5 ms·
From Microsoft’s blog post on the incident (Mitigation and Hardening section): - On June 26, OWA stopped accepting tokens issued from GetAccessTokensForResourc
by dimal 3y ago
From Microsoft’s blog post on the incident (Mitigation and Hardening section):
- On June 26, OWA stopped accepting tokens issued from GetAccessTokensForResource for renewal, which mitigated the token renewal being abused.
- On June 27, Microsoft blocked the usage of tokens signed with the acquired MSA key in OWA preventing further threat actor enterprise mail activity.
- On June 29, Microsoft completed replacement of the key to prevent the threat actor from using it to forge tokens. Microsoft revoked all MSA signing which were valid at the time of the incident, including the actor-acquired MSA key. The new MSA signing keys are issued in substantially updated systems which benefit from hardening not present at issuance of the actor-acquired MSA key:
- Microsoft has increased the isolation of these systems from corporate environments, applications, and users.Microsoft has refined monitoring of all systems related to key activity, and increased automated alerting related to this monitoring.
- Microsoft has moved the MSA signing keys to the key store used for our enterprise systems.
- On July 3, Microsoft blocked usage of the key for all impacted consumer customers to prevent use of previously-issued tokens.
I’m not a security expert. What are the holes in this strategy?
- nerdbert 3y agoOne big problem is that there's no way of knowing what other holes/backdoors were introduced during the period when the attacker had all those credentials. Maybe they are immediately able to get the new key.
- jl6 3y agoLet's hope someone has spent the last 3 months reinstalling Azure from the original CD.
- garganzol 3y ago"MSN Limited Edition Gold CD" is actually a thing.
- juancampa 3y agoFCKGW-RHQQ2-YXRKT-8TG6W-2B7Q8
- gorlilla 3y agoThanks. I used to have that on a piece of paper taped to my tower. I don't have that tower but instantly recognized it.
- no_identd 3y ago[Laughs in Trusting Trust Problem]
- quickthrower2 3y agoYou can but you need to install NT4 first, then do all the upgrades
- mycall 3y agoWhy is there no way of knowing? I would think Microsoft is able to do forensic snapshot comparisons for their datacenters -- at least, I would assume a trillion dollar company does.
- eqvinox 3y agoEstablishing that ability costs money (i.e. having snapshots & co.), and actually executing it costs further money. Absent either customers paying for it, or regulations requiring it, Microsoft certainly won't sink money out of the goodness of their heart. I don't believe there are a lot of regulations for this — and how many customers do you think would pay for something like this? Realistically? :-(
- insanitybit 3y agoI mean, they at least have SOC2 compliance, and obviously a lot more (FEDRAMP). To get those certifications an auditor is going to make sure you have basic shit in place like logging, etc.
- nerdbert 3y agoThey're not going to make sure of anything, in my experience, except that an org's IT management had a disappointing conversation with their team and then aspirationally checked boxes claiming to have things in place.
- notnmeyer 3y agoyeah, but SOC auditors barely understand the stuff you’re providing as proof.
- insanitybit 3y agoIt's gonna depend on the auditor, but yeah of course SOC2 doesn't mean "you're secure" but unless you actively lie to your auditor you're going to have some basic stuff in place.
- 3y ago
- insanitybit 3y agoThese points seem to dispute the "the keys are compromised and still in use" and the "everything is tainted" title.
- eqvinox 3y agoThe article does not claim the keys are still in use. It specifically says "missing containment actions". Everything is tainted because you don't know what secondary actions were executed using the compromised keys.
- eqvinox 3y agoThe problem is that you have no way to verify what may or may not have been done by malicious actors using compromised keys in the meantime. If you have immutable, permanent audit logs, you can go through all actions authenticated with something directly or indirectly signed by the leaked key. However, building such an audit log in a way that someone with maximum permissions still can't tamper with it is not easy — and not cheap. (And, worst case, the audit log may not have the necessary detail; e.g. just listing an authenticated identity, but not the way authentication was established — thus not allowing easy identification of possibly compromised access.) As such, the hole in the strategy is that it doesn't account for other persistent backdoors that may have been added while access using this leaked key was possible. It only prevents further exploitation of the issue. But depending on the sophistication level of the attackers — which seems extremely high considering how the key was apparently stolen — it's nigh impossible to figure out how many secondary avenues of access they have established.
- dimal 3y agoCould this be said for just about _any_ intrusion? Once you’ve been compromised, is there any way to know that no back doors were installed? Is this situation different than others?
- eqvinox 3y agoWell, it really depends on the maximum privilege achieved by the intrusion, a user getting compromised hopefully can't do much more than exfiltrate data they have access to; local admin could compromise the OS or even the BIOS, then there's possibly multiple levels of domain admin, and then there's a compromise of the authentication system itself…
- deanCommie 3y agoThe problem with THAT line of thinking is: * We already have confirmation that the US government has been tapping internet infrastructure, accessing back doors in BigTech backends, and compromising industry-wide encryption and RNG standards. So there is no way to prove that SOMEONE at the NSA doesn't have the ability to access all of the information on the internet. And, since the NSA is just more humans, that means there's no way to prove that someone else hasn't sold that ability or specific subsets of the data to malicious actors. Post Snowden revelations, you have to do risk analysis. Is some US or Five Eyes Government Agency able to access all your personal information or business competitive secrets? Probably Yes. Can one of your competitors? Probably Not. Can a malicious neighbor or drug cartel that would then use it to extort you for money? Probably not. So even in this hypothetical example where everything authenticated by Microsoft is tainted, it's not clear if it actually changes this equation significantly.