google and Alphabet. Having the top leadership rush full on into AI and Low Code / No Code solutions is counter to running a successful cloud business.

Dudester230602 3y ago
Wasn't Pichai rushing somewhere this very summer? The sort of rushing that starts when you lag behind?
isanjay 3y ago
Two of the most user hostile companies of our times.

deleted 3y ago

[deleted]

jsnell 3y ago

Previous discussions below. Scheier's claim that this is related to SolarWinds is new AFAIK, but also seems like it's entirely speculation? https://news.ycombinator.com/item?id=36740133 https://news.ycombinator.com/item?id=36740133 https://news.ycombinator.com/item?id=36770235 https://news.ycombinator.com/item?id=36770235 https://news.ycombinator.com/item?id=36823007 https://news.ycombinator.com/item?id=36823007 https://news.ycombinator.com/item?id=36979532 https://news.ycombinator.com/item?id=36979532 https://news.ycombinator.com/item?id=36731731 https://news.ycombinator.com/item?id=36731731

tempnow987 3y ago

I don't understand how they extracted the key from the HSM. How is this even possible - the vendor of the HSM should be named!

rickstanley 3y ago

I don't understand, is this a breach in MS Azure accounts or personal accounts or both? I mean, I use Authenticator to log in from my phone and I have disabled the password as a way to log in; am I also a potential victim of this attack?