19 ms·

Everything authenticated by Microsoft is tainted

772 points by ColinWright 3y ago

panki27 3y ago
I read a good analogy recently: The titanic (cloud) is sinking, the engine room is already full of water, but the people in the ballroom (execs) are still celebrating with champagne, even though the warnings have been called multiple times.
- catchnear4321 3y ago
  drown in champagne or drown in filthy sea water? for some, this sounds like a nonsensical choice. for others, a defining moment of leadership.
  - cf141q5325 3y ago
    https://nationalpost.com/news/canada/charles-joughin-titanic-anniversary-april-15-drunk https://nationalpost.com/news/canada/charles-joughin-titanic... >How a baker survived the Titanic sinking by getting really drunk Bottoms up!
    - catchnear4321 3y ago
      just coming back a few later to say thanks, you tha real mvp.
- dudeinjapan 3y ago
  This is the cloud so you can’t call it the Titanic—-its the Hindenburg.
- ChatGTP 3y ago
  I read this recently, I found it chillingly similar to our current situation, a truly great read: The Machine Stops by E.M Foster https://web.cs.ucdavis.edu/~rogaway/classes/188/materials/the%20machine%20stops.pdf https://web.cs.ucdavis.edu/~rogaway/classes/188/materials/th...
  - CatWChainsaw 3y ago
    It's pretty impressive that the most accurate depiction of how the future will play out was written before even computers were a thing. Perhaps also a bit sad in what that says about us.
- swexbe 3y ago
  This is clearly an overreaction. Cloud will be fine.
  - doublerabbit 3y ago
    He defeats Sephiroth at the end of the game. Maybe he'll defeat Microsoft too.
    - reuben364 3y ago
      Typical JRPG. Start with saving a cat, end with fighting Microsoft.
- hnlmorg 3y ago
  How is that a good analogy when the cloud computing sector has been growing year on year? There's literally no evidence to support that analogy. It's not even remotely accurate. I'm not saying cloud computing is the solution to every problem, and nor should it be, but calling it a sinking ship is simply absurd. Frankly, I grow so tired of people thinking everything is a boolean choice. The real problem with the cloud is people who see things as binary statements: "cloud is cheaper", "cloud is more expensive", "self hosting is easier", "cloud is easier", "cloud is more secure", "on-prem is more secure", etc. All of those statements are true just as all of those statements are false. The reality is far more nuanced and it depends entirely on the constraints of your business at that point in time. Such as what engineers / skill sets do you have on your team? Capital to buy hardware, your physical location, the product you're trying to build... etc. But the problem with nuanced arguments is they're subjective to the immediate problem you're trying to solve. So you cannot debate them with other people as those other people are trying to solve different problems with different teams and different tools. And thus we end up with people posting bullshit blanket statements like "the cloud is a sinking ship" or the linked article that boasts that the cloud is less secure.
  - imchillyb 3y ago
    Security researchers agree with OP and disagree vehemently with your assessment. Cloud is centralizing. Centralizing, instead of distributing, is bad. Centralization broadens and expands the attack surface and creates a honey pot for attackers. This isn’t hyperbole nor is it alarmist. This is reality playing out before us in real time.
    - epups 3y ago
      "Security researchers agree" is a very broad statement. I don't believe there is a consensus at all. Fragmentation creates different problems than centralization, but it isn't a magical bullet either. Depending on your resources, you are far, far better off trusting even Microsoft than trying to come up with your own security implementation.
      - 3y ago
- cf141q5325 3y ago
  Arguably much of this is caused by governments getting into the zeroday market / blackhat position removing the incentives to fix stuff. IT security got degraded so far that it starts effecting the economy. There was a reason initial cryptocontrol had exceptions for businesses. Bloated security theater being profitable also doesnt help. One example is smartphones as TAN generators for online banking replacing TAN lists. While you can now charge customers per SMS, the second factor got quite a bit more easy to attack.
  - tomrod 3y ago
    > Arguably much of this is caused by governments getting into the zeroday market / blackhat position removing the incentives to fix stuff. I don't see the argument here. CISA posts issues they find, are they intended to be comprehensive?
    - cf141q5325 3y ago
      Unfortunately i dont see yours either. We have governments arguing against stronger encryption due to fears of going dark. Which means against having secure systems. This is in addition to a lot of government agencies sitting on, and investing into the knowledge about vulnerabilities. Some of the more public ones getting fixed doesnt change the overall vulnerability of the system. There is a clear incentive mismatch. One cant pretend that those vulnerabilities are "safe" due to only spooks knowing of them. If you can find them, so can others. Especially if you are actively exploiting them. I would argue that this shows both an unwillingness to accept improvements in security as well as actively degrading the current state. And this is before talking about governments actively adding vulnerabilities, which now even possible by law in some jurisdictions.
MaKey 3y ago
Give it a few years and then on-prem hardware and simple server hosting will become fashionable again.
- ahoka 3y ago
  On-prem is very expensive compared to cloud.
  - AlexandrB 3y ago
    It's actually often cheaper[1], assuming you need a relatively fixed amount of compute and have the capital for upfront costs. Cloud gives you a lot of flexibility, but at a premium, and trades CAPEX for OPEX which is very appealing if you're a startup and don't know if you'll be around in a year. [1] https://www.researchgate.net/figure/Yearly-cost-difference-of-Cloud-versus-On-Premise_tbl2_327957126 https://www.researchgate.net/figure/Yearly-cost-difference-o...
  - doublerabbit 3y ago
    For upfront costs, it can be. But when your running its pretty smooth sailing. Or is this the discussion of having a team of SysOps vs a team of Cloud Engineers?
    - ahoka 3y ago
      Most software vendors switched to subscription model, so that’s not obvious anymore. Yeah and as you mention, good luck getting experts for all of your software and hardware components unless you are a big tech company.
  - shadowgovt 3y ago
    And not guaranteed to solve problems like this. Because at the end of the day, the maintenance of a cloud infrastructure is irreducible complexity so you replace having a breach because a centralized controlling authority made a mistake with having a breach because your own hired staff made a mistake and you got infiltrated by either a lucky drive by or a persistent attacker against your organization.
deleted 3y ago
[deleted]
mrjin 3y ago
People fled from mainframes, now they are flocking to cloud...
- orionblastar 3y ago
  People fled from mainframes to client server. Running a Windows Server with BackOffice in their IT department and having Windows clients. Now they are flocking to the cloud. I remember when the Network Computer was going to put Microsoft out of business. It was Sun providing the NC and JavaOS, Netscape providing the Web Browser and anyone who wanted to license the NC to make their own. Internet was too slow then as everything was stored on the Internet, which because the Cloud model. Microsoft bundled IE with Windows to destroy Netscape and made Dotnet destroy Java. This is embarrassing for Microsoft. All their cloud services have been hacked. Data has been leaked. Could lead to lawsuits.
- BirAdam 3y ago
  Plus ça change, plus c’est la même chose.
candiddevmike 3y ago
This seems overly hyperbolic and alarmist. I do not think the sources prove the scope of breach the post asserts ("all of Microsoft"), seems more like a temporary key leak that was subsequently revoked.
- tommis 3y ago
  [flagged]
  - freitzkriesler2 3y ago
    Surprised I don't see M$FT. It's like slashdot in the early 2000s. Edit: -4 downd00ts! Haha must have triggered a few oldies who never let go of their hate.
    - tmpX7dMeXU 3y ago
      M$
      - ddtaylor 3y ago
        Winblows
        henriquez 3y ago
        [flagged]
    - AtlasBarfed 3y ago
      Why do you think people hated Microsoft? Let's see if you know actually know anything about their deep and wide business sociopathy. One of the big reasons that monopolies are really bad is that they are also inevitably incompetent. The fact those two things go hand in hand makes the inherent corruption of monopoly / cartels doubly damaging. ....almost all markets are cartels at a minimum these days
bionhoward 3y ago
We all ought to be using Qubes OS! We, as the Hacker News community, ought to be more concerned about making it easier to use reasonably secure systems. How do I buy a computer that runs Qubes? https://www.qubes-os.org/ https://www.qubes-os.org/ https://www.qubes-os.org/doc/system-requirements/ https://www.qubes-os.org/doc/system-requirements/
- nextlevelwizard 3y ago
  why?
- buro9 3y ago
  As someone who runs Qubes on one of my laptops (the travel one) I can assure you that your long battery life days are over.
  - lsllc 3y ago
    Yes, the shortened battery life is quite noticeable.
