[HN Gopher] Microsoft lost its keys, and the government got hacked
___________________________________________________________________
Microsoft lost its keys, and the government got hacked
Author : tim_sw
Score : 260 points
Date : 2023-07-18 10:30 UTC (12 hours ago)
(HTM) web link (techcrunch.com)
(TXT) w3m dump (techcrunch.com)
| Incipient wrote:
| What's with all this fairly overt state sponsored hacking and
| everyone going "aww shucks" and moving on quietly?
| mikrotikker wrote:
| War with China already started in the cyber space. In fact its
| probably the pre war intelligence gathering and backdoor
| installations
| dgoodell wrote:
| I work for NASA. Our budget is like $25B. We're definitely
| inefficient and wasteful, but we still do a lot of new things.
| Just not nearly as much as we could.
|
| Microsoft's operating budget was like $123B last year. There are
| bugs in office products that have been there for years
|
| What exactly are they doing with all that money?
| sundarurfriend wrote:
| Funding the current AI revolution, for example?
|
| https://techcrunch.com/2019/07/22/microsoft-invests-1-billio...
| https://techcrunch.com/2023/01/23/microsoft-invests-billions...
| https://www.reuters.com/technology/microsoft-talks-invest-10...
| diarrhea wrote:
| [flagged]
| jdm2212 wrote:
| [flagged]
| notjoemama wrote:
| Ah, no, but point taken. I can't think of an example myself
| because I don't know how Nasa functions.
|
| Besides that, I think the valid critique (without the
| subtext) is, it's probably not a good comparison to measure a
| very large companies failings to a much smaller companies
| failings because their size is a definitively weighted factor
| in the outcome.
|
| The caveat that I would add, is Nasa is publicly funded and
| it's probably ok to ask the question in the public interest.
| For private companies like Microsoft, just stop buying their
| products.
| oskarw85 wrote:
| "Just stop buying their products" is silly answer when
| those products are epitome of corporate IT offerings.
| Especially where people doing "the buying" are completely
| different than people doing the support.
|
| On the contrary - criticism should be loud, clear and
| persistent. Being private company does not make you immune
| to criticism.
| mistrial9 wrote:
| you the user are not the customer, management and legal are the
| customer. You the user, are last, and least, in the priorities.
| krono wrote:
| Based on my own dealings with Microsoft from such a
| management role over the years:
|
| The only customer Microsoft seems to care about or is really
| even cognizant of its responsibilities towards, is Microsoft
| itself. Every single one of its products and services exists
| solely because and only for as long as some division of
| Microsoft believes it requires those specific things and
| whatever they're meant to evolve into over time, in order to
| manage its increasingly complex and ever expanding internal
| operations.
|
| It's like a snake eating its own tail.
| JamesonNetworks wrote:
| Seems like they are assuming the same key was used to forge
| tokens and jump from that assumption to the conclusion that they
| found all instances of requests. If more keys were used to
| generate more tokens, isn't it possible this attack had a much
| wider surface area?
| breadwinner wrote:
| As a rule of thumb, hacks are _always_ worse than initially
| thought. See
| https://circles.page/5680a56b5c28af0998656e09/Hacks-worse-th...
| jamesjuicy55 wrote:
| Absolutely. Maybe Louisiana and Oregon DMV hacks?
| amai wrote:
| What do you expect? Microsoft is a gaming company. They don't
| care about security.
| 666satanhimself wrote:
| [dead]
| 2OEH8eoCRo0 wrote:
| > Microsoft still doesn't know -- or want to share -- how China-
| backed hackers stole a key that allowed them to stealthily break
| into dozens of email inboxes, including those belonging to
| several federal government agencies.
| dralley wrote:
| Speculation: insider threat
| 2OEH8eoCRo0 wrote:
| That would be my amateur guess as well which scares me in a
| couple of ways.
| Zelphyr wrote:
| I hate to go negative. I really do because, usually it doesn't
| improve the discourse whatsoever.
|
| However, I feel like it needs to be said: Microsoft makes bad
| products[1]! They're overpriced, insecure, slow (it's astounding
| to me how slow their web properties are), and hard to use. Easily
| some of the worst UI I've ever seen and, what's worse, they've
| been like that my entire career. They keep slapping lipstick on
| the same pigs and claiming to have reinvented themselves.
|
| Their support is so ungodly bad that it literally took one of
| their reps over a day to figure out what timezone I'm in.
| Meanwhile, two of my employees' emails were being randomly CC'd
| to the CEO for no apparent reason. The cause? Nobody knows. It
| just stopped happening. Even Microsoft couldn't tell me why it
| happened.
|
| With a $2.5 trillion market cap, it may seem like they're killing
| it but, I really think they're riding on momentum just like IBM
| did. Twenty years ago, IBM's market cap was double what is is now
| and, in my experience, their products are every bit as bad
| (admittedly, I have almost no exposure to their big iron
| products).
