22 ms·
Microsoft actions following attack by nation state actor Midnight Blizzard
- sneak 3y agoWhy does the data security industry seem to be so into obfuscated jargon? It’s like a new industry microcosm corporatespeak. It’s ok to call them countries, hackers, and intrusions. Microsoft got hacked by Russian government hackers.
- newsclues 3y agoBecause the reality is murky.
- SoftTalker 3y agoMy summary understanding of this write-up is that a weak password was guessed and allowed entry into an old system that had access to stuff it shouldn't have had access to.
- wrsh07 3y agoYour summary is also ambiguous. Were they hacked by the Russian CIA equivalent? Were they hacked by people funded by the Russian government? Were they hacked by people funded by senior government officials? I think it's possible that the truth is a little murky, and capturing that ambiguity is actually clearer than trying to wave it away
- 2OEH8eoCRo0 3y ago> The U.S. Federal Bureau of Investigation (FBI), U.S. Cybersecurity & Infrastructure Security Agency (CISA), U.S. National Security Agency (NSA), Polish Military Counterintelligence Service (SKW), CERT Polska (CERT.PL), and the UK’s National Cyber Security Centre (NCSC) assess Russian Foreign Intelligence Service (SVR) cyber actors—also known as Advanced Persistent Threat 29 (APT 29), the Dukes, CozyBear, and NOBELIUM/Midnight Blizzard https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/russia https://www.cisa.gov/topics/cyber-threats-and-advisories/adv... So, they're "Russian Foreign Intelligence Service (SVR) cyber actors"
- Morte42 3y agoIm guessing that's like saying they are hired by the Russian equivalent of the CIA and following direct orders from top Russian officials?
- 2OEH8eoCRo0 3y agoWhile the CIA is a US foreign intelligence agency, I'd hesitate to call them equivalent. Hired by as in, employees of, Russian intelligence? Unless my link is inaccurate, yes.
- parl_match 3y ago> It’s ok to call them countries, hackers, and intrusions. It's not if you want to do business in that country. Or if you annoy allies of that country (accusing certain countries might get senators breathing down your neck!). You are accusing a government of committing a crime, or at least a wildly unethical behavior. Those are huge charges. To your point, I wish they could be more direct, but... > Microsoft got hacked by Russian government hackers. It is not known whether this hacking group is private, government sponsored, or government run. They could be a private group that takes both private and government contracts. If they were funded via government channels, who was it? A higher up person using their personal wealth? A specific agency? Multiple agencies? The reason they are being so vague is because they don't know the answers, and it is very discrediting to throw around incorrect accusations.
- toss1 3y ago>> It is not known whether this hacking group is private, government sponsored, or government run. Coming from Russia, that's a distinction without a difference. Sure, private groups can 'freelance', but not without at least tacit permission from the FSB, GRU, and/or SVR (more accurately, cant freelance for long). Especially so for sch a high visibility target such as Microsoft. And when the RU govt isdues a denial, it's confirmed. But still no reason for MS to escalate the wording. They put enough in there that anyone with a clue knows it's serious.
- parl_match 3y agoThe distinction probably matters to a lot of people at the scale that Microsoft is operating at. They likely worked with some sort of MS US government liaison on the wording. Operating with tacit approval is not the same as being a government entity. Even you admit there is a small chance that this group is not tacitly approved ("for long"). I mean yeah, we all know the score, but a it's really bad idea to levy heavy charges without knowing the answer 100%. This statement does pretty heavily implicate the Russian Govt though, yeah :)
- lazyasciiart 3y ago
- chatmasta 3y agoAt least for the "Midnight Blizzard" part of the title, it's the result of a naming framework [0] for threat actors that Microsoft has been using since April 2023. I agree it sounds weird. [0] https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming https://learn.microsoft.com/en-us/microsoft-365/security/int...
- jstarfish 3y agoThe naming framework for these groups isn't even consistent, with every vendor having their own scheme. Midnight Animal to one vendor is Dancing Bear to another and known by Wet Cat to yet another. They all sound like bad translations to bargain-bin porno movies.
- true_religion 3y agoI’m not aware of another company that uses a naming framework.
- ivlad 3y agoCrowdstrike. FireEye.