- nolist_policy 3y ago
  Or get a Chromebook. Say what you want about Google but its one of the few who really care about security.
- hiatus 3y ago
  How would Qubes help here? Separately, Qubes runs fine on a framework laptop.
throwawysn38 3y ago
Microsoft should have done a clean room implementation of their cloud and used that to pivot their customers into more manageable technology for both parties. That they've chosen to integrate it with all their legacy stack (which is one of the most complicated ones in existence) is understandable and what 99% of companies would have done but... it's a horrible experience using it. Maybe people with only Microsoft experience don't feel the pain anymore.
- BirAdam 3y ago
  Your viewpoint isn’t without merit. I think it’s just a cost/benefit analysis issue though. Each platform has its own warts. For Microsoft, they built much of their business on backward compatibility, so breaking with that would be tough. As concerns the cloud, MS does partner with Canonical quite a bit, so it isn’t as if they are dogmatic in their tech stack. This issue seems more of a company one and not a technical one.
- Muromec 3y ago
  Having backwards compatibility is their defining feature and selling point, so no way ant of that will happen
ggeorgovassilis 3y ago
This story has been widely under-reported and the impact is potentially huge. My beef with MS is this: the keys were leaked in 2021 and were still signing authentication tokens in 2023, but there's not a single Azure service that allows me to enter credentials with a 2 years duration. It's a classic case of "do as I say, not as I do".
- ahoka 3y ago
  This. They don’t even use a HSM if I understood correctly and using one is not part of the mitigation plan. Not OK.
  - lazide 3y ago
    HSM’s are super inconvenient obviously, and as Mr. Robot showed not perfect. So why bother? /s
    - jnsaff2 3y ago
      Apparently they might also be backdoored by the NSA: https://news.ycombinator.com/item?id=37571014 https://news.ycombinator.com/item?id=37571014
      - lazide 3y ago
        Still probably better than having the private key part of a random core dump from a random developer. :s That’s just embarrassing.
        jnsaff2 3y ago
        No doubt. My expectations to MS engineering are really low so I'm unfortunately not shocked.
      - grotorea 3y ago
        Frankly is this important? If the NSA is a threat to you do you have any business trusting MS?
victor106 3y ago
This issue is specific to Azure and Microsoft. I find AWS and GCP to be fine. Microsoft has some of the worst security vulnerabilities and practices I have ever seen. I can’t for the life of me figure out how executives at big Fortune 500 move their workloads to Azure. The only selling point Microsoft has for Azure in some domains is that Amazon is their competitor. I wish Amazon just let AWS be it’s own thing. I also hope that Microsoft step up their security game but at this point it’s kind of a lost cause.
- orionblastar 3y ago
  I used to work as a federal contractor for the US Military in 1996-1997 and they replaced their Windows Web Servers with Macintosh ones because the Mac had better security. I used to run a Windows 2000 Pro web server, after lack of security I switched to Linux. Microsoft may be popular, but they have big holes in their security. Always has been.
  - barrkel 3y ago
    They replaced Windows NT with Classic Mac OS?
    - orionblastar 3y ago
      Yes. https://news.slashdot.org/story/99/09/10/1034202/army-dumps-nt-as-web-server-moves-to-mac https://news.slashdot.org/story/99/09/10/1034202/army-dumps-...
    - e12e 3y ago
      Isn't that like moving from Windows NT to windows 95 for hosting your web server?
    - ok123456 3y ago
      Harder to execute a useful payload in a cooperative multitasking environment.
    - tzs 3y ago
0xPIT 3y ago
While the post is great, terrifying, and seems to contain only true and verifiable information, I’m not sure what we expect. „Normal“ people will not read this, nor be able to understand, nor gauge or grasp the impact. It’s become way to complex. We can’t simply stop using mentioned services anymore as a society. Wouldn’t it be more reasonable to teach: 1. You have no privacy, it is impossible to ensure or guarantee privacy, and there’s no incentive at all for anyone to ensure privacy. (Scott McNeally of Sun said that already in the late 1990s) 2. There is no security and every kind of security has been, was designed to, or will be compromised. 3. All your digital information is already public or will become public at some point. (btw: Every top-tier consultancy operates under that assumption)
- cf141q5325 3y ago
  I think a new approach to privacy is likely around the corner. Why have one conversation with somebody when you can have as many as you want all at once? There were already addons like that that created garbage traffic a while ago. Just wasnt practical without language networks.
- loup-vaillant 3y ago
  Those 3 points are only teaching despair. The more useful thing to teach is who we can blame, and how to reclaim actual privacy and security… even if it means using the dreaded regulation hammer.
  - lazide 3y ago
    None of which will change those three points practically. For any bit of information, they may not apply, but if you assume they’re true you’ll: 1) not record information that is truly damaging in a damaging way (which is really good practice in general if you’ve got something to lose!) 2) have practical operational practices which do not rely on these being false - which is a really good idea if that actually matters (you have actual enemies somewhere). 3) you’ll focus on safety and building value in areas which are not mere information at rest, which is a good modern practice. Osama Bin Laden already knew all this, which is why it took so long to find him. A decade or so. I guarantee you the CIA has been learning this with all their leaks. The FBI learned this this after COINTELPRO. What is not written down can’t show up as a grainy photocopy in the New York Times, or a viral video from Wikileaks, or whatever. What you’re talking about is a hammer to use to punish someone after a leak. But by then it’s far too late for anything actually valuable. Necessary and important for ‘day to day’ stuff like bank account balances I guess, as long as you assume that they’ll be violated with little practical recourse if you have anything actually valuable in it. Streisand effect, etc.
bilekas 3y ago
This is actually wild.. I'm only reading about this properly now thanks to this article but how did this fly under the radar? The company i work for just recently integrated all of our internal apps and services authentication through azure .. That feels like it was a mistake now.. or am I just over paranoid??
- Muromec 3y ago
  The postmortem about this was here on the front page few weeks ago. No conspiracy needed, just normal big tech malpractice
  - e12e 3y ago
    Do you have a link? There's been a lot of stories about Microsoft, Azure and security...
    - layer8 3y ago
      This one probably: https://news.ycombinator.com/item?id=37408776 https://news.ycombinator.com/item?id=37408776
- tgv 3y ago
  I don't understand either how it got to keep such a low profile. Not long before this came out, there was an "incident" where everyone could alter specific Bing search results (and probably other services too), and as a consequence gain access to all data the browser shares with bing, and that includes the access keys to all the MS accounts of the user that happens to use Bing for that specific search. Impact unknown, because they didn't divulge that. Why? Your guess is as good as mine.
tpool 3y ago
If the lesson the author is ultimately trying to convey is "You can't trust cloud infrastructure providers to protect your data, especially Microsoft." My answer is, "Okay. What can a company do when there is no choice?" The number of enterprise-grade applications that are cloud-only offerings is only increasing. Regardless of whether or not my company actually wants to to own the risk of storing its data in a third party, the day is coming where they have to choose to accept the risk that comes with storing data in the cloud, or re-inventing someone else's wheel at great development and operational cost.
- inetknght 3y ago
  > Okay. What can a company do when there is no choice? The company can recognize that "there is no choice" is not a valid option. There are many choices if the company actually cared to invest into choices. That requires learning and actually vetting your vendors though. That's hard work. Good luck getting people to do hard work.
  - tpool 3y ago
    I've been through multiple vendor vetting processes at my company, and there has always been a line drawn at whether or not the company's data is stored with the vendor in the cloud. My company is very cloud averse due to the nature of the business, and the kind of data they store. The vendor products that make that cut are usually not the best, and if they have a cloud offering, it's almost always superior to their on-premise offering. Every time I go through this process, it shifts even further in the direction of more + better cloud offerings, and fewer on-premise offerings.
- squarefoot 3y ago