|
| So, what are our alternatives? I know many people who don't like
| Apple for various reasons. Linux on the desktop has been promised
| for 20 years. It's closer than it has ever been to being a solid
| replacement but I don't know that it's quite there yet.
|
| It saddens me to say, I don't know what the answer is. I just
| know that we need to get away from Microsoft products and fast.
|
| 1: In my experience, the only two exceptions are VS Code and SQL
| Server.
| orangepurple wrote:
| Linux on the desktop is here. Go all-in on KDE. Everything is
| seamless and just works.
| ElectricalUnion wrote:
| The only Linux desktop environment that I found that looks
| and feels integrated and polished is Gnome, but that is
| because it's a slow as molasses, corporate focused and dumbed
| down copycat of the other mainstream OSes.
| azinman2 wrote:
| This has nothing to do with large scale enterprise email
| security.
| sudosysgen wrote:
| It does. Outlook is where it is for email because of
| Windows.
| mceachen wrote:
| > seamless and just works
|
| Just say "better." Gnome and KDE are decidedly not perfect,
| but they are both quite usable even by casual windows-only
| non-techies.
|
| FWIW I've been using Linux as my primary desktop OS for more
| than 20 years--it does no one any good to oversell it.
| Touchpad scrolling rate is still broken on Gnome/Firefox.
| Angels have to sing (or use xorg) to make s3 suspend work.
| Fedora auto-update can break if there's "too many" packages
| to update. Touchpad scrolling can be misinterpreted as swipe-
| left or swipe-right by KDE on some hardware.
|
| The point is, if you bang against any of these sorts of
| issues in Windows, you're frequently stymied. On Linux, you
| can either fix it, or at least route around the damage with
| an alternative.
| naikrovek wrote:
| > Everything is seamless and just works.
|
| I have zero confidence in that testimonial, given my own
| experience with open source desktop environments, and KDE.
| zero confidence whatsoever.
| mikrotikker wrote:
| I'm 12 years into Linux on the desktop. It's amazing.
| Converted my non computer friend to it. My partner freaked
| when windows 10 tried to install itself years ago, and she
| switched. I play triple A games on it via steam. Our TV PC
| runs it.
|
| The experience is so much better I really don't get this
| mentality.
| ElectricalUnion wrote:
| If you really think about it from the point of view of
| defaults, Windows is a even worse mess.
|
| * You often _need_ to do non-standard system tweaks to get
| the system in a working state. It 's everything-
| doesn't-work-by-default.
|
| * You often _need_ to install /prevent instalation of bad
| quality drivers and associated bundleware to make devices
| work.
|
| * Microsoft can't decide what UI framework they will
| support (or drop support) so built-in applications happens
| to be built with the current "thing", the old ones staying
| on the older unsupported frameworks.
|
| * You _need_ to constantly tweak a combination of Windows
| 3.11 control applets, Windows 95 control panel applets,
| Windows 7 unified control panel glass, and Metro Settings
| Universal Windows Platform app to keep things working.
|
| * Microsoft can't decide what random widgets go on the
| taskbar, or the file manager, or your start menu, so it's
| always disrupting things every few updates.
|
| It is arriving at a point where the only "consistent" UI
| thing in Windows is Steam, and Steam isn't built-in, and is
| a hot mess of inconsistent UI itself.
| o1y32 wrote:
| None of the comments here seem to address desktop OS in
| enterprise/government environment, which is what this article
| about. Linux desktop OS your personal computer? Sure. In an
| organization where most users are not technical, and where
| vendors do not release their software? Good luck.
| kingrazor wrote:
| My experiences with Linux have been anything but seamless.
| yoyohello13 wrote:
| Similar to my experience with Windows TBH.
| formerly_proven wrote:
| > However, I feel like it needs to be said: Microsoft makes bad
| products[1]! They're overpriced, insecure, slow (it's
| astounding to me how slow their web properties are), and hard
| to use. Easily some of the worst UI I've ever seen and, what's
| worse, they've been like that my entire career. They keep
| slapping lipstick on the same pigs and claiming to have
| reinvented themselves.
|
| Some think tank should make an analysis how many billions of
| dollars are lost in productivity across the globe if you
| compare the current MS Office stuff to an alternate of "the
| Windows 2000-era stuff, but with security patches" or "the FOSS
| office stack, with more money behind it".
|
| Anyone wanna estimate how many digits that number has?
|
| (Teams, while being ungodly slow, at least has the value
| proposition of being an integrated product - persistent chat,
| file sharing and voice / video calls - that really didn't exist
| in 2000)
| naikrovek wrote:
| what does this have to do with the article, though? You just
| had a rant ready for when you saw a Microsoft-is-at-fault story
| came up?
| MrDresden wrote:
| After spending 5 years of corporate work having to wrestle with
| Azure (in a ci/cd capacity) I would never recommend Microsoft's
| cloud offerings to anyone.
|
| Problem is that there is no other provider I would rather
| recommend. They are all bad in one way or another.
