4 ms·

This seems overly hyperbolic and alarmist. I do not think the sources prove the scope of breach the post asserts ("all of Microsoft"), seems more like a tempor

This seems overly hyperbolic and alarmist. I do not think the sources prove the scope of breach the post asserts ("all of Microsoft"), seems more like a temporary key leak that was subsequently revoked.

tommis 3y ago
[flagged]
- freitzkriesler2 3y ago
  Surprised I don't see M$FT. It's like slashdot in the early 2000s. Edit: -4 downd00ts! Haha must have triggered a few oldies who never let go of their hate.
  - tmpX7dMeXU 3y ago
    M$
    - ddtaylor 3y ago
      Winblows
      - henriquez 3y ago
        [flagged]
  - AtlasBarfed 3y ago
    Why do you think people hated Microsoft? Let's see if you know actually know anything about their deep and wide business sociopathy. One of the big reasons that monopolies are really bad is that they are also inevitably incompetent. The fact those two things go hand in hand makes the inherent corruption of monopoly / cartels doubly damaging. ....almost all markets are cartels at a minimum these days
    - freitzkriesler2 3y ago
      I get that, but the Microsoft of today isn't the Microsoft of the 90s or even 2000s. Now if we want to talk about Google...
  - squarefoot 3y ago
    Don't forget that it was then Microsoft CEO Steve Ballmer who in 2001 compared Linux to cancer. If there is childish vitriol somewhere, it did start neither on HN nor on /.
    - freitzkriesler2 3y ago
      Oh I know, all companies change over time and both Billy and Balmer have zero impact on the day to day operations at Microsoft. The Microsoft today isn't the Microsoft of the 2000s. Now I wish the same thing could be said about Google which is quickly becoming the Microsoft of the 2000s.
      - riddley 3y ago
        You keep saying that they're different, but to my old eyes you're just buying their marketing. They still have horrible security. They are still product dumping. They're still ignoring user preferences and forcing their agenda (eg: Edge) They're worse than ever about user privacy. I could go on. I don't like Google either, but your corporate loyalty is silly. Both can be and are terrible.
        freitzkriesler2 3y ago
        And in my eyes you're just a bitter old boomer stuck in his ways. Security is no worse than what I see with osx. I don't use Linux because I have real work to do. Edge is just chrome with a big blue E. And every company product team ignores its users for monetary gain. You really can't teach an old dog new tricks.
  - chokolad 3y ago
    Top comment has "windoze" mentioned. It is pretty much slashdot from 2000s
- yborg 3y ago
  You should be. HN buried Mastodon as a viable social media platform a year ago.
  - vsareto 3y ago
    Mastodon is often really slow. The krebs link loaded after like two minutes with an error, then a soft refresh finally loaded it. That happens regularly with Mastodon links for me
    - riffic 3y ago
      there isn't a single Mastodon server. It's a web application (like Wordpress which frequently gets hugged to death when linked here).
      - troyvit 3y ago
        Right, so instead of: > HN buried Mastodon as a viable social media platform a year ago. It should be: > HN buries Mastodon as a viable social media platform every time an HN user posts a moderately popular link to Mastadon. I want to love Mastodon but until they figure some stuff out they're never going to be a viable platform to (for instance) explain to all those who need to know how one of the largest cloud providers is deeply compromised.
  - colordrops 3y ago
    How did HN "bury" mastodon?
- blibble 3y ago
  if their keys to the kingdom leaking out and them not realising for 2 years aren't cause to say "Microsoft sux" then what would be?
gwd 3y ago
Probably a better link would have been the one linked to in the post*: https://karl-voit.at/cloud/ https://karl-voit.at/cloud/ Which has these among a long list (retaining the reverse order from link above). NB I have just copied and pasted for convenience; neither removed text which refers to links nor added the actual links. You can click through yourself if you want to follow the links. 8<--- 023-08: Again Microsoft, again Azure: "unauthorized access to cross-tenant applications and sensitive data (including but not limited to authentication secrets)". If you aren't tech-savvy: this is very bad. (Source) A reoccuring pattern emerges more and more: Microsoft didn't fix the issue in months and as of 2023-08-03 it is still an open vulnerability in Azure, risking the data of all Azure customers. related: Microsoft comes under blistering criticism for “grossly irresponsible” security | Ars Technica BrianKrebs: "The CEO of Tenable just ripped Microsoft a new on…" - Infosec Exchange 2023-07: Hackers stole a Microsoft Azure Active Directory certificate which gave them full access to basically all Microsoft cloud services including Outlook, Office, SharePoint, Teams, "Login with Microsoft", and so forth. (MS blog entry, Source, German source) With the default logs, customers could not even detect intruders as you would need to pay extra to get access to those log files. Microsoft did not communicate which services were affected and which not. Any Microsoft cloud service was potentially compromised. Most probably, the usual "any compromised system needs to be thrown away and re-created from scratch will not be applied here. As a consequence, you can't trust any data from Microsoft services any more. Security experts like Mike Kuketz think that most probably we need to consider all Microsoft systems that are using their cloud authentication including all Windows hosts are compromised. According to this German source, Microsoft is still refusing to tell what happened and which systems are affected to what extend. 2023-08-18: German comment: Many similar comments like that underline that Microsoft disqualifies as a trustworthy partner. 2023-09-06: first public explanation by MS: Microsoft: Results of Major Technical Investigations for Storm-0558 Key Acquisition Press reactions: heise (German), fefe (German)
- jameshart 3y ago
  The timeline now includes this significant event: > 2023-09-29: My Mastodon message about the latest news was posted on Hacker News and its discussion reached number one worldwide. The circle is complete.
pritambarhate 3y ago
Found following from the links from the post: 2023-07: Hackers stole a Microsoft Azure Active Directory certificate which gave them full access to basically all Microsoft cloud services including Outlook, Office, SharePoint, Teams, "Login with Microsoft", and so forth. (MS blog entry [1], Source[2], German source) Also the following: https://infosec.exchange/@briankrebs/110820474957163710 https://infosec.exchange/@briankrebs/110820474957163710 Quite damning if true. [1]: https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/ https://www.microsoft.com/en-us/security/blog/2023/07/14/ana... [2]: https://www.wiz.io/blog/storm-0558-compromised-microsoft-key-enables-authentication-of-countless-micr https://www.wiz.io/blog/storm-0558-compromised-microsoft-key...
- _23sd 3y ago
  The issue was specific to services that used Microsoft's .NET libraries for Azure AD authentication without doing additional checks for auth token validity [1], which was not "all of Microsoft". There's no public list of what components are used where AFAIK, we just know that MS says forged auth tokens were successfully used on Exchange Online email. It is sensationalizing to say the entire Azure cloud was hacked. This is not to downplay how bad Microsoft's security lapses were, and how bad their announcements were. The most horrifying part to me, besides the need for "premium" logs to detect a breach which I'd been complaining about before this, was how PR seemed to blame the Exchange Online team for misusing the authentication libraries, but later they updated the libraries and said the token validation issue was "corrected using the updated libraries". That feels like internal blame shifting out in public. [1] https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/#why-a-consumer-key-was-able-to-access-enterprise-mail https://msrc.microsoft.com/blog/2023/09/results-of-major-tec...
thefz 3y ago
Besides, in some services not even MS has control over the data, see KV or MHSM. In the very same link he posts: https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/ https://www.microsoft.com/en-us/security/blog/2023/07/14/ana... "Post-compromise activity Our telemetry and investigations indicate that post-compromise activity was limited to email access and exfiltration for targeted users." So it's not "all Microsoft". It's the usual exaggerated headline, but this time it draws attention on a person's post on Mastodon. This platform is really no different from Twitter.