  > "Okay. What can a company do when there is no choice?" The number of enterprise-grade applications that are cloud-only offerings is only increasing. I'd be curious to know what kind of problems could be only solved through a cloud-only solution. It's a honest question; I'm not old enough to remember actually using mainframes but in my days companies had their own IT staff, gear and storage. I understand that hiring a IT team of 3 could not be viable for a small 10 people startup, but I'm sure there are solutions in between before being forced to entirely surrender everything to someone else's data center.
jwestbury 3y ago
When I worked at Microsoft, I found a case internally where it appeared that a service was accepting expired certificates as a form of authentication for admin-level calls. I was fairly new, so I brought it to someone who had been at Microsoft for the better part of a decade. We didn't own the service in question, and he told me that, since it wasn't our service, I should just focus on continuing our work, and that it wasn't our responsibility to raise the security concern. In the end, it turns out it was not accepting expired certs -- there was another auth method superseding the certs -- but the behaviour I saw in this case was not unusual to encounter. Microsoft has many excellent engineers, even in security. But decades of culture rot take longer than a few years to fix, and a lot of old-timer Microsofties have this "not my problem" viewpoint that can lead to major security risks. No doubt, the way Microsoft has handled this year's layoffs -- staggered, leaving people in the lurch and in serious stress for months on end -- has wiped out much of the progress they've made under Satya. tl;dr I'm not surprised by (a) Microsoft having breaches and (b) Microsoft not dealing with security issues in a timely manner.
- BirAdam 3y ago
  Fascinating insight. This is not dissimilar from other megacorporations that become too bureaucratized over their lifetimes. When growing quickly, bureaucracy helps to organize people and hold a team accountable for their own mistakes. As time moves on, these different teams begin to act as independent entities who no longer successfully communicate or collaborate and the entire business becomes both fragile and ossified, hence that “not my problem” attitude.
- gmerc 3y ago
  Facebook had the same. First it was “nothing at facebook is somebody else’s problem”, but eventually it became “everything at Meta is somebody else’s problem”
- chrjxnandns 3y ago
  Why didn’t you go to ReportItNow like our training has been telling people to do for years?
- kevingadd 3y ago
mindaslab 3y ago
Microsoft, Apple, Oracle, Google are commercial companies, they want money and don't care about the people who use their software. If you want true freedom and honesty, use free software https://fsf.org https://fsf.org
bastard_op 3y ago
He's absolutely right, you really can't trust anything they sign anymore. This is why Microsoft has been so defensive about their stance since it occurred. I've said the same since the news got out, but all my Microsoft-y friends I told didn't care. In fact, they all shrugged it off like "what are ya gonna do?" That's exactly the problem - what ARE companies going to do? Migrate OFF windoze? Migrate out of Azure? To Linux? Certainly not, Microsoft-y admin only know Microsoft, they usually can't do much else, it's all they know. They certainly won't bite the hand the feeds them. That means the organizations are stuck, which is exactly what Microsoft wanted all those years ago with a monopoly, and got it. Customers too stuck in their own ways to do anything but be a slave to Microsoft and their constant insecurity deserve what they get sadly.
- formerly_proven 3y ago
  And just recently Sharepoint was found to accept alg: null JWT tokens (ie. complete authentication bypass)
  - ipython 3y ago
    Do you have a link to a cve or vuln report? I’d like to read more
    - formerly_proven 3y ago
      https://starlabs.sg/blog/2023/09-sharepoint-pre-auth-rce-chain/ https://starlabs.sg/blog/2023/09-sharepoint-pre-auth-rce-cha...
  - formerly_proven 3y ago
    You also have things like mimikatz - which is only a thing because Windows just stores user's passwords in plaintext in lsass memory -, pathetically weak hashes, pass the hash etc. Catastrophically-bad-by-design authentication is a Microsoft staple.
- chiefalchemist 3y ago
  > That's exactly the problem - what ARE companies going to do? Migrate OFF windoze? Migrate out of Azure? To Linux? The short answer is...yes. Of course it isn't easy. Of course it would take time. But it's certainly not impossible. It's certainly been done. I'm not defending MS but the idea that they're some sort of siren and companies can't help themeselves...well, please get me a list of those companies so we short the shocks if they're that incompetent.
tomrod 3y ago
https://karl-voit.at/cloud/ https://karl-voit.at/cloud/
SCSIfloppy 3y ago
[dead]
swader999 3y ago
So should we all go short MSFT? How would this not take them down? Only way I can think it wouldn't is if its a responsible state actor.
courseofaction 3y ago
Unrelated, but this afternoon Microsoft decided I couldn’t use my laptop for 10 minutes for mandatory updates, which was a serious problem. And now the search feature doesn’t work anymore. If it wasn’t for the game support being important for work I’d happily leave and avoid every aspect of their ecosystem. What other reasons do people have for sticking with Microsoft apart from software compatibility?
- layer8 3y ago
  Many people prefer the traditional Windows UX over the Apple and Linux offerings. I’m saying “traditional” because Microsoft has been trying hard at sabotaging it since Windows 8. Regarding mandatory updates, try Reboot Blocker.
garganzol 3y ago
Maybe this explains why Defender (Microsoft's AV) became so overly aggressive during previous few months. They had a problem and acted in a semi-panic mode forcing Defender to mark nearly everything as a "virus" when its Cloud Protection mode was turned on.
- kstrauser 3y ago
  Uh, are you certain of that? When security alarms start going off, “darn, they broke the detector!” isn’t the only explanation.
  - garganzol 3y ago
    I'm certain as I'm in the field. Another plausible explanation is a wider rollout of a ML-based tech which is not very discrete in its detections.
jmclnx 3y ago
I wonder how this impacts Secure Boot since AFAIK, most people and I think some distros pay Microsoft to get a cert. Me, I have never used it and hope I never will have to use it. Luckily on the hardware I have, it can be fully disabled.
dagoodboy 3y ago
I wonder how this article about Cloudflare powering Microsoft Edge Secure Network fits in with this story. https://blog.cloudflare.com/cloudflare-now-powering-microsoft-edge-secure-network/ https://blog.cloudflare.com/cloudflare-now-powering-microsof...
epups 3y ago
The writeup by Microsoft is far more illustrative than the frankly confusing post and blog from the main article: https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/ https://www.microsoft.com/en-us/security/blog/2023/07/14/ana... Also, unlike what (I think) is being claimed here, Microsoft did fix the issue after learning about it: https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/ https://msrc.microsoft.com/blog/2023/09/results-of-major-tec...
- tgv 3y ago
  A lot later. The damage was done. Whoever had those keys could have had access to all MS accounts and services. And those people had already hacked an engineer's account. Because the chances of stumbling upon this key when only hacking one engineering account are very low, it's reasonable to assume many MS engineering accounts had already been hacked. Basically, your MS account is not safe.
  - mjburgess 3y ago
    > many MS engineering accounts had already been hacked This isnt being focused on enough here. MS is set up in such a way that there are individual members of staff, with individual devices, that just need to be compromised for all their infrastructure is compromised. This fact alone means that's its near certainly presently compromised. states have the resources to place an engineer at MS, let alone compromise one of their devices. This, critically, is not necessary. There is nothing technologically necessary about one person, or one device, having the keys to the kingdom. It's security malpractice.
    - epups 3y ago
      Microsoft knows which accounts were targeted by the attacker. They say so in the first link: "Our telemetry and investigations indicate that post-compromise activity was limited to email access and exfiltration for targeted users." Therefore, no, it is hyperbole that this attack means any and all MS data is compromised. The key that was compromised from one MS engineer was used in conjunction with a specific bug - crash dumps were including secret keys, accessible on a debug environment -, this is not how the system is intended to work at all and they implemented measures to fix it. So this is another hyperbole from the original post.
dangus 3y ago
I think this is a pretty big leap to conclusions. Some guy on Mastdon doesn’t know what Microsoft’s security team knows about the breach. It’s irresponsible to make broad claims like this, that everything in Microsoft’s cloud has to be replaced to mitigate the breach. That doesn’t pass the sniff test. I get that Microsoft has a vested interest in mitigating the PR aspect of it, but I doubt they’ve just done nothing to correct the issue.
- mjburgess 3y ago
