What Microsoft's latest email breach says about this IT security heavyweight For most organizations – especially security vendors – disclosing a corporate email breach, in which executives' internal messages and attachments were stolen, would noticeably ding their stock prices. But Microsoft apparently doesn't operate by the laws of Wall Street. Late Friday afternoon, Redmond revealed that Russia's …
So [a] there was a redundant account left active, and [b] there was no password retry lockout in place. Just about the most basic laxity imaginable. And these guys profess to (obligatorily these days via enforced updates) manage our security?
With connectivity to bridge the non-production test systems to the production systems because segmenting networks is so hard.
And where they somehow got hold of a private key? That means the people with that key can publish software as Microsoft and nobody will be the wiser!
We are to believe that the hackers went from a legacy test system to accessing the email accounts of top executives and security employees at Microsoft, plus also accessing customer accounts - check the HPE news. Somebody needs to explain how is that possible? Did the test system have a direct connection and trust relationship with the production system? Did the hackers gain SysAdmin access to the test system through a password spray attack? That is like a bank leaving the door of an office unlocked overnight, without security, and then also leaving a pile of cash in a plastic bag under a desk. It is more than carelessness; it would look like either supreme stupidity or an inside job... Never underestimate the amount of stupidity in the world, though.
It means they could have done that, until the key was revoked. Which in practice probably means they could only do it once.
It would be interesting to know what, if anything, they used that power to do.
Meyers then talks about applications (eg Powerpoint).
Microsoft seems to approach security just as it does testing of software updates: toss it over the wall and let customers do the QA for them.
This approach is bad enough for updates but criminal for security.
The thing the Teams and Outlook are not just "new functionality", it's a full blown "rewrite as a Windows Store app, remove some functionality, remove a load of power user functions, break a few bits and pieces along the way and make the interface less professional and more Fisher Price"
Tried "New" Teams when it first came out. Had to go back to the "Old" Teams because if anyone started their camera or tried to share their screen it resulted in a black screen or frozen image on the screen.
Ok.. fair enough...it's still not really GA, so rolled back.
Then a shortish time later I was forced onto it.
About the only plus at that point was that the black/frozen screen seemed to have been fixed.
But synchronising statuses is right out of the window. I have it showing me/others out of office when the status is actually available. But of course, others will see available. Or maybe not. It's random.
Teams is an abomination. Updated outside of Office with little to no controls. Trying to do far too many things. Skype for Business did communications and tended to do it well. All they needed to do was add some form of persistent chat and it would be absolutely fine. But oh no...let's fuck around with OneDrive and SharePoint integrations and make a dogs dinner out of it.
"This approach is bad enough for updates but criminal for security"
The reality is that updates and security are inseparable unless we just don't give a damn. But, fundamentally, so is code quality to start with. If security were taken seriously at dev time, we wouldn't need so many darned 'updates'.
"...The reality is that updates and security are inseparable unless we just don't give a damn. But, fundamentally, so is code quality to start with. If security were taken seriously at dev time, we wouldn't need so many darned 'updates'..."
I think that is only partly fair - some of the exploits we see are incredibly clever.
Where it is more than fair though is when we see the same kind of exploit being used over and over and over again.
Hmm, that is subject to discussion. You let a test ID get password spammed. That's a service, is it not ?
Because if there was no human who mistakenly clicked a link, then it's your products or procedures that are at fault.
And we all remember Borkzilla's zeal at renewing its own domain names, right ?
I hope there will be a bit more fallout on this, but hey, Windows is unavoidable, so . . .
They mention that an account was used to access a test tenant. This suggests the system was hosted on the cloud. This makes it difficult to totally isolate the system from the Internet, but they should have put things like IP restrictions, and account lockouts on the system. At least MFA..
When will people stop being surprised Microsoft is this inept? Have we not seen almost 30 years of security ineptitude from them from the operating system to things like internet explorer as the best malware delivery engine of all time? If anyone gets into your network, it's 99% of the time going to be via a windows box, active directory, or crappy 3rd party application built for them.
These reports going public are now only since they "have to" report these sorts of breaches, as they can't trust their secret won't be leaked by the instigating hacking crew to shame them and put them in a compliance situation. They will however downplay the severity as much as they can to placate the user base back to blissful ignorance, and hide any unnecessarily embarrassing details.
Just imagine how often this has happened over the past 30 years they haven't told you about publicly since ransomware and exfiltration has become more common that they have to?
From the article:
Once, such a privacy breach might be enough to sink a software maker – or at the very least render its name synonymous with a cyber intrusion. But Microsoft seemingly remains immune.
Not really, Everyone on the face of the planet (some dolts in Congress notwithstanding) knows that Micros~1 is to security as fish is to bicycle.1 It's not that Micros~1 is immune, but rather that those that would react are so inured to their utter lack of security prowess, that this is just another case of "same shit, different day" for them.
1 Yeah, I know I used this in a recent previous post, but it fit here, too. Reuse is a thing, innit?
The horrifying thing here is how a compromise of a non-product test tenant account can turn into access to "senior leadership" accounts in Microsoft's own tenancy. The best case (which is still fairly damning) is that this "test tenant" was testing some sort of internal super-partner access for licence auditing or something similar. Unforgivable that it was not on MFA and left open after it was no longer needed.
There is that, but also, many corporations' investment portfolios have MS stock in the mix so of course, what is mandated as employee kit?
Nope, no conflict of interest there!
(no I don't see the logic in it either, but nobody ever accused the psychopathic, inbred* money grubbing boards of directors of being logical, now have they? Uber scooters anyone?)
s
((*many director members are also members of other boards of directors))
Microsoft is aware that a large quantity of e-mails were stolen from leadership team, cybersecurity, and legal employees in a breach. This is a serious incident and work has already begun to prevent this from happening again. Surviving of Midnight Blizzard who read through these e-mails are being offered counselling for the trauma, depression, and overwhelming despair now afflicting them. Sincerest condolences go out to these hackers, their friends, and their families who suffered losses as a result of being exposed to this breach.
it can't be helped
"It is inexcusable that Microsoft still hasn't required multi-factor authentication, which is cybersecurity 101 and would have prevented this latest attack," Wyden told The Register.
You might have accounts 3rd party apps require that don't support MFA. Nothing can be done. You can't just stop using the 3rd party app, the execs paid for it to be put in. You might also have stuff that struggle to understand new tech with no training budget to change this.
Its not always easy. Its always easy for someone in Congress to comment though.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