tommis 3y ago

[flagged]

freitzkriesler2 3y ago
Surprised I don't see M$FT. It's like slashdot in the early 2000s. Edit: -4 downd00ts! Haha must have triggered a few oldies who never let go of their hate.
- tmpX7dMeXU 3y ago
  M$
  - ddtaylor 3y ago
    Winblows
    - henriquez 3y ago
      [flagged]
- AtlasBarfed 3y ago
  Why do you think people hated Microsoft? Let's see if you know actually know anything about their deep and wide business sociopathy. One of the big reasons that monopolies are really bad is that they are also inevitably incompetent. The fact those two things go hand in hand makes the inherent corruption of monopoly / cartels doubly damaging. ....almost all markets are cartels at a minimum these days
  - freitzkriesler2 3y ago
    I get that, but the Microsoft of today isn't the Microsoft of the 90s or even 2000s. Now if we want to talk about Google...
- squarefoot 3y ago
  Don't forget that it was then Microsoft CEO Steve Ballmer who in 2001 compared Linux to cancer. If there is childish vitriol somewhere, it did start neither on HN nor on /.
  - freitzkriesler2 3y ago
    Oh I know, all companies change over time and both Billy and Balmer have zero impact on the day to day operations at Microsoft. The Microsoft today isn't the Microsoft of the 2000s. Now I wish the same thing could be said about Google which is quickly becoming the Microsoft of the 2000s.
    - riddley 3y ago
      You keep saying that they're different, but to my old eyes you're just buying their marketing. They still have horrible security. They are still product dumping. They're still ignoring user preferences and forcing their agenda (eg: Edge) They're worse than ever about user privacy. I could go on. I don't like Google either, but your corporate loyalty is silly. Both can be and are terrible.
      - freitzkriesler2 3y ago
        And in my eyes you're just a bitter old boomer stuck in his ways. Security is no worse than what I see with osx. I don't use Linux because I have real work to do. Edge is just chrome with a big blue E. And every company product team ignores its users for monetary gain. You really can't teach an old dog new tricks.
- chokolad 3y ago
  Top comment has "windoze" mentioned. It is pretty much slashdot from 2000s
yborg 3y ago
You should be. HN buried Mastodon as a viable social media platform a year ago.
- vsareto 3y ago
  Mastodon is often really slow. The krebs link loaded after like two minutes with an error, then a soft refresh finally loaded it. That happens regularly with Mastodon links for me
  - riffic 3y ago
    there isn't a single Mastodon server. It's a web application (like Wordpress which frequently gets hugged to death when linked here).
    - troyvit 3y ago
      Right, so instead of: > HN buried Mastodon as a viable social media platform a year ago. It should be: > HN buries Mastodon as a viable social media platform every time an HN user posts a moderately popular link to Mastadon. I want to love Mastodon but until they figure some stuff out they're never going to be a viable platform to (for instance) explain to all those who need to know how one of the largest cloud providers is deeply compromised.
- colordrops 3y ago
  How did HN "bury" mastodon?
blibble 3y ago
if their keys to the kingdom leaking out and them not realising for 2 years aren't cause to say "Microsoft sux" then what would be?