  if you follow all the links you'll find out that the keys stolen gave the hackers (probably the Chinese state) access to all managed MS applications for all customers; and enabled faking having an organizational account for arbitrary MS customers. This essentially makes all key western companies and public orgs, hosted on azure, probable targets. It's highly unlikely that they only stole state dept. emails, when they had access to banks, finical orgs, etc. Indeed, their very ability to steal emails from the US state dept! makes it likely a breach at other less protected vital biz/orgs occured. The whole of the azure cloud, and esp. the whole of managed MS apps at major institutions was compromised for at least a year. This is apocalyptic.
- aktuel 3y ago
  Everyone on HN should know that this is not just one guy on Mastodon. https://arstechnica.com/security/2023/08/microsoft-cloud-security-blasted-for-its-culture-of-toxic-obfuscation/ https://arstechnica.com/security/2023/08/microsoft-cloud-sec...
emodendroket 3y ago
Is there a news source detailing the incident this guy is referring to? Wasn’t clear from the linked blog post.
dimal 3y ago
From Microsoft’s blog post on the incident (Mitigation and Hardening section): - On June 26, OWA stopped accepting tokens issued from GetAccessTokensForResource for renewal, which mitigated the token renewal being abused. - On June 27, Microsoft blocked the usage of tokens signed with the acquired MSA key in OWA preventing further threat actor enterprise mail activity. - On June 29, Microsoft completed replacement of the key to prevent the threat actor from using it to forge tokens. Microsoft revoked all MSA signing which were valid at the time of the incident, including the actor-acquired MSA key. The new MSA signing keys are issued in substantially updated systems which benefit from hardening not present at issuance of the actor-acquired MSA key: - Microsoft has increased the isolation of these systems from corporate environments, applications, and users.Microsoft has refined monitoring of all systems related to key activity, and increased automated alerting related to this monitoring. - Microsoft has moved the MSA signing keys to the key store used for our enterprise systems. - On July 3, Microsoft blocked usage of the key for all impacted consumer customers to prevent use of previously-issued tokens. I’m not a security expert. What are the holes in this strategy?
- nerdbert 3y ago
  One big problem is that there's no way of knowing what other holes/backdoors were introduced during the period when the attacker had all those credentials. Maybe they are immediately able to get the new key.
  - jl6 3y ago
    Let's hope someone has spent the last 3 months reinstalling Azure from the original CD.
    - garganzol 3y ago
      "MSN Limited Edition Gold CD" is actually a thing.
    - juancampa 3y ago
      FCKGW-RHQQ2-YXRKT-8TG6W-2B7Q8
aquova 3y ago
Off-topic, but I was surprised to see that this was a Mastodon server created specifically for the people of Graz, Austria, a city I lived in for a semester in college and have very fond memories of. I like the idea of providing self-hosted services for their local region, and I wish them well. I'd consider joining myself if I wasn't so ashamed of my poor German skills...
jl6 3y ago
> Security experts like Mike Kuketz think that most probably we need to consider all Microsoft systems that are using their cloud authentication including all Windows hosts are compromised. This is a giant claim. It does seem theoretically possible that a stolen signing key could have been used as part of a bigger attack to access critical services like Windows Update or the Azure control plane, but it does feel like someone would have noticed that kind of systemic compromise.
- gtech1 3y ago
  And someone would have noticed illicit activity using a stolen key for 2 years...oh wait
insanitybit 3y ago
Such hyperbole. This was a bad breach, for sure, and we may not fully understand its scope at this point. But... > They were able to implant #backdoors, self-made keys, ... all over the place. I mean, emphasis on able to, as in "in theory, based on what I know, it is POSSIBLE", not that they did. > If you didn't understand until now: basically EVERYTHING at Microsoft got hacked and Microsoft can't (or won't) get rid of the intruders. Everything authenticated by Microsoft is tainted. Even #Windows auth. Microsoft's response also seems to clearly state that they have rotated the keys, moved them to a more secure storage, etc. They don't say they've removed the attackers, I guess, but they certainly don't indicate that the attack is ongoing. Certainly they don't indicate that all auth is forever broken. I feel like the conclusions being drawn are extreme. https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/ https://msrc.microsoft.com/blog/2023/09/results-of-major-tec...
- bilekas 3y ago
  > This was a bad breach, for sure, and we may not fully understand its scope at this point > I mean, emphasis on able to, as in "in theory, based on what I know, it is POSSIBLE", not that they did. When you consider the potential implications, and possible scenarios, from a security perspective you have to assume that they're not just "possible" but a reality. If you find a zero day exploit, you don't just ignore patching it because "well nobody else probably has it".
  - jerska 3y ago
    Of course you patch it, but you don’t assume that every system affected by this 0-day got exploited. You try to check if some were and it’s obvious that people at Microsoft are doing exactly that. Not saying that MS’s response was great, but I agree with GP that the whole thing is hyberbolic.
    - bogwog 3y ago
      > Of course you patch it, but you don’t assume that every system affected by this 0-day got exploited. Uhh, what? Of course you do. Why give the benefit of the doubt to hackers who hacked you with malicious intentions? That's the type of security nonsense that I'd expect from... Well, Microsoft lol
nilslindemann 3y ago
Is this the reason why GitHub asked me two days ago to enable 2fa Authentication? https://stackoverflow.com/questions/77186232/how-to-use-github-two-factor-authentication-using-qr-codes-when-on-linux-witho https://stackoverflow.com/questions/77186232/how-to-use-gith...
- quickthrower2 3y ago
  They have been asking this for longer than 2 days. I think I got pestered a couple of weeks ago.
deleted 3y ago
[deleted]
darepublic 3y ago
I just remember the Microsoft 2fa flow was very janky. And that there would be a pointless prompt that would popup everytime replete with a don't ask again checkbox. However none of the options actually did anything it was a pointless thing you had to click through every time. That corporate pastel coloured jank. That inattention to small details to help out the user. Classic MS
standapart 3y ago
So here's a little brain teaser about what you have to do when dealing with potential nation-state actors. This scenario is for the folks who are calling "hyperbole" when the actor is clearly, potentially a nation-state. This scenario is based upon an event that actually occurred. 1. You have a $200 million piece of defense-critical equipment. 2. You know that there was a 5-minute period where a potential member of a foreign intelligence service was alone and unattended in the same room as this piece of equipment. What do you do with the equipment? You can: a) Put the equipment into service b) Disassemble the equipment on both a hardware and software level and try to detect if anything was altered c) Destroy the equipment If you choose anything other than c) you have probably never been, nor should you ever be, in charge of securing critical assets that can be targeted by a nation-state. This incident seems to indicate that the leadership at Microsoft would choose a). Also, bear in mind that these are the people that you just sent all your ChatGPT data to.
- insanitybit 3y ago
  Hi, person here who said that this is hyperbole. I said that because it states unfounded things in an extremely confusing way that implies that they are facts. No question, this was a very bad breach and I hope to learn more about it as the investigation continues. Anyways, I've worked at companies that are absolutely targeted by nation states.
  - remram 3y ago
    We are not talking about a vulnerability in Azure's system here, we are talking about a vulnerability that was exploited. The worst has happened, somebody got in and grabbed that key. The idea that an attacker went to this length to get the key and then did nothing with it is absurd.
    - insanitybit 3y ago
      No one is saying they did nothing with it. In fact, we know at least that they accessed a ton of emails of Gov't employees.
rakkhi 3y ago
Wrote about this a few weeks ago https://rakkhi.substack.com/p/microsoft-hack-zero-trust-architecture https://rakkhi.substack.com/p/microsoft-hack-zero-trust-arch...
urlwolf 3y ago
If you are running a consumer MS desktop of win 11 (which forces you to be logged in to their cloud), are you compromised? If so, what's the best way to act from this point on?
amai 3y ago
Going through this article of the author https://karl-voit.at/cloud/ https://karl-voit.at/cloud/ it seems to me that it is mainly Azure that has security issues. Google and especially AWS have no comparable incidents. If security would be important for the cloud market one would see now a movement away from Azure. But Microsofts office monopoly keeps everyone in the Azure cloud. The cloud market is broken and only huge antitrust cases against the cloud providers could fix that. But our government officials are all cowards nowadays.
- deepsun 3y ago
  Not so much Office monopoly, as Active Directory monopoly.

