3 ms·
Not to downplay the severity but honestly, every breach I read about seems “serious” but very rarely does anything of consequence happen with these events. Azu
by bamboozled 3y ago
Not to downplay the severity but honestly, every breach I read about seems “serious” but very rarely does anything of consequence happen with these events.
Azure was owned pretty hard a while back, very little was ever heard of it again.
Is the drama of them appealing ? What might we expect to happen from this ? They’ve read Satya’s email ?
- bobmaxup 3y agoHow do you know if nothing happens? It isn't like the people siphoning, selling, or purchasing this data are broadcasting their wins on news aggregators.
- tempodox 3y agoIt makes the news when an entity like Microsoft gets cracked, but when their users get robbed or otherwise hurt as a consequence it will hardly make the news. You not knowing of the consequences doesn't mean they don't exist.
- bamboozled 3y agoThe company will be making record profits next year. There maybe consequences but nothing consequential in the grand scheme of things.
- malermeister 3y agoTurns out there's more possible consequences than company profits being impacted. Users are more than just things you milk for cash, they're people that trusted you and your product.
- PoignardAzur 3y agoI find this reply incredibly cynical. GP is clearly saying "this is important because small people will get hurt invisibly" and your hot take is that them being exploited isn't going to impact Microsoft's bottom line, so this isn't newsworthy? This is vice-signaling.
- bamboozled 3y agoBeginning in late November 2023, the threat actor used a password spray attack to compromise a legacy non-production test tenant account and gain a foothold, and then used the account’s permissions to access a very small percentage of Microsoft corporate email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions, and exfiltrated some emails and attached documents. The investigation indicates they were initially targeting email accounts for information related to Midnight Blizzard itself. We are in the process of notifying employees whose email was accessed. It says nothing about users being compromised. This is why they won’t do anything about it though ? Do you understand how it works ? They’re not going to do anything about the consequences for the users until it impacts their profits. Name one person who is done with Microsoft after this?
- wholinator2 3y agoI think the confusion lies between the terms "consequences" and "consequences for Microsoft". There won't be consequences _for Microsoft_ but there will be consequences for regular people. Saying there won't be consequences full stop implies you don't consider the damage to regular people as worthy of discussion or consideration
- tempodox 3y ago> It says nothing about users being compromised. Making my point. It doesn't mean users weren't compromised. And even if it did, that doesn't make it so for every security breach.
- ivlad 3y ago> Azure was owned pretty hard a while back, very little was ever heard of it again. From what I recall, it was a Chinese APT (designated as Storm-0558, which I think means they could not reliably attribute it to any group: https://malpedia.caad.fkie.fraunhofer.de/actor/storm-0558 https://malpedia.caad.fkie.fraunhofer.de/actor/storm-0558), that was sitting on developers’ workstations long enough to get access to master signing key from a memory dump that ended up on one of the workstations. They then used it to access US government officials’ emails (Department of State if I recall correctly), which supposedly gave China a strategic advantage and a better understanding of inner workings of US foreign policy. You will not see it in news that China got favourable terms in some negotiations with a country in Africa (are of Chinese interests) and US got least favourable terms than they could’ve gotten because the Chinese negotiators knew something.