| mschuster91 wrote:
| AWS is pretty decent in my experience, and when managed with
| Terraform (which is all but a requirement if you don't want
| to go completely b0nkers) it's a breeze to manage.
| tracker1 wrote:
| And this is one place where I think Azure does better... I
| mean, the UI/UX sucks, but at least you _can_ do everything
| in the UI without loosing too many brain cells. Google and
| AWS seem to require automation tooling to make sense, which
| IMO makes all of it harder to learn in practice. I tend to
| like learning some of those things visually first, then
| automate out of necessity as opposed to the other way
| around.
|
| Not that I'm tethered to Azure... I've used a combination
| of dedicated server, DigitalOcean and Cloudflare for my
| personal stuff... though just started delving into the
| Cloudflare (edge compute) stuff.
|
| There are definitely ups and downs to them all.
| psadauskas wrote:
| I'm not sure I agree completely. When I was learning
| Terraform, trying to figure out what the options a
| resource had and some of the possible values, I'd make
| the change in the AWS UI, then re-run Terraform to see
| what it wanted to change back. There weren't a whole lot
| of things in aWS that didn't have a UI to configure
| _somewhere_.
| badrabbit wrote:
| The big red issue with MS is they elaborately make it very
| difficult to integrate outside their ecosystem and they love
| holding customers hostage to ridiculous restrictions, but
| also Azure is very difficult to centrally manage things for
| all subscriptions. Others are as well but not as much. I
| actually like the azure UI and CLI as well as many if their
| offerings, but it's so difficult to piece together a bigger
| picture or make small changes without doing a ton of work and
| more MS products being involved.
|
| Also,unrelated: Azure AD is now "Entra ID" (????) now lol.
| lostmsu wrote:
| Yeah, that Entra ID was the biggest "why?" moment I had in
| years. Seeing the new name no better or even worse than the
| old one I can already imagine the pain of renaming
| packages, namespaces, fixing documentation etc. Probably
| the most expensive marketing campaign with 0 gain I am
| aware of.
| Spooky23 wrote:
| That's easy and makes sense.
|
| Azure AD was initially a shim to enable O365. Now it's
| evolved into a pretty awesome identity platform for
| Enterprise and B2C.
|
| The problem is M365 adoption (ie O365 + the other crap)
| is high. So they are out of stuff to sell. Entra will add
| the governance and compliance bullshit and increase
| revenue.
|
| End of the day, Microsoft chisels $38-55/head for every
| corporate worker. Services are all about cash flow, so
| they are looking to grow that up to $100 user/month.
| Every $1 of subscription spend is like $400 on the
| scorecard for the bonuses of SVP staff.
|
| Because of anti-trust, they can't just do what Adobe does
| and raise the price every few months. They just keep
| adding services and move stuff around in the bundles.
| M365 Plus+ E9 with Entra technology will give you $350 in
| value for only $103/month!
| ourmandave wrote:
| Entra ID. As someone trying to get up to speed on Azure AD,
| suddenly all the recent tutorials I've watched are out of
| date. Very frustrating.
|
| Same story when they moved to MSAL a few years ago.
| flopriore wrote:
| "Problem is that there is no other provider I would rather
| recommend. They are all bad in one way or another."
|
| Could you explain a little further what you don't like about
| Azure and why you would still recommend it over the
| competitors?
| jiggawatts wrote:
| Not the OP, but: it's just sloppy. There is zero QA other
| than end-users bitching.
|
| I recently collected some notes of bugs and errors for an
| MS rep. I was setting up _just_ a .NET web app with a SQL
| back end, as simple and vanilla as it gets.
|
| I found 60 bugs.
|
| SIXTY!!!
| GordonS wrote:
| As a counterpoint:
|
| I've worked with both Azure cloud and Azure DevOps (or
| whatever the feck they call it now) for a long time (maybe 10
| years?), a lot in a corporate setting, but also for my
| startup.
|
| Apart from the same price issues that exist across all the
| big 3 cloud providers, I actually really like Azure.
| jiggawatts wrote:
| I love the conceptual framework and high level architecture
| of Azure: Resource Manager, sane naming compared to AWS,
| etc...
|
| What I hate is the unfathomably sloppy implementation that
| their developers refuse to fix unless held at gun point.
|
| You literally have to have an MS account manager about to
| miss out on millions of dollars to force a trivial fix
| through their pipeline.
|
| They have zero "customer obsession."
| whynotkeithberg wrote:
| I like the Azure bash cli... That's about the only thing I
| like from Azure.
| Jochim wrote:
| I moved from Azure to AWS.
|
| App Insights, DevOps pipelines, and WebApp slots look like
| future tech when compared to codepipelines and x-ray.
|
| DevOps in particular feels so close to being a really great
| tool. Not having to jump between 8 different UIs to deploy
| something is magical. If only they'd polish the rough bits
| and invest a bit more into it.
| silverbax88 wrote:
| We use DevOps for pipelines, but AWS for our prod cloud
| environment.