772 points by ColinWright 3y ago

I read a good analogy recently: The titanic (cloud) is sinking, the engine room is already full of water, but the people in the ballroom (execs) are still celebrating with champagne, even though the warnings have been called multiple times.

catchnear4321 3y ago
drown in champagne or drown in filthy sea water? for some, this sounds like a nonsensical choice. for others, a defining moment of leadership.
- cf141q5325 3y ago
  https://nationalpost.com/news/canada/charles-joughin-titanic-anniversary-april-15-drunk https://nationalpost.com/news/canada/charles-joughin-titanic... >How a baker survived the Titanic sinking by getting really drunk Bottoms up!
  - catchnear4321 3y ago
    just coming back a few later to say thanks, you tha real mvp.
dudeinjapan 3y ago
This is the cloud so you can’t call it the Titanic—-its the Hindenburg.
ChatGTP 3y ago
I read this recently, I found it chillingly similar to our current situation, a truly great read: The Machine Stops by E.M Foster https://web.cs.ucdavis.edu/~rogaway/classes/188/materials/the%20machine%20stops.pdf https://web.cs.ucdavis.edu/~rogaway/classes/188/materials/th...
- CatWChainsaw 3y ago
  It's pretty impressive that the most accurate depiction of how the future will play out was written before even computers were a thing. Perhaps also a bit sad in what that says about us.
swexbe 3y ago
This is clearly an overreaction. Cloud will be fine.
- doublerabbit 3y ago
  He defeats Sephiroth at the end of the game. Maybe he'll defeat Microsoft too.
  - reuben364 3y ago
    Typical JRPG. Start with saving a cat, end with fighting Microsoft.
hnlmorg 3y ago
How is that a good analogy when the cloud computing sector has been growing year on year? There's literally no evidence to support that analogy. It's not even remotely accurate. I'm not saying cloud computing is the solution to every problem, and nor should it be, but calling it a sinking ship is simply absurd. Frankly, I grow so tired of people thinking everything is a boolean choice. The real problem with the cloud is people who see things as binary statements: "cloud is cheaper", "cloud is more expensive", "self hosting is easier", "cloud is easier", "cloud is more secure", "on-prem is more secure", etc. All of those statements are true just as all of those statements are false. The reality is far more nuanced and it depends entirely on the constraints of your business at that point in time. Such as what engineers / skill sets do you have on your team? Capital to buy hardware, your physical location, the product you're trying to build... etc. But the problem with nuanced arguments is they're subjective to the immediate problem you're trying to solve. So you cannot debate them with other people as those other people are trying to solve different problems with different teams and different tools. And thus we end up with people posting bullshit blanket statements like "the cloud is a sinking ship" or the linked article that boasts that the cloud is less secure.
- imchillyb 3y ago
  Security researchers agree with OP and disagree vehemently with your assessment. Cloud is centralizing. Centralizing, instead of distributing, is bad. Centralization broadens and expands the attack surface and creates a honey pot for attackers. This isn’t hyperbole nor is it alarmist. This is reality playing out before us in real time.
  - epups 3y ago
    "Security researchers agree" is a very broad statement. I don't believe there is a consensus at all. Fragmentation creates different problems than centralization, but it isn't a magical bullet either. Depending on your resources, you are far, far better off trusting even Microsoft than trying to come up with your own security implementation.
    - 3y ago
cf141q5325 3y ago
Arguably much of this is caused by governments getting into the zeroday market / blackhat position removing the incentives to fix stuff. IT security got degraded so far that it starts effecting the economy. There was a reason initial cryptocontrol had exceptions for businesses. Bloated security theater being profitable also doesnt help. One example is smartphones as TAN generators for online banking replacing TAN lists. While you can now charge customers per SMS, the second factor got quite a bit more easy to attack.
- tomrod 3y ago
  > Arguably much of this is caused by governments getting into the zeroday market / blackhat position removing the incentives to fix stuff. I don't see the argument here. CISA posts issues they find, are they intended to be comprehensive?
  - cf141q5325 3y ago
    Unfortunately i dont see yours either. We have governments arguing against stronger encryption due to fears of going dark. Which means against having secure systems. This is in addition to a lot of government agencies sitting on, and investing into the knowledge about vulnerabilities. Some of the more public ones getting fixed doesnt change the overall vulnerability of the system. There is a clear incentive mismatch. One cant pretend that those vulnerabilities are "safe" due to only spooks knowing of them. If you can find them, so can others. Especially if you are actively exploiting them. I would argue that this shows both an unwillingness to accept improvements in security as well as actively degrading the current state. And this is before talking about governments actively adding vulnerabilities, which now even possible by law in some jurisdictions.

MaKey 3y ago

Give it a few years and then on-prem hardware and simple server hosting will become fashionable again.

ahoka 3y ago
On-prem is very expensive compared to cloud.
- AlexandrB 3y ago
  It's actually often cheaper[1], assuming you need a relatively fixed amount of compute and have the capital for upfront costs. Cloud gives you a lot of flexibility, but at a premium, and trades CAPEX for OPEX which is very appealing if you're a startup and don't know if you'll be around in a year. [1] https://www.researchgate.net/figure/Yearly-cost-difference-of-Cloud-versus-On-Premise_tbl2_327957126 https://www.researchgate.net/figure/Yearly-cost-difference-o...
- doublerabbit 3y ago
  For upfront costs, it can be. But when your running its pretty smooth sailing. Or is this the discussion of having a team of SysOps vs a team of Cloud Engineers?
  - ahoka 3y ago
    Most software vendors switched to subscription model, so that’s not obvious anymore. Yeah and as you mention, good luck getting experts for all of your software and hardware components unless you are a big tech company.
- shadowgovt 3y ago
  And not guaranteed to solve problems like this. Because at the end of the day, the maintenance of a cloud infrastructure is irreducible complexity so you replace having a breach because a centralized controlling authority made a mistake with having a breach because your own hired staff made a mistake and you got infiltrated by either a lucky drive by or a persistent attacker against your organization.

deleted 3y ago

[deleted]

mrjin 3y ago

People fled from mainframes, now they are flocking to cloud...

orionblastar 3y ago
People fled from mainframes to client server. Running a Windows Server with BackOffice in their IT department and having Windows clients. Now they are flocking to the cloud. I remember when the Network Computer was going to put Microsoft out of business. It was Sun providing the NC and JavaOS, Netscape providing the Web Browser and anyone who wanted to license the NC to make their own. Internet was too slow then as everything was stored on the Internet, which because the Cloud model. Microsoft bundled IE with Windows to destroy Netscape and made Dotnet destroy Java. This is embarrassing for Microsoft. All their cloud services have been hacked. Data has been leaked. Could lead to lawsuits.
BirAdam 3y ago
Plus ça change, plus c’est la même chose.

candiddevmike 3y ago

This seems overly hyperbolic and alarmist. I do not think the sources prove the scope of breach the post asserts ("all of Microsoft"), seems more like a temporary key leak that was subsequently revoked.

tommis 3y ago
[flagged]
- freitzkriesler2 3y ago
  Surprised I don't see M$FT. It's like slashdot in the early 2000s. Edit: -4 downd00ts! Haha must have triggered a few oldies who never let go of their hate.
  - tmpX7dMeXU 3y ago
    M$
    - ddtaylor 3y ago
      Winblows
      - henriquez 3y ago
        [flagged]
  - AtlasBarfed 3y ago
    Why do you think people hated Microsoft? Let's see if you know actually know anything about their deep and wide business sociopathy. One of the big reasons that monopolies are really bad is that they are also inevitably incompetent. The fact those two things go hand in hand makes the inherent corruption of monopoly / cartels doubly damaging. ....almost all markets are cartels at a minimum these days

bionhoward 3y ago

We all ought to be using Qubes OS! We, as the Hacker News community, ought to be more concerned about making it easier to use reasonably secure systems. How do I buy a computer that runs Qubes? https://www.qubes-os.org/ https://www.qubes-os.org/ https://www.qubes-os.org/doc/system-requirements/ https://www.qubes-os.org/doc/system-requirements/

nextlevelwizard 3y ago
why?
buro9 3y ago
As someone who runs Qubes on one of my laptops (the travel one) I can assure you that your long battery life days are over.
- lsllc 3y ago
  Yes, the shortened battery life is quite noticeable.
nolist_policy 3y ago
Or get a Chromebook. Say what you want about Google but its one of the few who really care about security.
hiatus 3y ago
How would Qubes help here? Separately, Qubes runs fine on a framework laptop.

throwawysn38 3y ago

Microsoft should have done a clean room implementation of their cloud and used that to pivot their customers into more manageable technology for both parties. That they've chosen to integrate it with all their legacy stack (which is one of the most complicated ones in existence) is understandable and what 99% of companies would have done but... it's a horrible experience using it. Maybe people with only Microsoft experience don't feel the pain anymore.

