3 ms·

So if we remove the careful wording, someone downloaded a minidump onto a dev workstation from production and then it was probably left rotting in corporate One

by baz00 3y ago

So if we remove the careful wording, someone downloaded a minidump onto a dev workstation from production and then it was probably left rotting in corporate OneDrive until that developer's account was compromised. Someone took the dump, found a key in it and hit the jackpot.

trifurcate 3y ago
And, crucial to this exploit actually working to the extent it did, Microsoft's own developers failed to implement a secure authentication check on top of their own libraries and infrastructure.
- runeks 3y ago
  How so?
  - baz00 3y ago
    Leaving credentials and keys in memory.
    - drodgers 3y ago
      Also completely failing to check the scope of the request before validating it! > Microsoft provided an API to help validate the signatures cryptographically but did not update these libraries to perform this scope validation automatically
remram 3y ago
And there was a redaction system, which did not redact the key ("race condition"). Then a detection system, which didn't detect the key. And then the key was used to access an entirely different system with an entirely different access level and it just worked anyway. The phrasing as "some obscure bugs were carefully exploited" seems a bit off, it looks more like a comedy of errors where none of the security systems served its purpose at all.
- baz00 3y ago
  That's because the whole idea of a redaction system is stupid. You can't start out with something unconstrained and expect to patch all the holes in it. Mathematically speaking, you start with set A which is all possibilities and set B which is all the things you know to remove and you end up with A \ B not {}. You have to start out with something constrained and allow only the good bits through the holes. Having a similar discussion at the moment. Which is the correct solution: a) Buy some software to redact all PII from logs b) don't put it in there in the first place
  - remram 3y ago
    I agree in general, but for "signing key material", there should be enough entropy and they have enough control over the format to make it very easy to detect. Plus, they are the ones who put the security of their system behind this detection, letting developers access the dump they believed to be redacted. Whether they made a massive mistake at the design or implementation phase doesn't really absolve them.

by baz00 3y ago

trifurcate 3y ago

And, crucial to this exploit actually working to the extent it did, Microsoft's own developers failed to implement a secure authentication check on top of their own libraries and infrastructure.

runeks 3y ago
How so?
- baz00 3y ago
  Leaving credentials and keys in memory.
  - drodgers 3y ago
    Also completely failing to check the scope of the request before validating it! > Microsoft provided an API to help validate the signatures cryptographically but did not update these libraries to perform this scope validation automatically

remram 3y ago

And there was a redaction system, which did not redact the key ("race condition"). Then a detection system, which didn't detect the key. And then the key was used to access an entirely different system with an entirely different access level and it just worked anyway. The phrasing as "some obscure bugs were carefully exploited" seems a bit off, it looks more like a comedy of errors where none of the security systems served its purpose at all.

baz00 3y ago
That's because the whole idea of a redaction system is stupid. You can't start out with something unconstrained and expect to patch all the holes in it. Mathematically speaking, you start with set A which is all possibilities and set B which is all the things you know to remove and you end up with A \ B not {}. You have to start out with something constrained and allow only the good bits through the holes. Having a similar discussion at the moment. Which is the correct solution: a) Buy some software to redact all PII from logs b) don't put it in there in the first place
- remram 3y ago
  I agree in general, but for "signing key material", there should be enough entropy and they have enough control over the format to make it very easy to detect. Plus, they are the ones who put the security of their system behind this detection, letting developers access the dump they believed to be redacted. Whether they made a massive mistake at the design or implementation phase doesn't really absolve them.