Everything authenticated by Microsoft is tainted

If you have immutable, permanent audit logs, you can go through all actions authenticated with something directly or indirectly signed by the leaked key. However, building such an audit log in a way that someone with maximum permissions still can't tamper with it is not easy — and not cheap. (And, worst case, the audit log may not have the necessary detail; e.g. just listing an authenticated identity, but not the way authentication was established — thus not allowing easy identification of possibly compromised access.)

As such, the hole in the strategy is that it doesn't account for other persistent backdoors that may have been added while access using this leaked key was possible. It only prevents further exploitation of the issue. But depending on the sophistication level of the attackers — which seems extremely high considering how the key was apparently stolen — it's nigh impossible to figure out how many secondary avenues of access they have established.

Almost every organisation already has a huge-ass contract with Microsoft for Windows, AD, Office, Teams, Exchange and whatnot, deeply integrated with their core IT. So if the organisation doesn't already have AWS set up as a supplier, it's usually easier to push for an existing supplier instead.

It's all smoke and mirrors but it works.

Blame CTOs and system admins who are either married to the stack because it's the most familiar OR they were forced onto it by a CTO because, "no one ever got fired for picking a Gartner upper right quadrant option."

I used to run a Windows 2000 Pro web server, after lack of security I switched to Linux.

Microsoft may be popular, but they have big holes in their security. Always has been.

It doesn't matter that China/Whichever state actor is snooping on all your user's data. Either no-one finds out and you're good. Or the blast radius is _so_ wide, that all blame falls on Microsoft

This issue.

Services get compromised often, cloud or customer managed. Microsoft has a mature, professional and effective security team. They got compromised, due to implementation flaws and one or more (my conjecture) corrupted insiders. Most organizations would have no idea wtf happened and would not be able to identify what has been revealed to the public.

Hindsight is 20/20.

Can you explain this more? What's wrong with AWS compared to Azure?

Because they’re not financially liable for the mistakes of Microsoft. They go to these services because they sign contracts offloading that risk to another company. If Microsoft leaks your entire datastore because of poor security on their end, you sue them for damages because ensuring the protection of your digital property is part of the reason these companies are enticing to use in the first place. They use Microsoft because everyone uses Office 365 because it integrates well with Active Directory which they’ve used for their corporate directory for 20+ years.

> I mean, emphasis on able to, as in "in theory, based on what I know, it is POSSIBLE", not that they did.

When you consider the potential implications, and possible scenarios, from a security perspective you have to assume that they're not just "possible" but a reality.

If you find a zero day exploit, you don't just ignore patching it because "well nobody else probably has it".

You linked Microsoft's investigation report on the exploit.

The attackers first managed to get access to Microsoft's development network, noticed a crashdump, understood the possible significance of that, dug through it, found a private key, then acquired enough insight into Microsofts authentication systems to understand how this key could be used beyond its intended purpose and then executed on that.

And you don't believe they left persistent backdoors in some high-profile targets?

The conclusions being drawn are … entirely appropriate. Your argument maaaaaybe makes some sense applied to general public random cloud customers. Backdooring indiscriminately just increases the risk of discovery. But large companies and government users? You have to assume compromise, anything else is incredulously naïve.

cf.:

https://www.microsoft.com/en-us/security/blog/2023/07/14/ana...

> Storm-0558 operates with a high degree of technical tradecraft and operational security. The actors are keenly aware of the target’s environment, logging policies, authentication requirements, policies, and procedures. Storm-0558’s tooling and reconnaissance activity suggests the actor is technically adept, well resourced, and has an in-depth understanding of many authentication techniques and applications.

https://karl-voit.at/cloud/

Which has these among a long list (retaining the reverse order from link above). NB I have just copied and pasted for convenience; neither removed text which refers to links nor added the actual links. You can click through yourself if you want to follow the links.

8<---

023-08: Again Microsoft, again Azure: "unauthorized access to cross-tenant applications and sensitive data (including but not limited to authentication secrets)". If you aren't tech-savvy: this is very bad. (Source)

A reoccuring pattern emerges more and more: Microsoft didn't fix the issue in months and as of 2023-08-03 it is still an open vulnerability in Azure, risking the data of all Azure customers. related:

Microsoft comes under blistering criticism for “grossly irresponsible” security | Ars Technica

BrianKrebs: "The CEO of Tenable just ripped Microsoft a new on…" - Infosec Exchange

2023-07: Hackers stole a Microsoft Azure Active Directory certificate which gave them full access to basically all Microsoft cloud services including Outlook, Office, SharePoint, Teams, "Login with Microsoft", and so forth. (MS blog entry, Source, German source)

With the default logs, customers could not even detect intruders as you would need to pay extra to get access to those log files.