BirAdam 3y ago
Your viewpoint isn’t without merit. I think it’s just a cost/benefit analysis issue though. Each platform has its own warts. For Microsoft, they built much of their business on backward compatibility, so breaking with that would be tough. As concerns the cloud, MS does partner with Canonical quite a bit, so it isn’t as if they are dogmatic in their tech stack. This issue seems more of a company one and not a technical one.
Muromec 3y ago
Having backwards compatibility is their defining feature and selling point, so no way ant of that will happen

ggeorgovassilis 3y ago

This story has been widely under-reported and the impact is potentially huge. My beef with MS is this: the keys were leaked in 2021 and were still signing authentication tokens in 2023, but there's not a single Azure service that allows me to enter credentials with a 2 years duration. It's a classic case of "do as I say, not as I do".

ahoka 3y ago
This. They don’t even use a HSM if I understood correctly and using one is not part of the mitigation plan. Not OK.
- lazide 3y ago
  HSM’s are super inconvenient obviously, and as Mr. Robot showed not perfect. So why bother? /s
  - jnsaff2 3y ago
    Apparently they might also be backdoored by the NSA: https://news.ycombinator.com/item?id=37571014 https://news.ycombinator.com/item?id=37571014
    - lazide 3y ago
      Still probably better than having the private key part of a random core dump from a random developer. :s That’s just embarrassing.
      - jnsaff2 3y ago
        No doubt. My expectations to MS engineering are really low so I'm unfortunately not shocked.
    - grotorea 3y ago
      Frankly is this important? If the NSA is a threat to you do you have any business trusting MS?

victor106 3y ago

This issue is specific to Azure and Microsoft. I find AWS and GCP to be fine. Microsoft has some of the worst security vulnerabilities and practices I have ever seen. I can’t for the life of me figure out how executives at big Fortune 500 move their workloads to Azure. The only selling point Microsoft has for Azure in some domains is that Amazon is their competitor. I wish Amazon just let AWS be it’s own thing. I also hope that Microsoft step up their security game but at this point it’s kind of a lost cause.

orionblastar 3y ago
I used to work as a federal contractor for the US Military in 1996-1997 and they replaced their Windows Web Servers with Macintosh ones because the Mac had better security. I used to run a Windows 2000 Pro web server, after lack of security I switched to Linux. Microsoft may be popular, but they have big holes in their security. Always has been.
- barrkel 3y ago
  They replaced Windows NT with Classic Mac OS?
  - orionblastar 3y ago
    Yes. https://news.slashdot.org/story/99/09/10/1034202/army-dumps-nt-as-web-server-moves-to-mac https://news.slashdot.org/story/99/09/10/1034202/army-dumps-...
  - e12e 3y ago
    Isn't that like moving from Windows NT to windows 95 for hosting your web server?
  - ok123456 3y ago
    Harder to execute a useful payload in a cooperative multitasking environment.
  - tzs 3y ago

0xPIT 3y ago

While the post is great, terrifying, and seems to contain only true and verifiable information, I’m not sure what we expect. „Normal“ people will not read this, nor be able to understand, nor gauge or grasp the impact. It’s become way to complex. We can’t simply stop using mentioned services anymore as a society. Wouldn’t it be more reasonable to teach: 1. You have no privacy, it is impossible to ensure or guarantee privacy, and there’s no incentive at all for anyone to ensure privacy. (Scott McNeally of Sun said that already in the late 1990s) 2. There is no security and every kind of security has been, was designed to, or will be compromised. 3. All your digital information is already public or will become public at some point. (btw: Every top-tier consultancy operates under that assumption)

cf141q5325 3y ago
I think a new approach to privacy is likely around the corner. Why have one conversation with somebody when you can have as many as you want all at once? There were already addons like that that created garbage traffic a while ago. Just wasnt practical without language networks.
loup-vaillant 3y ago
Those 3 points are only teaching despair. The more useful thing to teach is who we can blame, and how to reclaim actual privacy and security… even if it means using the dreaded regulation hammer.
- lazide 3y ago
  None of which will change those three points practically. For any bit of information, they may not apply, but if you assume they’re true you’ll: 1) not record information that is truly damaging in a damaging way (which is really good practice in general if you’ve got something to lose!) 2) have practical operational practices which do not rely on these being false - which is a really good idea if that actually matters (you have actual enemies somewhere). 3) you’ll focus on safety and building value in areas which are not mere information at rest, which is a good modern practice. Osama Bin Laden already knew all this, which is why it took so long to find him. A decade or so. I guarantee you the CIA has been learning this with all their leaks. The FBI learned this this after COINTELPRO. What is not written down can’t show up as a grainy photocopy in the New York Times, or a viral video from Wikileaks, or whatever. What you’re talking about is a hammer to use to punish someone after a leak. But by then it’s far too late for anything actually valuable. Necessary and important for ‘day to day’ stuff like bank account balances I guess, as long as you assume that they’ll be violated with little practical recourse if you have anything actually valuable in it. Streisand effect, etc.

bilekas 3y ago

This is actually wild.. I'm only reading about this properly now thanks to this article but how did this fly under the radar? The company i work for just recently integrated all of our internal apps and services authentication through azure .. That feels like it was a mistake now.. or am I just over paranoid??

Muromec 3y ago
The postmortem about this was here on the front page few weeks ago. No conspiracy needed, just normal big tech malpractice
- e12e 3y ago
  Do you have a link? There's been a lot of stories about Microsoft, Azure and security...
  - layer8 3y ago
    This one probably: https://news.ycombinator.com/item?id=37408776 https://news.ycombinator.com/item?id=37408776
tgv 3y ago
I don't understand either how it got to keep such a low profile. Not long before this came out, there was an "incident" where everyone could alter specific Bing search results (and probably other services too), and as a consequence gain access to all data the browser shares with bing, and that includes the access keys to all the MS accounts of the user that happens to use Bing for that specific search. Impact unknown, because they didn't divulge that. Why? Your guess is as good as mine.

tpool 3y ago

If the lesson the author is ultimately trying to convey is "You can't trust cloud infrastructure providers to protect your data, especially Microsoft." My answer is, "Okay. What can a company do when there is no choice?" The number of enterprise-grade applications that are cloud-only offerings is only increasing. Regardless of whether or not my company actually wants to to own the risk of storing its data in a third party, the day is coming where they have to choose to accept the risk that comes with storing data in the cloud, or re-inventing someone else's wheel at great development and operational cost.

inetknght 3y ago
> Okay. What can a company do when there is no choice? The company can recognize that "there is no choice" is not a valid option. There are many choices if the company actually cared to invest into choices. That requires learning and actually vetting your vendors though. That's hard work. Good luck getting people to do hard work.
- tpool 3y ago
  I've been through multiple vendor vetting processes at my company, and there has always been a line drawn at whether or not the company's data is stored with the vendor in the cloud. My company is very cloud averse due to the nature of the business, and the kind of data they store. The vendor products that make that cut are usually not the best, and if they have a cloud offering, it's almost always superior to their on-premise offering. Every time I go through this process, it shifts even further in the direction of more + better cloud offerings, and fewer on-premise offerings.
squarefoot 3y ago
> "Okay. What can a company do when there is no choice?" The number of enterprise-grade applications that are cloud-only offerings is only increasing. I'd be curious to know what kind of problems could be only solved through a cloud-only solution. It's a honest question; I'm not old enough to remember actually using mainframes but in my days companies had their own IT staff, gear and storage. I understand that hiring a IT team of 3 could not be viable for a small 10 people startup, but I'm sure there are solutions in between before being forced to entirely surrender everything to someone else's data center.