| Jochim wrote:
| I'm hoping to push us that way, some hurdles with getting
| buy in from the whole team though.
|
| That's why I wish DevOps made it a really clear cut
| choice. There's some really low hanging fruit and silly
| decisions that spoil the initial impression:
|
| YAML pipelines have been the "official" option for at
| least 4 years now but when I create a new project, every
| issue has a "deployments" section that tells me it only
| supports classic releases. Classic pipelines/releases can
| now be disabled at the project level at least.
|
| They're introducing a new widget that shows open pull
| requests across repositories but for an absolutely insane
| reason it's limited to 10 repositories, just why...
|
| Environments still have no support for resources other
| than VMs and AKS.
|
| The mandatory "sprints" backlog is just stupid as well.
| It's a clear artificial limitation rather than one
| necessitated by the platform.
|
| Another issue is that Microsoft have done a poor job at
| communicating the potential longevity of the platform.
| The Github acquisition is the first thing that gets
| mentioned when DevOps is brought up as an option, which
| is a shame because DevOps feels much more
| capable/cohesive/advanced than GitHub.
|
| Despite these problems it's still been the tool with the
| absolute least friction and most potential when it comes
| to organised development work. The alternatives I've used
| come nowhere close.
| azinman2 wrote:
| I'd go with Gmail...
| genmud wrote:
| Their pricing has become bonkers over the last few years.
| Most people in traditional businesses need o365 for
| word/excel/powerpoint, and you effectively get email for
| free, so for many companies its a no brainer.
| azinman2 wrote:
| Until this happens
| navigate8310 wrote:
| > So, what are our alternatives? I know many people who don't
| like Apple for various reasons. Linux on the desktop has been
| promised for 20 years. It's closer than it has ever been to
| being a solid replacement but I don't know that it's quite
| there yet.
|
| When most people hear the word "Microsoft," their initial
| thoughts typically revolve around Windows and, at most, Office.
| However, it is important to note that a significant portion of
| Microsoft's profits actually comes from their Dynamics 365
| offerings.
| mschuster91 wrote:
| > With a $2.5 trillion market cap, it may seem like they're
| killing it but, I really think they're riding on momentum just
| like IBM did. Twenty years ago, IBM's market cap was double
| what is is now and, in my experience, their products are every
| bit as bad (admittedly, I have almost no exposure to their big
| iron products).
|
| People are only not shitting on IBM so much anymore because
| they sold off Lotus Notes...
| fatfingerd wrote:
| I don't see Lotus Notes as all that different than other
| Offices products developed by big Tech. I think it would be
| similar to Google's business platform with some more legacy
| automation but not unlike SalesForce or ServiceNow.
|
| Having used Microsoft recently, after Google for work, I'm
| absolutely flabbergasted at how terrible Word, Teams,
| Outlook, etc are. I would describe the average Microsoft
| product as a zombie in its own feature set, at war with a
| different version of itself, and attempting to steal organs
| from other products to try to transition to every possible
| entirely different role in the suite.
|
| Attempting to use a Microsoft product is like watching
| developers capitulate to some kind of bizarre internal
| political war between Product managers.
| yoyohello13 wrote:
| It's even more hilarious because Microsoft are always loudly
| exclaiming telemetry is necessary for software improvement but
| based on how buggy and terrible most of their software is
| telemetry doesn't seem to be helping.
| giancarlostoro wrote:
| > It saddens me to say, I don't know what the answer is.
|
| I think the answer is a company willing to put in the work to
| force GPU manufacturers to provide high quality hardware
| drivers for a commercial Linux Distro. I mean all out
| partnership with the various vendors. Then sell prebuilts,
| maybe someone like System76 has come close, or has the capacity
| to do so. The Linux issues for me always seem to be hardware
| specific. Then its just making sure whatever the default DE is,
| has enough necessary polish.
| taeric wrote:
| I'm curious on the non-sequitur to GPU stuff? At large,
| running machine learning code has been easily doable in linux
| for a long time. Frustratingly hard, yes, but no harder than
| in Windows. Often more repeatable and cheaper to fan out to a
| fleet of machines, to boot.
|
| Is there another aim of GPU that I'm ignoring?
|
| Microsoft makes fine enterprise software, sadly. To know and
| believe that, though, you have to see what the alternatives
| are in the enterprise world. It is atrociously bad.
|
| I do think Chromebooks are an interesting use case showing
| you don't need massive software. Schools have taken to those
| very well and are almost certainly competing with most
| enterprises for number of users and use cases.
| marcosdumay wrote:
| > Microsoft makes fine enterprise software, sadly.
|
| Hum, no they don't. They make shit and use anti-competitive
| practices to push every other offering out of the market.
|
| The fact that you only see experimental alternatives
| without the maturity to get any polish is caused by them
| destroying the competition, not the reason they won.
| taeric wrote:
| I meant that as a purely "backhanded compliment." The bar
| is rather low in enterprise software.