gwd 3y ago

Probably a better link would have been the one linked to in the post*: https://karl-voit.at/cloud/ https://karl-voit.at/cloud/ Which has these among a long list (retaining the reverse order from link above). NB I have just copied and pasted for convenience; neither removed text which refers to links nor added the actual links. You can click through yourself if you want to follow the links. 8<--- 023-08: Again Microsoft, again Azure: "unauthorized access to cross-tenant applications and sensitive data (including but not limited to authentication secrets)". If you aren't tech-savvy: this is very bad. (Source) A reoccuring pattern emerges more and more: Microsoft didn't fix the issue in months and as of 2023-08-03 it is still an open vulnerability in Azure, risking the data of all Azure customers. related: Microsoft comes under blistering criticism for “grossly irresponsible” security | Ars Technica BrianKrebs: "The CEO of Tenable just ripped Microsoft a new on…" - Infosec Exchange 2023-07: Hackers stole a Microsoft Azure Active Directory certificate which gave them full access to basically all Microsoft cloud services including Outlook, Office, SharePoint, Teams, "Login with Microsoft", and so forth. (MS blog entry, Source, German source) With the default logs, customers could not even detect intruders as you would need to pay extra to get access to those log files. Microsoft did not communicate which services were affected and which not. Any Microsoft cloud service was potentially compromised. Most probably, the usual "any compromised system needs to be thrown away and re-created from scratch will not be applied here. As a consequence, you can't trust any data from Microsoft services any more. Security experts like Mike Kuketz think that most probably we need to consider all Microsoft systems that are using their cloud authentication including all Windows hosts are compromised. According to this German source, Microsoft is still refusing to tell what happened and which systems are affected to what extend. 2023-08-18: German comment: Many similar comments like that underline that Microsoft disqualifies as a trustworthy partner. 2023-09-06: first public explanation by MS: Microsoft: Results of Major Technical Investigations for Storm-0558 Key Acquisition Press reactions: heise (German), fefe (German)

jameshart 3y ago
The timeline now includes this significant event: > 2023-09-29: My Mastodon message about the latest news was posted on Hacker News and its discussion reached number one worldwide. The circle is complete.

pritambarhate 3y ago

Found following from the links from the post: 2023-07: Hackers stole a Microsoft Azure Active Directory certificate which gave them full access to basically all Microsoft cloud services including Outlook, Office, SharePoint, Teams, "Login with Microsoft", and so forth. (MS blog entry [1], Source[2], German source) Also the following: https://infosec.exchange/@briankrebs/110820474957163710 https://infosec.exchange/@briankrebs/110820474957163710 Quite damning if true. [1]: https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/ https://www.microsoft.com/en-us/security/blog/2023/07/14/ana... [2]: https://www.wiz.io/blog/storm-0558-compromised-microsoft-key-enables-authentication-of-countless-micr https://www.wiz.io/blog/storm-0558-compromised-microsoft-key...

_23sd 3y ago
The issue was specific to services that used Microsoft's .NET libraries for Azure AD authentication without doing additional checks for auth token validity [1], which was not "all of Microsoft". There's no public list of what components are used where AFAIK, we just know that MS says forged auth tokens were successfully used on Exchange Online email. It is sensationalizing to say the entire Azure cloud was hacked. This is not to downplay how bad Microsoft's security lapses were, and how bad their announcements were. The most horrifying part to me, besides the need for "premium" logs to detect a breach which I'd been complaining about before this, was how PR seemed to blame the Exchange Online team for misusing the authentication libraries, but later they updated the libraries and said the token validation issue was "corrected using the updated libraries". That feels like internal blame shifting out in public. [1] https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/#why-a-consumer-key-was-able-to-access-enterprise-mail https://msrc.microsoft.com/blog/2023/09/results-of-major-tec...

thefz 3y ago

Besides, in some services not even MS has control over the data, see KV or MHSM. In the very same link he posts: https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/ https://www.microsoft.com/en-us/security/blog/2023/07/14/ana... "Post-compromise activity Our telemetry and investigations indicate that post-compromise activity was limited to email access and exfiltration for targeted users." So it's not "all Microsoft". It's the usual exaggerated headline, but this time it draws attention on a person's post on Mastodon. This platform is really no different from Twitter.