jwestbury 3y ago

When I worked at Microsoft, I found a case internally where it appeared that a service was accepting expired certificates as a form of authentication for admin-level calls. I was fairly new, so I brought it to someone who had been at Microsoft for the better part of a decade. We didn't own the service in question, and he told me that, since it wasn't our service, I should just focus on continuing our work, and that it wasn't our responsibility to raise the security concern. In the end, it turns out it was not accepting expired certs -- there was another auth method superseding the certs -- but the behaviour I saw in this case was not unusual to encounter. Microsoft has many excellent engineers, even in security. But decades of culture rot take longer than a few years to fix, and a lot of old-timer Microsofties have this "not my problem" viewpoint that can lead to major security risks. No doubt, the way Microsoft has handled this year's layoffs -- staggered, leaving people in the lurch and in serious stress for months on end -- has wiped out much of the progress they've made under Satya. tl;dr I'm not surprised by (a) Microsoft having breaches and (b) Microsoft not dealing with security issues in a timely manner.

BirAdam 3y ago
Fascinating insight. This is not dissimilar from other megacorporations that become too bureaucratized over their lifetimes. When growing quickly, bureaucracy helps to organize people and hold a team accountable for their own mistakes. As time moves on, these different teams begin to act as independent entities who no longer successfully communicate or collaborate and the entire business becomes both fragile and ossified, hence that “not my problem” attitude.
gmerc 3y ago
Facebook had the same. First it was “nothing at facebook is somebody else’s problem”, but eventually it became “everything at Meta is somebody else’s problem”
chrjxnandns 3y ago
Why didn’t you go to ReportItNow like our training has been telling people to do for years?
kevingadd 3y ago

mindaslab 3y ago

Microsoft, Apple, Oracle, Google are commercial companies, they want money and don't care about the people who use their software. If you want true freedom and honesty, use free software https://fsf.org https://fsf.org

bastard_op 3y ago

He's absolutely right, you really can't trust anything they sign anymore. This is why Microsoft has been so defensive about their stance since it occurred. I've said the same since the news got out, but all my Microsoft-y friends I told didn't care. In fact, they all shrugged it off like "what are ya gonna do?" That's exactly the problem - what ARE companies going to do? Migrate OFF windoze? Migrate out of Azure? To Linux? Certainly not, Microsoft-y admin only know Microsoft, they usually can't do much else, it's all they know. They certainly won't bite the hand the feeds them. That means the organizations are stuck, which is exactly what Microsoft wanted all those years ago with a monopoly, and got it. Customers too stuck in their own ways to do anything but be a slave to Microsoft and their constant insecurity deserve what they get sadly.

formerly_proven 3y ago
And just recently Sharepoint was found to accept alg: null JWT tokens (ie. complete authentication bypass)
- ipython 3y ago
  Do you have a link to a cve or vuln report? I’d like to read more
  - formerly_proven 3y ago
    https://starlabs.sg/blog/2023/09-sharepoint-pre-auth-rce-chain/ https://starlabs.sg/blog/2023/09-sharepoint-pre-auth-rce-cha...
- formerly_proven 3y ago
  You also have things like mimikatz - which is only a thing because Windows just stores user's passwords in plaintext in lsass memory -, pathetically weak hashes, pass the hash etc. Catastrophically-bad-by-design authentication is a Microsoft staple.
chiefalchemist 3y ago
> That's exactly the problem - what ARE companies going to do? Migrate OFF windoze? Migrate out of Azure? To Linux? The short answer is...yes. Of course it isn't easy. Of course it would take time. But it's certainly not impossible. It's certainly been done. I'm not defending MS but the idea that they're some sort of siren and companies can't help themeselves...well, please get me a list of those companies so we short the shocks if they're that incompetent.

tomrod 3y ago

https://karl-voit.at/cloud/ https://karl-voit.at/cloud/

SCSIfloppy 3y ago

[dead]

swader999 3y ago

So should we all go short MSFT? How would this not take them down? Only way I can think it wouldn't is if its a responsible state actor.

courseofaction 3y ago

Unrelated, but this afternoon Microsoft decided I couldn’t use my laptop for 10 minutes for mandatory updates, which was a serious problem. And now the search feature doesn’t work anymore. If it wasn’t for the game support being important for work I’d happily leave and avoid every aspect of their ecosystem. What other reasons do people have for sticking with Microsoft apart from software compatibility?

layer8 3y ago
Many people prefer the traditional Windows UX over the Apple and Linux offerings. I’m saying “traditional” because Microsoft has been trying hard at sabotaging it since Windows 8. Regarding mandatory updates, try Reboot Blocker.

garganzol 3y ago

Maybe this explains why Defender (Microsoft's AV) became so overly aggressive during previous few months. They had a problem and acted in a semi-panic mode forcing Defender to mark nearly everything as a "virus" when its Cloud Protection mode was turned on.

kstrauser 3y ago
Uh, are you certain of that? When security alarms start going off, “darn, they broke the detector!” isn’t the only explanation.
- garganzol 3y ago
  I'm certain as I'm in the field. Another plausible explanation is a wider rollout of a ML-based tech which is not very discrete in its detections.

jmclnx 3y ago

I wonder how this impacts Secure Boot since AFAIK, most people and I think some distros pay Microsoft to get a cert. Me, I have never used it and hope I never will have to use it. Luckily on the hardware I have, it can be fully disabled.

dagoodboy 3y ago

I wonder how this article about Cloudflare powering Microsoft Edge Secure Network fits in with this story. https://blog.cloudflare.com/cloudflare-now-powering-microsoft-edge-secure-network/ https://blog.cloudflare.com/cloudflare-now-powering-microsof...

epups 3y ago

The writeup by Microsoft is far more illustrative than the frankly confusing post and blog from the main article: https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/ https://www.microsoft.com/en-us/security/blog/2023/07/14/ana... Also, unlike what (I think) is being claimed here, Microsoft did fix the issue after learning about it: https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/ https://msrc.microsoft.com/blog/2023/09/results-of-major-tec...

tgv 3y ago
A lot later. The damage was done. Whoever had those keys could have had access to all MS accounts and services. And those people had already hacked an engineer's account. Because the chances of stumbling upon this key when only hacking one engineering account are very low, it's reasonable to assume many MS engineering accounts had already been hacked. Basically, your MS account is not safe.
- mjburgess 3y ago
  > many MS engineering accounts had already been hacked This isnt being focused on enough here. MS is set up in such a way that there are individual members of staff, with individual devices, that just need to be compromised for all their infrastructure is compromised. This fact alone means that's its near certainly presently compromised. states have the resources to place an engineer at MS, let alone compromise one of their devices. This, critically, is not necessary. There is nothing technologically necessary about one person, or one device, having the keys to the kingdom. It's security malpractice.
  - epups 3y ago
    Microsoft knows which accounts were targeted by the attacker. They say so in the first link: "Our telemetry and investigations indicate that post-compromise activity was limited to email access and exfiltration for targeted users." Therefore, no, it is hyperbole that this attack means any and all MS data is compromised. The key that was compromised from one MS engineer was used in conjunction with a specific bug - crash dumps were including secret keys, accessible on a debug environment -, this is not how the system is intended to work at all and they implemented measures to fix it. So this is another hyperbole from the original post.

dangus 3y ago

I think this is a pretty big leap to conclusions. Some guy on Mastdon doesn’t know what Microsoft’s security team knows about the breach. It’s irresponsible to make broad claims like this, that everything in Microsoft’s cloud has to be replaced to mitigate the breach. That doesn’t pass the sniff test. I get that Microsoft has a vested interest in mitigating the PR aspect of it, but I doubt they’ve just done nothing to correct the issue.