- true_religion 3y agoDefinitely agree that Crowdstrikes naming veers past what is necessary. They even draw up supervillain graphics for them. https://www.crowdstrike.com/adversaries/arcane-kitten/ https://www.crowdstrike.com/adversaries/arcane-kitten/
- jrowen 3y agoThis is wild. Ethereal Panda? Labyrinth Chollima?! Why are we modelling threat actors/"adversaries" as a video game bestiary? Or meteorological phenomena in the case of MS?
- mc32 3y agoRussia hacks, but so do China, North Korea, Iran and Ukraine. They all have bagged large targets. It could be any of them but could be someone else as well.
- deleted 3y ago[deleted]
- doublerabbit 3y agoAs does UK and the USA. Maybe it's Microsoft hacking it self; GPT style. If so, hello Skynet.
- nozzlegear 3y agoIt largely boils down to the same reason scientists classify animals into taxonomies. It helps to have a framework for classifying the groups so you can refer back to them in the future. Going back to my example with taxonomies: Yeah, you got bit by a spider, but exactly which kind of spider bit you? What do we know about those kinds of spiders, e.g. are they known for being venomous or not, does their bite have a well-known reaction in humans, etc.
- 2OEH8eoCRo0 3y agoWoah. Easy there. It sounds like you're trying to start a flamewar by singling out Russia. Don't you know that every country does this?! Please preface any accusations against Russia with paragraphs of anti-Western invective. /s
- mistrial9 3y agothis reminds me of guys trying to out-shout each other about who wants to fight the most, in front of a lot of (Ynews) onlookers
- akira2501 3y agoInteresting that they seem to suggest that applying security is now more important than avoiding service disruptions. This may be the hopeful dawn of a new era.
- robblbobbl 3y agoIt is indeed the beginning of a new AI related era. But why cloud services, Microsoft? There is already a new infrastructure on the way better suited for AI, called edge computing. I'm not talking about completely eliminating cloud services. But solely depending on these kind of services could lead to further problems later due to this topic (national security) is very serious for all of us.
- gustavus 3y agoI work in the security space. It is the dawn of an era where all the makers are stamped down under the boot ridiculous security theater via regulation for "security" and "protection" and the current interests become entrenched to ensure a couple of guys in their garage can no longer upset the behemoths of the tech space.
- booi 3y agoWell well well.. how the turn tables. It's karma after years of my windows machine forcing a restart for a security update while I'm working on something in the middle of the day..
- bamboozled 3y agoIt won’t be. Everyone will forget about this in a week and it will be BAU. Like every other breach.
- starik36 3y ago> access a very small percentage of Microsoft corporate email accounts Ok, so far so good. > including members of our senior leadership team Ahhh, so maybe the attackers were after the senior leadership team and therefore stopped at the "very small percentage".
- nighthawk454 3y agoSeems weird to word it as “a very small percentage” instead of “a very small number” unless the number was a little bigger than they want to admit.
- blibble 3y agoyes, at least 1% of their users which is a very large number > To date, there is no evidence that the threat actor had any access to customer environments, *production systems*, source code, or AI systems. senior executive's email accounts aren't production? having every western company use the garbage that are Microsoft's hosted products (notably Teams and Outlook) is a national security issue that's a massive disaster that's just waiting to happen
- calgoo 3y agoI agree around teams and outlook, but what is the alternative? Google? AWS? Self host? Honest question, because the way enterprise tends to work, they want to offload the responsibility to a third party so When information does leak or get hacked, they can blame someone else.
- blibble 3y ago> but what is the alternative? Google? AWS? Self host? I mean, given this was possible: > used a password spray attack to compromise a legacy non-production test tenant account and gain a foothold, and then used the account’s permissions to access a very small percentage of Microsoft corporate email accounts pretty much anything is going to be better than letting Microsoft host your email/corporate data
- BandButcher 3y agoHaha "...access a very small percentage of Microsoft corporate email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions, and exfiltrated some emails and attached documents." Seems like a big deal. Also, this may be why I've been getting massive amounts of "unusual account sign-in activity" emails for Microsoft about an old outlook account i no longer use... Hopefully these state actors can get access to my vsts server i no longer can find and deploy an old app for me ;)
- carabiner 3y agoWhat does the title mean?
