8 ms·

Microsoft blamed for "a cascade of security failures" in Exchange breach report

120 points by alexandreyc 2y ago

exitzer0 2y ago
Notice how little scrutiny Microsoft has been getting by Congress, DOJ, FTC, etc. despite these many huge security blunders and whatever is going on between them and OpenAI. This might be because it is almost impossible to tell where Microsoft starts and the government ends these days. Also remember that Microsoft was basically the pilot program for Prism.
- refulgentis 2y ago
  We're commenting on an government reporting ripping them to shreds in public, and the FTC already announced an investigation into the AI shenanigans, and not just OpenAI. Please don't self-peasantize or induce it in others.
bonton89 2y ago
> Once Microsoft realized that the intruders had used a theoretically expired 2016 consumer signing key to forge tokens for an enterprise customer, it launched an "all-hands-on-deck" investigation that went through the night, June 26–27. The company arrived at 46 hypotheses for the intrusion, including "a theoretical quantum computing capability to break public-key cryptography." I feel like this is a twist on the denial stage of grief. Sure, our house is on fire...but maybe it is because a asteroid just struck the earth.
- waynesonfire 2y ago
  > 46 hypotheses for the intrusion The criticism here doesn't seem warranted. At an early stage of investigation, it seems prudent to iterate all possibilities, including grey swan events. This then allows to them to scale the investigation and delegate to various experts to address each hypothesis.
consumer451 2y ago
The linked story from 2023 has insane details. I’m pretty sure I had heard this before, but blocked it out due to some sort of normalcy bias. This plus the latest State Dept. hack deserves pulling the CEO in front of Congress. It is known that there used to be a saying at Microsoft ~”Don’t get Bill pulled in front of Congress“ to avoid making bad decisions. That should be a thing again. > He also faulted Microsoft for waiting five years to refresh the signing key abused in the attacks, saying best practices are to rotate keys more frequently. He also criticized the company for allowing authentication tokens signed by an expired key, as was the case in the attack. https://arstechnica.com/security/2023/08/microsoft-cloud-security-blasted-for-its-culture-of-toxic-obfuscation/ https://arstechnica.com/security/2023/08/microsoft-cloud-sec...
- bigboy12 2y ago
  Oh Microsoft has a security failure? Imagine that. Only 40 years of non stop security failures in its history. Why anyone would use Microsoft products is beyond me. You can only blame yourself. Fool me once shame on you, fool me for 40 years shame on me.
  - Caligatio 2y ago
    I would love to know of a major tech company/product that has NOT had a security failure. This goes double for companies that provide hosting of services that hold juicy personal information.
  - anonzzzies 2y ago
    Yep. I don’t understand why anyone ever uses Exchange; it was a joke 25 years ago, it’s still a joke.
  - psd1 2y ago
    That's edgy without being interesting. I could replace you with a small script.
- _8j50 2y ago
  For key rotation, it may not be as simple as it sounds. I expect better from MS as well but for example, for on-prem AD, the krbtgt account should be rotated yearly but in practice, it carries a huge risk of outages for accounts that depend on it a lot for kerberos ticketing. I don't know the details but knowing MS, they may have copied over the key distribution design of kerberos to azure ad (hence the "skeleton key") and that maybe why they didn't rotate it frequently. For the latter issue you mentioned as well, it may be caused by fear of outages. The people implementing the design may have opted for a soft notification to the right people when the key expired but wasn't renewed instead of refusing to validate tokens and causing a global outage affecting every cloud service for every customer. Hindsight is always 20/20, but why didn't any government, organization or institution require a 3rd party audit of MS prior to this? And how special is MS in it's design compared to gcp or aws? What is MS's response to the findings? I have a pet-peeve for people that show up into an organization and find everything is done wrong without getting into the nuances and root causes so they can capitalize on the supposed failures for fame and glory. I don't know if that is the case here and certainly MS 's security track record and MSRC's response record is horrible but I am taking this report with a grain of salt. The government does need to twist MS's arm a lot in my opinion. I've done an objective comparison of cloud provider security capabilities and Azure's is the worst by a large margin, too much nickle and diming to charge customers more for security.
tiahura 2y ago
If it’s Boeing …
ChrisArchitect 2y ago
Related official report: CISA Releases Report on Microsoft Online Exchange Incident from Summer 2023 https://news.ycombinator.com/item?id=39922066 https://news.ycombinator.com/item?id=39922066
kjellsbells 2y ago
There are still things that feel murky from reading the CISA report. For example, it notes that Microsoft do not know for certain how the attacker got in in the first place, but they and the government suspect (see 1.2.4 of the CISA report) it was a compromise of a laptop owned by an employee of Affirmed Networks, who Microsoft bought in 2021. Are they saying, then, that the attacker was in their network for two years? Or that the attacker was someone able to leap from this laptop to Microsoft's identity systems (which would be very odd, since Affirmed were not in that business, so there would have been no reason for such a laptop to be anywhere close to Azure's insides). One bright spot in the report, deserving of kudos, is that the folks at the State Department understood their monitoring tools and used them very well to uncover the anomaly that led to the discovery of this compromise.
nickburns 2y ago
https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review_of_the_Summer_2023_MEO_Intrusion_Final_508c.pdf https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review...