mjburgess 3y ago
if you follow all the links you'll find out that the keys stolen gave the hackers (probably the Chinese state) access to all managed MS applications for all customers; and enabled faking having an organizational account for arbitrary MS customers. This essentially makes all key western companies and public orgs, hosted on azure, probable targets. It's highly unlikely that they only stole state dept. emails, when they had access to banks, finical orgs, etc. Indeed, their very ability to steal emails from the US state dept! makes it likely a breach at other less protected vital biz/orgs occured. The whole of the azure cloud, and esp. the whole of managed MS apps at major institutions was compromised for at least a year. This is apocalyptic.
aktuel 3y ago
Everyone on HN should know that this is not just one guy on Mastodon. https://arstechnica.com/security/2023/08/microsoft-cloud-security-blasted-for-its-culture-of-toxic-obfuscation/ https://arstechnica.com/security/2023/08/microsoft-cloud-sec...

emodendroket 3y ago

Is there a news source detailing the incident this guy is referring to? Wasn’t clear from the linked blog post.

dimal 3y ago

From Microsoft’s blog post on the incident (Mitigation and Hardening section): - On June 26, OWA stopped accepting tokens issued from GetAccessTokensForResource for renewal, which mitigated the token renewal being abused. - On June 27, Microsoft blocked the usage of tokens signed with the acquired MSA key in OWA preventing further threat actor enterprise mail activity. - On June 29, Microsoft completed replacement of the key to prevent the threat actor from using it to forge tokens. Microsoft revoked all MSA signing which were valid at the time of the incident, including the actor-acquired MSA key. The new MSA signing keys are issued in substantially updated systems which benefit from hardening not present at issuance of the actor-acquired MSA key: - Microsoft has increased the isolation of these systems from corporate environments, applications, and users.Microsoft has refined monitoring of all systems related to key activity, and increased automated alerting related to this monitoring. - Microsoft has moved the MSA signing keys to the key store used for our enterprise systems. - On July 3, Microsoft blocked usage of the key for all impacted consumer customers to prevent use of previously-issued tokens. I’m not a security expert. What are the holes in this strategy?

nerdbert 3y ago
One big problem is that there's no way of knowing what other holes/backdoors were introduced during the period when the attacker had all those credentials. Maybe they are immediately able to get the new key.
- jl6 3y ago
  Let's hope someone has spent the last 3 months reinstalling Azure from the original CD.
  - garganzol 3y ago
    "MSN Limited Edition Gold CD" is actually a thing.
  - juancampa 3y ago
    FCKGW-RHQQ2-YXRKT-8TG6W-2B7Q8

aquova 3y ago

Off-topic, but I was surprised to see that this was a Mastodon server created specifically for the people of Graz, Austria, a city I lived in for a semester in college and have very fond memories of. I like the idea of providing self-hosted services for their local region, and I wish them well. I'd consider joining myself if I wasn't so ashamed of my poor German skills...

jl6 3y ago

> Security experts like Mike Kuketz think that most probably we need to consider all Microsoft systems that are using their cloud authentication including all Windows hosts are compromised. This is a giant claim. It does seem theoretically possible that a stolen signing key could have been used as part of a bigger attack to access critical services like Windows Update or the Azure control plane, but it does feel like someone would have noticed that kind of systemic compromise.

gtech1 3y ago
And someone would have noticed illicit activity using a stolen key for 2 years...oh wait

insanitybit 3y ago

Such hyperbole. This was a bad breach, for sure, and we may not fully understand its scope at this point. But... > They were able to implant #backdoors, self-made keys, ... all over the place. I mean, emphasis on able to, as in "in theory, based on what I know, it is POSSIBLE", not that they did. > If you didn't understand until now: basically EVERYTHING at Microsoft got hacked and Microsoft can't (or won't) get rid of the intruders. Everything authenticated by Microsoft is tainted. Even #Windows auth. Microsoft's response also seems to clearly state that they have rotated the keys, moved them to a more secure storage, etc. They don't say they've removed the attackers, I guess, but they certainly don't indicate that the attack is ongoing. Certainly they don't indicate that all auth is forever broken. I feel like the conclusions being drawn are extreme. https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/ https://msrc.microsoft.com/blog/2023/09/results-of-major-tec...

bilekas 3y ago
> This was a bad breach, for sure, and we may not fully understand its scope at this point > I mean, emphasis on able to, as in "in theory, based on what I know, it is POSSIBLE", not that they did. When you consider the potential implications, and possible scenarios, from a security perspective you have to assume that they're not just "possible" but a reality. If you find a zero day exploit, you don't just ignore patching it because "well nobody else probably has it".
- jerska 3y ago
  Of course you patch it, but you don’t assume that every system affected by this 0-day got exploited. You try to check if some were and it’s obvious that people at Microsoft are doing exactly that. Not saying that MS’s response was great, but I agree with GP that the whole thing is hyberbolic.
  - bogwog 3y ago
    > Of course you patch it, but you don’t assume that every system affected by this 0-day got exploited. Uhh, what? Of course you do. Why give the benefit of the doubt to hackers who hacked you with malicious intentions? That's the type of security nonsense that I'd expect from... Well, Microsoft lol

nilslindemann 3y ago

Is this the reason why GitHub asked me two days ago to enable 2fa Authentication? https://stackoverflow.com/questions/77186232/how-to-use-github-two-factor-authentication-using-qr-codes-when-on-linux-witho https://stackoverflow.com/questions/77186232/how-to-use-gith...

quickthrower2 3y ago
They have been asking this for longer than 2 days. I think I got pestered a couple of weeks ago.

deleted 3y ago

[deleted]

darepublic 3y ago

I just remember the Microsoft 2fa flow was very janky. And that there would be a pointless prompt that would popup everytime replete with a don't ask again checkbox. However none of the options actually did anything it was a pointless thing you had to click through every time. That corporate pastel coloured jank. That inattention to small details to help out the user. Classic MS

standapart 3y ago

So here's a little brain teaser about what you have to do when dealing with potential nation-state actors. This scenario is for the folks who are calling "hyperbole" when the actor is clearly, potentially a nation-state. This scenario is based upon an event that actually occurred. 1. You have a $200 million piece of defense-critical equipment. 2. You know that there was a 5-minute period where a potential member of a foreign intelligence service was alone and unattended in the same room as this piece of equipment. What do you do with the equipment? You can: a) Put the equipment into service b) Disassemble the equipment on both a hardware and software level and try to detect if anything was altered c) Destroy the equipment If you choose anything other than c) you have probably never been, nor should you ever be, in charge of securing critical assets that can be targeted by a nation-state. This incident seems to indicate that the leadership at Microsoft would choose a). Also, bear in mind that these are the people that you just sent all your ChatGPT data to.

insanitybit 3y ago
Hi, person here who said that this is hyperbole. I said that because it states unfounded things in an extremely confusing way that implies that they are facts. No question, this was a very bad breach and I hope to learn more about it as the investigation continues. Anyways, I've worked at companies that are absolutely targeted by nation states.
- remram 3y ago
  We are not talking about a vulnerability in Azure's system here, we are talking about a vulnerability that was exploited. The worst has happened, somebody got in and grabbed that key. The idea that an attacker went to this length to get the key and then did nothing with it is absurd.
  - insanitybit 3y ago
    No one is saying they did nothing with it. In fact, we know at least that they accessed a ton of emails of Gov't employees.

rakkhi 3y ago

Wrote about this a few weeks ago https://rakkhi.substack.com/p/microsoft-hack-zero-trust-architecture https://rakkhi.substack.com/p/microsoft-hack-zero-trust-arch...

urlwolf 3y ago

If you are running a consumer MS desktop of win 11 (which forces you to be logged in to their cloud), are you compromised? If so, what's the best way to act from this point on?

amai 3y ago

Going through this article of the author https://karl-voit.at/cloud/ https://karl-voit.at/cloud/ it seems to me that it is mainly Azure that has security issues. Google and especially AWS have no comparable incidents. If security would be important for the cloud market one would see now a movement away from Azure. But Microsofts office monopoly keeps everyone in the Azure cloud. The cloud market is broken and only huge antitrust cases against the cloud providers could fix that. But our government officials are all cowards nowadays.

deepsun 3y ago
Not so much Office monopoly, as Active Directory monopoly.