- nycdatasci 3y agoThe title here matches the title of their blog post, which I agree is poorly worded.
- voytec 3y ago> poorly worded Or intentionally obfuscated "we were hacked".
- nozzlegear 3y agoI believe “Actions taken by Microsoft following an attack by a group named Midnight Blizzard, who are backed by a nation-state”.
- wg0 3y agoI had to read the title multiple times but couldn't make sense of what is exactly happening. Why is this happening to English? The other day, there was a story about an airplane window that got melt and many native speakers couldn't make sense of what the title of the story meant? In that case too, as a non native speaker of English, I blamed myself first for not understanding the language well enough.
- IronWolve 3y agoDid they release this late on a friday to downplay the scope of the attack? If they had top leadership accounts and service accounts hacked just by password protection sounds like a major security fubar.
- skybrian 3y agoReleasing news after the stock market is closed gives traders a chance to digest the news before trading begins the next day. (Which doesn't explain why it's on a Friday.)
- blibble 3y agotrading MSFT doesn't cease when the NASDAQ closing bell rings
- skybrian 3y agoStill, it seems to be the custom.
- blibble 3y agoif you're a retail investor maybe there's thousands of ways to get exposure to MSFT one way or the other beyond the primary market
- fsckboy 3y agoit's the custom because it's not just stock trading that they care about, it's brand/image, and weekends give the story time to disappear from the headlines, being replaced by new stories. Fewer people are paying attention to the news over the weekend.
- bee_rider 3y agoIt could be sort of neat if there was a convention for all news agencies and press rooms to queue up all their stories and release them after the end of the business day. Why advantage parties that can process in less than 12 hours? Rushing analysis just makes it worse.
- hbcondo714 3y agoMicrosoft filed this late today with the SEC[1] just before they stopped accepting new filings for the day under their new Cybersecurity Incident disclosure rule[2]. FWIW, two other publicly traded companies disclosed[3] their breaches since the rule went into affect last month. [1] https://www.sec.gov/Archives/edgar/data/789019/000119312524011295/d708866d8k.htm https://www.sec.gov/Archives/edgar/data/789019/0001193125240... [2] https://www.sec.gov/news/press-release/2023-139 https://www.sec.gov/news/press-release/2023-139 [3] https://last10k.com/stock-screeners/cybersecurity https://last10k.com/stock-screeners/cybersecurity
- ahoog42 3y agoActually there has been more, e.g. LoanDepot, Inc [1], and then various amended 8-Ks. I’ve been hacking on a side project to parse the 8-K data which is all over the place, including some companies still reporting under old “items” like 8.01 vs the new 1.05 material cybersecurity incident item. If folks are interested in this space, I just got the mailing list [2] running last night and you can see a list of all the current incidents on my Incident Tracker [3]. I have many more data points I plan on tracking as well as adding 10-K GRC items to the list (potentially helpful for CISOs, other risk managers and investors to eval a companies risk management maturity). Welcome any feedback! [1] https://www.board-cybersecurity.com/incidents/tracker/20240108-loandepot-inc-cybersecurity-incident/ https://www.board-cybersecurity.com/incidents/tracker/202401... [2] https://www.board-cybersecurity.com/alerts/ https://www.board-cybersecurity.com/alerts/ [3] https://www.board-cybersecurity.com/incidents/tracker/ https://www.board-cybersecurity.com/incidents/tracker/
- deleted 3y ago[deleted]
- clwg 3y agoThey should look at upgrading their Entra ID plan to P2 in order to protect against these attacks.
- this_steve_j 3y agoAnd all things considered, an AI security assistant like Copilot might be a good investment too, if they lack highly skilled front line security staff. Not to mention, AI generated automated playbooks in Sentinel to automatically apply Zero Trust principles! I also wonder if they had upgraded all of their Subscriptions to Defender for Cloud CSPM Tier 2 in order to use the premium Cloud Security Attack Graph explorer, and then enabled Workload protections, this tragedy could have been averted. It’s going to take an army of motivated sales engineers to protect against these new cybernetic attacks by augmented warfighters.
