4 ms·
> Also looks like they're kids and don't have the hang of security According to the testimony they know enough to almost completely compromise a Azure tenant t
by mindcrash 2y ago
> Also looks like they're kids and don't have the hang of security
According to the testimony they know enough to almost completely compromise a Azure tenant to the point that a foreign actor almost, ALMOST, could gain access with high privileges with a DOGE created username/password combination without being noticed because all monitoring was disabled.
The only thing which prevented that to happen was a luckily still enabled security policy restricting access to US IPs only (!) and flagging suspicious activity.
Believe me you'll need to have to know a shit ton about how Azure security works to pull something like that off without leaving evidence. I've got quite some experience in making sure this kind of shit doesn't happen.
- goku12 2y agoSo, what would happen if they used VPNs in USA?
- mindcrash 2y agoI would have set a security policy which does not allow any kind of inbound admin related traffic from any unknown IP or device at all, including domestic IPs (and VPNs). But that's just me, I don't know what the preferences of other dev(sec)ops engineers are.
- casenmgreen 2y agoIt's straightforward to make something insecure :-) Making it secure is the hard part.
- mindcrash 2y agoYeah, but it's actually not that straightforward to successfully turn the security of a heavily hardened Azure tenant to dogshit unless you know your way around and know exactly how Azure security works and what to strip out of it. That's my point. Same applies to properly hardened AWS and GCP tenants aswell.