|
| That said, fully fair that, even in the field, they
| probably rely more on bad practices to shoulder out
| competition than I'm crediting.
| bun_at_work wrote:
| I think it's because of game development. Many devs target
| Windows for DirectX, since it's easier and cheaper to
| target one platform, and Windows dominates desktops, so you
| won't get gamers to migrate without that support.
|
| There are various ways to get Windows games working on
| Linux or Mac, but they aren't out of the box, which is
| significant enough to prevent wide scale adoption.
| taeric wrote:
| Steam has done an amazing job at attacking this. Though,
| large studios don't target linux largely because they
| have very little financial incentive to do so.
|
| And it is more than installed userbase, which is very
| real. For the major distribution targets, the devkits
| have a ton of resources poured into them that major
| studios can't ignore.
|
| That said, still feels like a non-sequitur? I can't
| imagine "gaming as a target" is a concern for cloud
| customers. Certainly not the government?
| mistrial9 wrote:
| people making massive income from the system exactly the way
| it is, do not care about doing this
| _a_a_a_ wrote:
| MS SQL dev here, and I disagree because it's been going
| downhill in terms of code quality and especially documentation
| for a long while. Absolutely classic example why
| https://www.mssqltips.com/sqlservertip/3074/use-caution-with...
| but there are others
| mozman wrote:
| I have always believed that MS products are designed in a way
| to maximize the value of commercial support, certificates, etc.
|
| It's walled garden for lack of a better time and solving
| problems easily and quickly dilutes the value of MSCE and the
| army of paid consultants that exist.
|
| It is a completely different universe from Linux
| Zelphyr wrote:
| I've had to get their certifications. They're just as much
| garbage as the rest of their offerings. The courses they
| provide are nothing but marketing material. They don't
| improve your understanding of the products at all.
|
| I found out later that they use their certs as filters for
| resellers to help Microsoft identify which ones are serious
| players. What a waste of time and money.
| traceroute66 wrote:
| > I found out later that they use their certs as filters
| for resellers to help Microsoft identify which ones are
| serious players.
|
| If I understand what you are saying correctly, this is not
| exactly true.
|
| The IT industry is a box-shifting industry, and therefore
| Microsoft, like all other vendors, differentiate their
| resellers primarily on dollar-volume.
|
| So the _REAL_ reason a Microsoft reseller is Gold is
| primarily because they have shifted more product than other
| resellers on lower tiers.
|
| Sure, to actually get the Gold badge, you need to have X
| sales-reps who've passed the course and Y technicians
| who've passed that course. But bodies-with-certs are by
| comparison a very minor secondary criteria.
|
| The key criteria is always that your company has sold
| $big_number per year. Your entire organisation can be
| hiring exclusively Microsoft certified people, but you
| ain't getting the badge unless you're shifting the product
| no matter how many certified people you have on staff.
|
| And that is why Gold certified is meaningless. Because all
| it tells me as a customer is you've got good sales-reps on
| team.
| nubinetwork wrote:
| https://news.ycombinator.com/item?id=36690598
| https://news.ycombinator.com/item?id=36692494
| https://news.ycombinator.com/item?id=36693121
| https://news.ycombinator.com/item?id=36693469
| https://news.ycombinator.com/item?id=36694188
| https://news.ycombinator.com/item?id=36696413
| https://news.ycombinator.com/item?id=36696852
| https://news.ycombinator.com/item?id=36697272
| https://news.ycombinator.com/item?id=36699844
| https://news.ycombinator.com/item?id=36704776
| https://news.ycombinator.com/item?id=36705671
| https://news.ycombinator.com/item?id=36708294
| https://news.ycombinator.com/item?id=36713560
| https://news.ycombinator.com/item?id=36716028
| https://news.ycombinator.com/item?id=36719412
| https://news.ycombinator.com/item?id=36722538
| https://news.ycombinator.com/item?id=36731110
| https://news.ycombinator.com/item?id=36731308
| https://news.ycombinator.com/item?id=36731731
| https://news.ycombinator.com/item?id=36736306
| https://news.ycombinator.com/item?id=36740133
| https://news.ycombinator.com/item?id=36757016
| https://news.ycombinator.com/item?id=36757512
| https://news.ycombinator.com/item?id=36759808
| https://news.ycombinator.com/item?id=36759865
| michaelteter wrote:
| Perhaps preceding your list of related links you could state
| that the following is a list of (recent?) related HN
| submissions.
| sysop073 wrote:
| You thought perhaps they commented a list of random unrelated
| HN submissions?
| michaelteter wrote:
| The links are all just
| https://news.ycombinator.com/item?id=########. It's obvious
| they refer to some content on HN, but it could be comments,
| replies to comments, etc.
|
| By adding a small bit of human text, the human doesn't have
| to ponder the list and wonder what they will get if they
| click a link.