- Voultapher 3y agoLost my sanity there for a moment before realizing what you did. Good job!
- voidwtf 3y agoI wonder if they switched from user-based MFA to Conditional Access MFA yet, maybe they forgot to enable alerting for non-interactive logins. Maybe they forgot to update the Log Analytics Agent to the Azure Monitoring Agent. /s
- paxys 3y ago> Beginning in late November 2023, the threat actor used a password spray attack to compromise a legacy non-production test tenant account and gain a foothold, and then used the account’s permissions to access a very small percentage of Microsoft corporate email accounts [...] > The attack was not the result of a vulnerability in Microsoft products or services. Hmm...
- juggertao 3y agoThey mention it was a password spray guess.
- deelowe 3y agoI'm guessing they don't know what a password spray is?
- tommica 3y agoWhat is it? Just spam a form with passwords?
- tgv 3y agoWell, your "legacy non production test tenant" can be opened by just guessing passwords, and it allows access to "very much in use production non-test" tenants, then you could say MS has a vulnerability. It may not be a buffer overflow, but it is a vulnerability nonetheless.
- booi 3y agoYes, and I think most people would consider it a vulnerability if an authentication system doesn't rate-limit or otherwise slow/stop "password spray" attacks.
- oezi 3y agoYou can rate limit individual users but password spray attacks use a large number of accounts to remain undetected in a authentication system used by an even more users.
- yborg 3y ago"We were pwned by the Russians (again) and they were reading all of Satya's emails, but it's okay, they were just looking for shout-outs to post in their interoffice Telegram channel for the lulz." I understand that the company has to minimize every breach but this frankly looks a lot more serious than Microsoft suggests here.
- jug 3y agoI love how they emphasize only few were exposed. Like just a few, only our senior staff and cybersecurity team... I mean -- they aren't lying, but... Wow
- voidwtf 3y ago"very small percentage" 1% of 238,000 employees is a "very small percentage" and still 2,380 employees. Insight into certain operational information and potentially undisclosed/unpatched zero days could be monumentally valuable to a nation state actor.
- Fire-Dragon-DoL 3y agoIsn't the rule "if you are being targeted directly, lose all hope"?
- nycdatasci 3y agoThe Friday evening blog post also seems designed to brush this under the rug. "We will act immediately to apply our current security standards to Microsoft-owned legacy systems and internal business processes" In other words: Microsoft will adopt their own security standards. Curious whether their SOC reports mention these are optional?
- voytec 3y agoI wonder which mail client the execs were using. If Outlook, their messages would be already harvested by 700+ companies[0] and another leak wouldn't be an issue. [0] https://news.ycombinator.com/item?id=38441710 https://news.ycombinator.com/item?id=38441710 [0] https://news.ycombinator.com/item?id=38953618 https://news.ycombinator.com/item?id=38953618
- midtake 3y agoEver since Delve was introduced, Microsoft Outlook has felt weird to me
- Arn_Thor 3y agoI’m not familiar with Delve. Care to elaborate?
- mmerlin 3y agoDelve could lead to accidental document sharing with peer accounts? https://learn.microsoft.com/en-us/sharepoint/delve-for-office-365-admins#BKMK_DelveOff https://learn.microsoft.com/en-us/sharepoint/delve-for-offic... Microsoft365 is deprecating Delve in December 2024
- deleted 3y ago[deleted]
- yieldcrv 3y ago“it was Russia, they went thata way!” this presents no proof, but I’ve read lots of krebs security proof on other exploits and I think it is all very weak nothing is stopping anybody here from putting breadcrumbs in a payload to point the finger at North Korea or a former Soviet state This is kind of a silly standard that allows hackers to operate with impunity and companies to avoid accountability and the fbi from not bothering
- mr_mitm 3y agoDepends. If the breadcrumbs are key material which correlates to other known incidents from the same group, or exclusive tooling, or C2 infrastructure, then there is definitely something stopping them from putting breadcrumbs there. They'd have to hack the other group first in order to do so. I agree with you that seeing evidence would be nice, but I understand that there is the possibility that evidence supporting the claim exists and at the same time cannot be released to the public.
