3 ms·

I think there's a huge difference between "maybe there is a backdoor" versus "literally all of microsoft, across all orgs, is owned and they have to shut it all

I think there's a huge difference between "maybe there is a backdoor" versus "literally all of microsoft, across all orgs, is owned and they have to shut it all down and start from scratch", call me crazy.

arendtio 3y ago
To me it sounds more like: Most likely backdoors have been planted. So the question is how you handle such a situation.
eqvinox 3y ago
That's really wishful thinking. Which is fine if you're a small company throwing non-sensitive things into Azure. If OTOH you were working as a SIEM at some company providing 2nd-order cloud services, this is where I would start questioning your qualifications and that company's overall policies. (… especially when you're not even bringing up the fact that the compromised key was mainly usable to access e-mail)
- insanitybit 3y ago
  I did indeed bring that up in another comment. I don't feel the need to repeat all information across all of my comments. I don't know what your point is.
TheHappyOddish 3y ago
The "start from scratch" (or as we used to call it, 'nuke from orbit') approach is the only feasible one. If an attacker had full root across the org for an undetermined (but not short) period, I'm unsure what other approach you think you could take? You can't just run MalwareBytes and call it a day.
- insanitybit 3y ago
  Step 1 is to review your existing telemetry. You determine the possible scope of the attack based on the evidence you find. You remediate based on that. You may also want to consider scope that you don't have evidence for but that you lack telemetry for and that you believe an attacker could have accessed - that's fine too. This comes down to a risk assessment. No company has a breach and just shuts everything down, that is insane. When we perform IR we build a detailed timeline, we collect the scope of potential access, and we form a remediation plan. We don't just go "well hey, anything can happen right? shut it all down".
- nullindividual 3y ago
  Nuke it from orbit applies to a workstation, not an enterprise environment.
  - froggit 3y ago
    Nukes can be applied to all kinds of shit. It's easy enough to understand the implication of the phrase that there's no need to pretend it can only apply to specific items.

arendtio 3y ago

To me it sounds more like: Most likely backdoors have been planted. So the question is how you handle such a situation.

eqvinox 3y ago

That's really wishful thinking. Which is fine if you're a small company throwing non-sensitive things into Azure. If OTOH you were working as a SIEM at some company providing 2nd-order cloud services, this is where I would start questioning your qualifications and that company's overall policies. (… especially when you're not even bringing up the fact that the compromised key was mainly usable to access e-mail)

insanitybit 3y ago
I did indeed bring that up in another comment. I don't feel the need to repeat all information across all of my comments. I don't know what your point is.

TheHappyOddish 3y ago

The "start from scratch" (or as we used to call it, 'nuke from orbit') approach is the only feasible one. If an attacker had full root across the org for an undetermined (but not short) period, I'm unsure what other approach you think you could take? You can't just run MalwareBytes and call it a day.

insanitybit 3y ago
Step 1 is to review your existing telemetry. You determine the possible scope of the attack based on the evidence you find. You remediate based on that. You may also want to consider scope that you don't have evidence for but that you lack telemetry for and that you believe an attacker could have accessed - that's fine too. This comes down to a risk assessment. No company has a breach and just shuts everything down, that is insane. When we perform IR we build a detailed timeline, we collect the scope of potential access, and we form a remediation plan. We don't just go "well hey, anything can happen right? shut it all down".
nullindividual 3y ago
Nuke it from orbit applies to a workstation, not an enterprise environment.
- froggit 3y ago
  Nukes can be applied to all kinds of shit. It's easy enough to understand the implication of the phrase that there's no need to pretend it can only apply to specific items.