|
| And if there were human text, someone arriving by way of
| the parent comment link would have an easy time
| understanding the context without having to scan a lot of
| characters and make assumptions.
| nubinetwork wrote:
| I'll consider it.
| bozhark wrote:
| It's implied imo
| abrookewood wrote:
| Yeah, the submission IDs are all very close.
| yladiz wrote:
| Just posting these links, some of which have no comments, is a
| bit much and not actually helpful. It would be better to do a
| little more curation and choose the most active ones.
| NVHacker wrote:
| "Use MS products and you will get hacked" is not exactly news,
| is it ?
| dmvdoug wrote:
| And yet, fascinatingly, very very little discussion. 60-ish
| comments was the most on any of those posts.
| TheRealDunkirk wrote:
| Yeah, this is really, really weird.
| [deleted]
| 2OEH8eoCRo0 wrote:
| Mentioning China negatively is the kiss of death.
| rightbyte wrote:
| I feel I can't discuss some foreign nations anymore in a
| critical way since I fear giving mentally unstable war
| mongers ideas.
| lacrimacida wrote:
| On HN? I don't see censored comments with China mentions
| and this thread has been visible yet very few comments.
| What sort of manipulation I've seen on HN is threads being
| flagged or drop from top 30 to top 240 within an hour. Im
| suspect intel agencies have some ability to tilt the scales
| here on HN.
| formerly_proven wrote:
| This really surprised me when I learned of this story on the
| weekend. Very little discussion, very little reception in IT
| news.
|
| Someone _hacked Azure AD_ [1] and accessed the data of 25+
| orgs and the reaction is *crickets*?
|
| [1] I'm not exactly sure which Azure component was hacked and
| the MS communication seems intentionally unclear and obtuse
| on this. It sounds like the private keys of Azure-internal
| auth servers were stolen, but technically those private keys
| were not supposed to work for the accounts/orgs in question,
| except they did, and, in any case, MS doesn't disclose how
| the private keys (one? multiple?) of their cloud auth servers
| were stolen.
| tgv wrote:
| There was one issue where bing search results could be
| editted for any query by random users with an AAD account,
| and made to include a script that sends the Azure
| credentials of the user that happened to use that query to
| god-knows-where. And it wasn't the only service that was
| practically open. And another great thing: there were no
| logs.
|
| That's an amazingly big, world-wide security hole, and how
| much interest did it draw? Hey, look, there's a celebrity
| scandal over there.
| coldpie wrote:
| I saw the headline scroll by on my Ars Technica feed[1] but
| I admit I didn't bother to read it because there's like 10
| major security breaches every single day. Just another one
| to add to the pile, there's more interesting things to read
| about.
|
| [1] https://arstechnica.com/security/2023/07/microsoft-
| takes-pai...
| dhx wrote:
| Microsoft has published a more technical analysis[1] which
| was submitted in two of those HN stories mentioned above
| (which received no interest).
|
| Microsoft have two identity services being MSA and AAD. MSA
| is used for consumer Microsoft accounts for use with
| products like Xbox. AAD is Azure AD that businesses use.
| When a client wants to authenticate to a Microsoft service,
| it asks MSA to sign a token for services accepting MSA
| tokens, or asks AAD to sign a token for services accepting
| AAD tokens. Someone has gained access to an "inactive" (but
| not "invalidated"/revoked) MSA signing key. It's not stated
| in the analysis whether Microsoft services such as Xbox
| would have accepted a token signed with an "inactive" MSA
| signing key, but it sounds like this may have been the
| case. It's just consumer privacy and security at stake and
| the attackers apparently weren't interested in that, so the
| analysis is rather -\\_(tsu)_/- on consumer impact.
|
| The problem for Microsoft is that they had incorrectly
| configured OWA API to accept tokens signed by the MSA
| identity services even when accessing mailboxes that should
| require an AAD signed token. So now the attacker could
| access mailboxes for all business and government users
| around the world (excluding GCC High, DoD, etc which
| Microsoft state are not exposed to public networks).
|
| Microsoft only found out after one of their diligent
| customers queried Microsoft on why they were seeing logs
| for user mailboxes being accessed in unexpected ways.
| Speculatively (not in the analysis) this may have been
| noticed as a random IP address outside of allowed subnets
| accessing mailboxes at odd hours, and the customer checked
| their AAD configuration to ensure IP subnet restrictions
| were configured correctly and verified the user was not
| overseas.
|
| The attacker looks to have been quite careless by accessing
| OWA API from very obvious red flag locations for legitimate
| users. For example, the attacker could have used a
| residential ISP subnet in Washington DC to access a GCC
| hosted mailbox of a government agency with a presence in
| Washington DC, and only done so in hours that an employee
| may be working from home in Washington DC. Or the attacker
| could have gone after soft targets like small to medium
| businesses that contract to the government, hoping these
| soft targets wouldn't be monitoring nor have the ear of
| Microsoft for prompt incident response. Instead, the
| attacker has used random dedicated hosting providers in
| places as far as Europe and accessed mailboxes during hours
| coinciding with business hours half way between the US and
| Europe. It's possible the attackers thought this attack
| would be detected quickly, and therefore were always just
| going for a hit-and-run approach knowing they'd get their
| data prior to the attack being noticed and blocked. But it
| does make the attacker look brazen at best, and
| unsophisticated and careless at worst.