- sudosysgen 3y agoAs we've seen, many of the cybersecurity teams have been pwned, so a large part of the breadcrumbs they'd pattern match are already out there. Additionally, if security is poor enough, there can be more than one hacker into a system, which is another way they could accumulate breadcrumbs. This has precedent - there has been malware that uninstalls other malware.
- voidwtf 3y agoHow did they pivot from a test tenant to corporate email access? That's the most concerning fact that they just glossed over.
- shermantanktop 3y agoYou know, they pivoted. Non-production tenant PIVOT Satya’s email inbox. Like that.
- utdoctor 3y ago1. Password spray 2. Access non-prod environment 3. ??? 4. "Look at me, look at me, I am the CEO now."
- voidwtf 3y agoI reflexively read #4 to the tune of Flobots - Handlebars
- chrnola 3y agounderrated comment
- palmfacehn 3y agoIt was a "Captain Phillips" reference for me.
- foota 3y agoReflexively? That song is almost 20 years old! (oh god now I feel old too)
- deleted 3y ago[deleted]
- isoprophlex 3y agoPivot! PIVOT!!! https://youtu.be/njgfomF51fg https://youtu.be/njgfomF51fg
- cedws 3y ago>Beginning in late November 2023, the threat actor used a password spray attack to compromise a legacy non-production test tenant account and gain a foothold, and then used the account’s permissions to access a very small percentage of Microsoft corporate email accounts I have so many questions from this sentence alone. What did they password spray? Microsoft's internal identity provider? Was the non-prod system internet facing? Why isn't MFA enforced?
- Too 3y agoIndeed. How can they not be mandating MFA?
- sagman 3y agoMaybe this is why it only affected leadership team. Maybe they can circumvent requirements meant for lowly employees.
- thrwwycbr 3y agoThey got Kerberoasted and don't want to admit it publicly.
- zer0c00ler 3y ago[dead]
- modeless 3y agoUm. Why does "a legacy non-production test tenant account" have "permissions" for "email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions"?
- SoftTalker 3y agoThe usual reason include: oversight; mistake; incompetence.
- jtdev 3y ago[dead]
- JeffSnazz 3y agoOh god they're russian. That means they're evil!
- aa1234556 3y ago[dead]
- m3kw9 3y agoSwiss cheese security as usual
- m3kw9 3y agoMS is a joke at security and they prob have 2000 person in a building doing this stuff too
- kgeist 3y ago>Microsoft has identified the threat actor as Midnight Blizzard, the Russian state-sponsored actor also known as Nobelium How do they identify those groups?
- rightbyte 3y agoThey are just making it up. Security people seems to be of the militaristic type ofent, so I guess they add a slive of war mongering to it to to play ball. Iran, North Korea and what not. Very convenient since it is not falsifiable in practice.
- astrange 3y agoThey are certainly identifiable from their work. State hackers are professionals and they work like other professionals do; they work 9-5 in their local time zone and they have modular implants with code reuse. Amateurs aren't like this.
- kgeist 3y agoThat's basically the only argument I've heard so far - if a hacking activity happens between 06:00 UTC and 14:00 UTC then it must be the Russians, otherwise it's someone else. Doesn't sound like a very strong argument? "Modular implants with code reuse" - sounds like exploit kits you can buy on hacking forums.
- astrange 3y ago> "Modular implants with code reuse" - sounds like exploit kits you can buy on hacking forums. This isn't a category argument, they're using a different one than what you can get on forums.
- fremenite 3y agoFrom the artifacts they leave behind after the attack, broadly speaking.
- 3y ago
- wly_cdgr 3y agoNow I understand why Microsoft bought Activision Blizzard. So they could fight Midnight Blizzard.
- postepowanieadm 3y agoJust block all traffic from russia :)
- ikekkdcjkfke 3y agotakes step over the border and opens laptop
- mylidlpony 3y agoimmediately gets caught and extradited to us
- 1vuio0pswjnm7 3y ago"Microsoft took advantage of news of this hack to talk about how they are going to move forward to make itself more secure." https://techcrunch.com/2024/01/19/hackers-breached-microsoft-to-find-out-what-microsoft-knows-about-them/ https://techcrunch.com/2024/01/19/hackers-breached-microsoft...
