3 ms·

The company should have known better than to trust their IT infrastructure to Microslop. This is their own fault.

Xylakant 7mo ago
My 95% bet is that the attacker just gained access to an account with suitable privileges and then went on to use existing automation. The fact that it’s intune is largely irrelevant - I’m not aware of any safeguards that any provider would implemen. So the options here are MDM or no MDM and that’s a hard choice. No MDM means that you have to trust all people to get things as basic as FDE or a sane password policy right. No option to wipe or lock lost devices. No option to unlock devices where people forgot their password. Using an MDM means having a privileged attack vector into all machines.
- neo_doom 7mo ago
  No MDM just isn’t an option for most enterprises but ideally the keys to the kingdom are properly secured.
  - mulmen 7mo ago
    How does that look exactly? Someone has to be able to use MDM to manage devices or there’s no point in having it. This scenario is firmly in rubber hose/crescent wrench cryptanalysis territory. Can updates have delays with approval gates built in? Does MDM need a break glass capability?
    - heraldgeezer 7mo ago
      "Principle of least privilege" as MS calls it. Do not use global admin or admin account as daily driver for one. Dont save it in browser etc either. Limit roles, even within the application, here Intune. Office 365 also has conditional access and many policy leavers to tweak, many cases of people locking themselves OUT of 365. So the gates work but you need to configure them. "Break glass" global admin accounts now also require MFA. https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication?tabs=dotnet https://learn.microsoft.com/en-us/entra/identity/authenticat...
      - mulmen 7mo ago
        Ok and who has access to the global admin and how resistant are they to Iranian operatives?
        heraldgeezer 7mo ago
        What are you asking? For Stryker specifically? We don't and probably won't know details. For companies in general? Background checks, security clearance etc are done if the company determines this necessary and are willing to pay for the process and higher salary.
        mulmen 7mo ago
        I’m asking if it’s possible to secure the MDM process in a way that Iranian operatives can’t simply torture an administrator into pushing the big red MDM button.
        butlike 7mo ago
        https://xkcd.com/538/ https://xkcd.com/538/
        mulmen 7mo ago
        Yes I made this reference upthread.
      - pixl97 7mo ago
        At the end of the day someone needs remote wipers privs, and in a large company it's something done pretty often.
heraldgeezer 7mo ago
[flagged]
- JonChesterfield 7mo ago
  Well, all the machines in the current outfit are Linux as far as I know. Services are self hosted. Seems to be fine, teams et al run adequately in a browser for talking to people on other stacks. Previous place had a corporate controlled windows laptop that made a very poor thin client for accessing dev machines. One before that had a somewhat centrally managed macbook that made a very poor thin client for accessing dev machines. You don't have to soul bond to Microsoft to get things done.
  - Ekaros 7mo ago
    I don't see how Linux would prevent anything if company wants similar controls on their machines. Like tracking update status, forcing updates when needed, potentially wiping entire device when stolen and so on. Fault really is not the OS but the control corporate wants over their devices. And it does make some sense.
    - pjc50 7mo ago
      Indeed. You'd expect a corporate IT system to be able to ssh as root into all their devices. And the cloud is even worse: if you get hold of the right IAM role, you can simply delete everything! That does usually get locked behind proper 2FA, but it's not impossible to phish even experienced admins once in a while.
      - namibj 7mo ago
        Compare to the Facebook global BGP breakage and the amount of hands-on authorization that needed to happen to recover. And no, there are plenty systems you don't want to have root ssh on. Mainframes require 4-eyes administration to do more nuanced "root" things than picking up a sledgehammer and physically smashing drives.
  - 7mo ago

My 95% bet is that the attacker just gained access to an account with suitable privileges and then went on to use existing automation. The fact that it’s intune is largely irrelevant - I’m not aware of any safeguards that any provider would implemen. So the options here are MDM or no MDM and that’s a hard choice. No MDM means that you have to trust all people to get things as basic as FDE or a sane password policy right. No option to wipe or lock lost devices. No option to unlock devices where people forgot their password. Using an MDM means having a privileged attack vector into all machines.

neo_doom 7mo ago
No MDM just isn’t an option for most enterprises but ideally the keys to the kingdom are properly secured.
- mulmen 7mo ago
  How does that look exactly? Someone has to be able to use MDM to manage devices or there’s no point in having it. This scenario is firmly in rubber hose/crescent wrench cryptanalysis territory. Can updates have delays with approval gates built in? Does MDM need a break glass capability?
  - heraldgeezer 7mo ago
    "Principle of least privilege" as MS calls it. Do not use global admin or admin account as daily driver for one. Dont save it in browser etc either. Limit roles, even within the application, here Intune. Office 365 also has conditional access and many policy leavers to tweak, many cases of people locking themselves OUT of 365. So the gates work but you need to configure them. "Break glass" global admin accounts now also require MFA. https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication?tabs=dotnet https://learn.microsoft.com/en-us/entra/identity/authenticat...
    - mulmen 7mo ago
      Ok and who has access to the global admin and how resistant are they to Iranian operatives?
      - heraldgeezer 7mo ago
        What are you asking? For Stryker specifically? We don't and probably won't know details. For companies in general? Background checks, security clearance etc are done if the company determines this necessary and are willing to pay for the process and higher salary.
        mulmen 7mo ago
        I’m asking if it’s possible to secure the MDM process in a way that Iranian operatives can’t simply torture an administrator into pushing the big red MDM button.
        butlike 7mo ago
        https://xkcd.com/538/ https://xkcd.com/538/
        mulmen 7mo ago
        Yes I made this reference upthread.
    - pixl97 7mo ago
      At the end of the day someone needs remote wipers privs, and in a large company it's something done pretty often.

heraldgeezer 7mo ago

[flagged]

JonChesterfield 7mo ago
Well, all the machines in the current outfit are Linux as far as I know. Services are self hosted. Seems to be fine, teams et al run adequately in a browser for talking to people on other stacks. Previous place had a corporate controlled windows laptop that made a very poor thin client for accessing dev machines. One before that had a somewhat centrally managed macbook that made a very poor thin client for accessing dev machines. You don't have to soul bond to Microsoft to get things done.
- Ekaros 7mo ago
  I don't see how Linux would prevent anything if company wants similar controls on their machines. Like tracking update status, forcing updates when needed, potentially wiping entire device when stolen and so on. Fault really is not the OS but the control corporate wants over their devices. And it does make some sense.
  - pjc50 7mo ago
    Indeed. You'd expect a corporate IT system to be able to ssh as root into all their devices. And the cloud is even worse: if you get hold of the right IAM role, you can simply delete everything! That does usually get locked behind proper 2FA, but it's not impossible to phish even experienced admins once in a while.
    - namibj 7mo ago
      Compare to the Facebook global BGP breakage and the amount of hands-on authorization that needed to happen to recover. And no, there are plenty systems you don't want to have root ssh on. Mainframes require 4-eyes administration to do more nuanced "root" things than picking up a sledgehammer and physically smashing drives.
- 7mo ago