|
| [1] https://www.microsoft.com/en-
| us/security/blog/2023/07/14/ana...
|
| [2] https://learn.microsoft.com/en-
| us/office365/servicedescripti...
| dhx wrote:
| As an update, the attackers were discovered by the
| customer due to mailbox access event logs showing an
| unexpected mail client to access mailbox items.[1][2] The
| attacker should have spoofed a realistic mail client.
|
| [1] https://www.cisa.gov/news-events/cybersecurity-
| advisories/aa...
|
| [2] https://learn.microsoft.com/en-
| us/office365/servicedescripti...
| predictabl3 wrote:
| Wow. It's hard to say which is worse "our internal apps
| to control 1P MS properties were marked multi-tenant and
| did no real AuthZ"... or... "we leaked an MSA signing key
| and had our token validation so f**ked that (presumably)
| any signing key was valid for any key-under-test,
| regardless of expected configuration".
|
| Just stunningly bad and would make me reconsider how much
| MSFT I hold, except that no one seems to care.
| RVuRnvbM2e wrote:
| This is not even the first time this year that Azure AD has
| been owned sideways.
|
| See this mind-blowing blog post from Wiz where they live
| edited bing.com search results, injected XSS into O365,
| accessed exabytes of internal MS file storage and more:
| https://www.wiz.io/blog/azure-active-directory-bing-
| misconfi...
|
| I have no idea how Azure maintains its reputation as a safe
| enterprise choice. Microsoft really just has an almost
| impenetrable reputation I guess?
| dmvdoug wrote:
| I mean, we're talking about key federal agencies involved
| as the impacted customer(s), too. Yet it's like, eh, next
| story.
| djbusby wrote:
| How did you even get all those so fast?
| nubinetwork wrote:
| Search box, typed in Microsoft and scrolled through a week's
| worth of submissions.
| mschuster91 wrote:
| Look at hn.algolia.com, they index pretty much everything on
| here.
| victor106 wrote:
| One of the reasons why we moved away from using Microsoft
| products for our identity management to Okta.
|
| Not that they are bad products per se, but as many organizations
| use Microsoft products they are prime targets for too many
| hackers and it's hard going to bed thinking that your identity
| info might be hacked someday and/or not knowing if it will be.
|
| The surface area that Azure/Microsoft have is just too large for
| it to assume to be protected by one company whose security as not
| been the most stellar. So we are actively moving to GCP as well.
| AtNightWeCode wrote:
| We use MS for some stuff and did use Okta for others. But...
| Okta fkd up and can never be used in any enterprise today. We
| migrated from it. Everybody should. Now we use MS and Google.
| Okta is probably the most over-priced service in history of CS
| especially considering the poor sec design. They do however
| solve the US-Franchise-Corp bs that I guess it was designed
| for.
| fsociety wrote:
| Okta is also a prime target for hackers, and likely has a
| smaller security budget than Microsoft.
| likecarter wrote:
| Okta has been hacked a couple times now...
| azemetre wrote:
| Was about to say, wasn't all their source code stolen too?
|
| https://techcrunch.com/2022/12/22/okta-breach-source-code-
| gi...
|
| Okta looked very bad during the entire saga where they kept
| denying they were hacked until the proof was insurmountable.
| Pretty sure there was a large discussion on HN at the time
| too.
| victor106 wrote:
| Agree they have shortcomings too, I guess, what I was
| trying to say is its best not to put all your eggs in one
| basket and to spread them across different
| products/companies.
| azinman2 wrote:
| So, many weak links and no one technical is responsible
| with the macro vision?
| EthanHeilman wrote:
| To toot my own companies horn[0] we designed our
| authentication protocol OpenPubkey[1] to have two signers on
| tokens:
|
| 1. The IDP signer (like microsoft or google) 2. The Cosigner
| (like bastionzero.com)
|
| ...so that even if microsoft's signing key is stolen, the
| attacker also needs to compromise the cosigner's signing key
| as well. It's like multisig for authentication tokens.
|
| I don't know if OpenPubkey would have helped in this
| particular case as the details are still coming out[2], but I
| think the future of authentication schemes must require that
| authentication tokens must be signed by multiple signers at
| different organizations; Authentication systems with single
| point of compromise signing keys is too fragile. Or put
| another way authentication via multiple independent roots of
| trust is just too powerful of a security tool not to use.