- Roark66 3y agoSeriously? This reads like a joke. They brute forced some tenant test systems. Fine, I bet the password was Password123!, but then "they used account's permissions" to access various corporate emails. How is that even possible? What does it mean "they used the account's permissions"? Are you telling me there was no privilege separation between a tenant test environment and the internal domain? That the tenant system was not in its own isolated network? This is absolutely insane. Whenever I read stuff like that I wonder if some junior IT employee didn't just buy a new home for cash few months ago. I'm all for "don't look for malice where incompetence is a sufficient explanation", but that's just a little too much incompetence to be believable.
- slackr 3y agoWhy do they say "nation state actor", isn't "state actor" the correct term? I thought Russia, like the UK and many other states, is a multinational state, including numerous languages and cultures.
- raccoonDivider 3y agoI've always wondered why infosec people love this expression so much. Maybe "nation state" just sounds more impressive. Who cares what the state is composed of? Or is it "nation/state", one or the other?
- mr_mitm 3y agoClearly only a nation-state threat actor could have pulled off this highly sophisticated cyber attack of ... Spraying passwords
- GartzenDeHaes 3y agoSeems a bit out of style to blame the Russians, but I guess that describes Microsoft in general.
- alexdns 3y ago> Why do they say "nation state actor" A Nation-State is the idea of a homogenous nation governed by its own sovereign state—where each state contains one nation.
- Symbiote 3y agoAnd that definition doesn't describe the Russian Federation. There are many nations within Russia, ones you may have heard of are Bashkortostan (in the news this month due to protests) and Chechnya (civil wars in the 1990s). It is not a homogeneous federation. https://en.wikipedia.org/wiki/Republics_of_Russia https://en.wikipedia.org/wiki/Republics_of_Russia
- 3y ago
- yukIttEft 3y agoFrom the same company that charges you to access your logfiles. https://www.theregister.com/2023/07/20/under_cisa_spressures_collaboration_microsoft/ https://www.theregister.com/2023/07/20/under_cisa_spressures...
- noSyncCloud 3y agoThey're actually Microsoft's logfiles, see? You're just licensing them
- jongjong 3y agoI'm wondering how many hacks like this must occur before companies start caring about hiring good developers with a proven individual record instead of those who can solve the most gimmicky puzzles in 30 minutes. There are developers out there with excellent track records who have built bug-free solo projects which prove their excellence and yet can't find a job in this economy. Some of these developers have also proven themselves to work well in a team so there is no excuse to ignore them. They are excellent both as lone wolf and team player. Companies should desperately look for them and recruit them. Only such developers can save companies from technical decay.
- helpfulContrib 3y ago[dead]
- amai 3y ago„compromise a legacy non-production test tenant account and gain a foothold, and then used the account’s permissions to access a very small percentage of Microsoft corporate email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions, and exfiltrated some emails and attached documents.“ Does a non-production test account usually have permission to access email accounts of the senior leadership team? Is that a security best practice?
- lousken 3y agoI am surprised they had logs for this long. Entra only comes with 30 days of audit logs by default which is utterly insane
- sagman 3y agoBet it might be because of a combination of compliance and cost. Storing logs at that scale is not cheap
- lousken 3y agoWho cares? a) their logs have 30% of information that is completely useless, maybe they should fix that then b) (especially) if you have a P1/P2 AD license this is just not acceptable, you are paying enough to at least have some decent storage for such critical piece of information funny thing - if you have these things in default and someone deletes a user, you won't know who did such action after 30 days (meaning you not only can not recover the user, but also will not know who performed the action) edit -as for the compliance, personally not aware of it, but you should be able to at least have a retention policy option for it and since most companies will just put it into a storage account or log analytics I don't think it's a matter of that
- mrkramer 3y ago>Beginning in late November 2023, the threat actor used a password spray attack to compromise a legacy non-production test tenant account and gain a foothold If people at Microsoft reuse passwords than what we can expect from casual PC users?!
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- yeahthatone 3y agoi found $ signs $ in my AI prompt text-box suggesting shell interference while also experiencing buffer overflow in my local windows pc. just a random Dalle3 user in Bing's image creator