120 points by alexandreyc 2y ago

Notice how little scrutiny Microsoft has been getting by Congress, DOJ, FTC, etc. despite these many huge security blunders and whatever is going on between them and OpenAI. This might be because it is almost impossible to tell where Microsoft starts and the government ends these days. Also remember that Microsoft was basically the pilot program for Prism.

refulgentis 2y ago
We're commenting on an government reporting ripping them to shreds in public, and the FTC already announced an investigation into the AI shenanigans, and not just OpenAI. Please don't self-peasantize or induce it in others.

bonton89 2y ago

> Once Microsoft realized that the intruders had used a theoretically expired 2016 consumer signing key to forge tokens for an enterprise customer, it launched an "all-hands-on-deck" investigation that went through the night, June 26–27. The company arrived at 46 hypotheses for the intrusion, including "a theoretical quantum computing capability to break public-key cryptography." I feel like this is a twist on the denial stage of grief. Sure, our house is on fire...but maybe it is because a asteroid just struck the earth.

waynesonfire 2y ago
> 46 hypotheses for the intrusion The criticism here doesn't seem warranted. At an early stage of investigation, it seems prudent to iterate all possibilities, including grey swan events. This then allows to them to scale the investigation and delegate to various experts to address each hypothesis.

consumer451 2y ago

The linked story from 2023 has insane details. I’m pretty sure I had heard this before, but blocked it out due to some sort of normalcy bias. This plus the latest State Dept. hack deserves pulling the CEO in front of Congress. It is known that there used to be a saying at Microsoft ~”Don’t get Bill pulled in front of Congress“ to avoid making bad decisions. That should be a thing again. > He also faulted Microsoft for waiting five years to refresh the signing key abused in the attacks, saying best practices are to rotate keys more frequently. He also criticized the company for allowing authentication tokens signed by an expired key, as was the case in the attack. https://arstechnica.com/security/2023/08/microsoft-cloud-security-blasted-for-its-culture-of-toxic-obfuscation/ https://arstechnica.com/security/2023/08/microsoft-cloud-sec...

bigboy12 2y ago
Oh Microsoft has a security failure? Imagine that. Only 40 years of non stop security failures in its history. Why anyone would use Microsoft products is beyond me. You can only blame yourself. Fool me once shame on you, fool me for 40 years shame on me.
- Caligatio 2y ago
  I would love to know of a major tech company/product that has NOT had a security failure. This goes double for companies that provide hosting of services that hold juicy personal information.
- anonzzzies 2y ago
  Yep. I don’t understand why anyone ever uses Exchange; it was a joke 25 years ago, it’s still a joke.
- psd1 2y ago
  That's edgy without being interesting. I could replace you with a small script.
_8j50 2y ago
For key rotation, it may not be as simple as it sounds. I expect better from MS as well but for example, for on-prem AD, the krbtgt account should be rotated yearly but in practice, it carries a huge risk of outages for accounts that depend on it a lot for kerberos ticketing. I don't know the details but knowing MS, they may have copied over the key distribution design of kerberos to azure ad (hence the "skeleton key") and that maybe why they didn't rotate it frequently. For the latter issue you mentioned as well, it may be caused by fear of outages. The people implementing the design may have opted for a soft notification to the right people when the key expired but wasn't renewed instead of refusing to validate tokens and causing a global outage affecting every cloud service for every customer. Hindsight is always 20/20, but why didn't any government, organization or institution require a 3rd party audit of MS prior to this? And how special is MS in it's design compared to gcp or aws? What is MS's response to the findings? I have a pet-peeve for people that show up into an organization and find everything is done wrong without getting into the nuances and root causes so they can capitalize on the supposed failures for fame and glory. I don't know if that is the case here and certainly MS 's security track record and MSRC's response record is horrible but I am taking this report with a grain of salt. The government does need to twist MS's arm a lot in my opinion. I've done an objective comparison of cloud provider security capabilities and Azure's is the worst by a large margin, too much nickle and diming to charge customers more for security.

tiahura 2y ago

If it’s Boeing …

ChrisArchitect 2y ago

Related official report: CISA Releases Report on Microsoft Online Exchange Incident from Summer 2023 https://news.ycombinator.com/item?id=39922066 https://news.ycombinator.com/item?id=39922066

kjellsbells 2y ago

There are still things that feel murky from reading the CISA report. For example, it notes that Microsoft do not know for certain how the attacker got in in the first place, but they and the government suspect (see 1.2.4 of the CISA report) it was a compromise of a laptop owned by an employee of Affirmed Networks, who Microsoft bought in 2021. Are they saying, then, that the attacker was in their network for two years? Or that the attacker was someone able to leap from this laptop to Microsoft's identity systems (which would be very odd, since Affirmed were not in that business, so there would have been no reason for such a laptop to be anywhere close to Azure's insides). One bright spot in the report, deserving of kudos, is that the folks at the State Department understood their monitoring tools and used them very well to uncover the anomaly that led to the discovery of this compromise.

nickburns 2y ago

https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review_of_the_Summer_2023_MEO_Intrusion_Final_508c.pdf https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review...