|
| [0]: BastionZero, https://bastionzero.com
|
| [1]: OpenPubkey: Augmenting OpenID Connect with User held
| Signing Keys, https://eprint.iacr.org/2023/296
|
| [2]: It appears the key stolen was an MSA key, not an Azure
| AD signing key. The MSA architecture might not fit into the
| OpenPubkey model (or it might I don't know enough about MSA
| signing keys work to say). Had it been an Azure AD signing
| key then OpenPubkey would mitigate the theft of an Azure AD
| Signing key. https://www.microsoft.com/en-
| us/security/blog/2023/07/14/ana...
| zingababba wrote:
| Interesting that it aligned with their AAD rebrand.
| jtbayly wrote:
| This headline does a good job of pointing out why we shouldn't
| allow backdoors in encryption.
| naikrovek wrote:
| no one said it was a backdoor, though. you have to have a key
| to encrypt stuff, and it was that key which got leaked,
| _somehow_. a backdoor is a way around the use of a key to see
| secret messages, or an alternate key which allows you to view
| messages without compromising the key which encrypts messages
| in normal operation.
|
| could have been a backdoor, sure, could have been something
| else. could have been carelessness. could have been blackmail.
| could have been a rogue employee. could have been malware,
| spear fishing, or any one of a hundred other things.
|
| did I miss something or are you premature in blaming this on a
| backdoor?
| [deleted]
| ketralnis wrote:
| They didn't say it was an intentional backdoor. But if it
| were, the result would be the same.
|
| It's hard to secure encryption keys. If you had a backdoor
| based on a key that you had to keep secret, leaks like these
| can happen. If Microsoft (or anyone) can't keep their
| encryption keys secure, they'd be equally unable to keep a
| backdoor key secure for the same reason.
| Spooky23 wrote:
| If Microsoft can't manage to hold onto these critical
| encryption keys, why do you think that <insert nation state
| x> will?
|
| When your data is stolen because you were working in Cancun
| and the Mexican CIA was compromised, will you ever even know?
|
| The point isn't blaming a back door, it's just pointing out
| that the more stakeholder that possess a key, the higher the
| probability of a compromise.
| thephyber wrote:
| But an encryption back door is either a second key that
| someone else holds or it is some piece of information the
| public should not know about.
|
| Either way, when the details about the back door leak, the
| system ceases to retain the properties of secure encryption.
| mikrotikker wrote:
| It's still a good example though.
| thomastjeffery wrote:
| > no one said it was a backdoor, though.
|
| That includes the comment you are replying to.
| collsni wrote:
| Isn't cloud fun?
|
| Same keys to everyone's kingdom!
| [deleted]
| yttribium wrote:
| American companies are generally forbidden by EEOC rules from
| having reasonable security precautions unless some product is
| associated with a government contract and can require full blown
| security clearances. As a result you can safely assume that any
| given department with a juicy portfolio is fully compromised by
| foreign intelligence.
| iJohnDoe wrote:
| Speculation. This type of key issuance is given to FBI and NSA
| and other partnerships Microsoft has. China hacked their way up
| to get the keys.
| pjdemers wrote:
| This sounds like an inside job.
| exabrial wrote:
| Any Windows product/system is a liability. I'm not sure how to
| put this lightly. It was designed to create a monopoly first
| before any other goal.
|
| And it's not that the alternatives are perfect, but Windows is as
| secure as swiss cheese.
| TheRealDunkirk wrote:
| I know this is a bit of a thread jack, but this same attitude
| now playing out on Xbox in the console space. The recent FTC
| attempt to block the Activision merger surfaced emails saying
| that they were just going to outspend Sony to further
| consolidate and buy a higher position in the market, because
| they can.
|
| There's nothing in any of Microsoft's revealed communications
| over the years where they ever seem to aspire to make better
| products. I mean, sure, obviously, there are pockets inside the
| company, but that has never seemed to be the purview of the
| board or the executives. If there's a thought leader in there
| somewhere who had passion to make great products like Jobs, I
| can't think of who it would be.
|
| I almost feel bad for Microsoft, and I say this as a Microsoft-
| hater and Linux zealot who ran it on the desktop for 19 years
| before switching to Mac. It's the legacy backward-compatibility
| that makes Windows so attractive to a lot of organizations
| which makes it so vulnerable. OTOH, corporate IT divisions love
| it because Microsoft lets them do all sorts of stupid things to
| it, like prevent me from changing the desktop background, so
| it's kind of a deserved punishment.
| Rygian wrote:
| > as secure as swiss cheese
|
| In IT security jargon, the "Swiss cheese" model is a good
| practice: https://en.wikipedia.org/wiki/Swiss_cheese_model
| 666satanhimself wrote:
| [dead]
| nyolfen wrote:
| this is not windows
| lostmsu wrote:
| > Any Windows product/system is a liability.
|
| A self-evident realization: every single product/system is a
| liability.
| neilv wrote:
| Did anyone start getting Microsoft "single use code" emails last
| night?
|
| (Maybe if you have an Microsoft consumer account that you don't
| use, forgot you had, and might be incompletely set up.)
___________________________________________________________________
(page generated 2023-07-18 23:02 UTC)