Microsoft did not communicate which services were affected and which not. Any Microsoft cloud service was potentially compromised.

Most probably, the usual "any compromised system needs to be thrown away and re-created from scratch will not be applied here. As a consequence, you can't trust any data from Microsoft services any more.

Security experts like Mike Kuketz think that most probably we need to consider all Microsoft systems that are using their cloud authentication including all Windows hosts are compromised.

According to this German source, Microsoft is still refusing to tell what happened and which systems are affected to what extend.

2023-08-18: German comment: Many similar comments like that underline that Microsoft disqualifies as a trustworthy partner.

2023-09-06: first public explanation by MS: Microsoft: Results of Major Technical Investigations for Storm-0558 Key Acquisition Press reactions: heise (German), fefe (German)

2023-07: Hackers stole a Microsoft Azure Active Directory certificate which gave them full access to basically all Microsoft cloud services including Outlook, Office, SharePoint, Teams, "Login with Microsoft", and so forth. (MS blog entry [1], Source[2], German source)

Also the following:

https://infosec.exchange/@briankrebs/110820474957163710

Quite damning if true.

[1]: https://www.microsoft.com/en-us/security/blog/2023/07/14/ana... [2]: https://www.wiz.io/blog/storm-0558-compromised-microsoft-key...

In the very same link he posts: https://www.microsoft.com/en-us/security/blog/2023/07/14/ana... "Post-compromise activity

Our telemetry and investigations indicate that post-compromise activity was limited to email access and exfiltration for targeted users."

So it's not "all Microsoft".

It's the usual exaggerated headline, but this time it draws attention on a person's post on Mastodon.

This platform is really no different from Twitter.

Now I have apps where I need 15 minutes of maintenance a year, install and configuration takes 5 minutes.

Some cloud providers have amazing stuff, but I feel they all start to bloat and I don't have use cases that need whole clusters.

There is a best of both worlds in there and I think we've gotten where we are now because of cloud providers marketing themselves suitable for everyone.

When everything was local and private, the attacker could only access a specific device or network, even if the security was often very weak. Now a single attack on a centralized entity has such a big payoff, that it makes if viable to allocate much bigger resources by attackers.

Also even for softwares deployed on on-prem hardware, big orgs will still need single sign on, which will still be open to these kind of attacks.

Maybe “on prem” but largely managed by someone else, which is already a thing.

There were already addons like that that created garbage traffic a while ago. Just wasnt practical without language networks.

Disagree. You don't need 10 years in IT to understand the meaning of: "M$ allowed customers to use their house-keys to open everyone's office safe, lied about it for 2 years, and still doesn't have a plan for fixing it".

McNeally was simply wrong, but despair is easier than fixing things, so a lot of people went with despair. The popularity of cloud and SaaS is the result. But this isn't a foretold destiny; just don't "trust" people you don't actually trust.

All of the points are not true I think:

1. People can still have guaranteed privacy (e.g. going into the woods with no devices). As with many laws an incentive to ensure privacy of others could be punishment in case of failure.

2. There is no absolute security, but there is security against certain threat models.

3. Why would data I keep on a device that is not connected to any network ever get public?

Well we expect people and corporations to fix a problem when confronted with it. That is what we expect.

> „Normal“ people will not read this, nor be able to understand, nor gauge or grasp the impact. It’s become way to complex. We can’t simply stop using mentioned services anymore as a society.

Have to give you a pass on "normal" people. I don't know any. I see no reason why we cannot go without the (by the way) unmentioned services or why we cannot change them to be more privacy conscious.

>Wouldn’t it be more reasonable to teach:

No it would be more reasonable to teach that privacy is vitally important to have a functioning society and economy. Anyone claiming different think they can exploit the information disparity between you and them to make money in the short term.

>1. You have no privacy, it is impossible to ensure or guarantee privacy, and there’s no incentive at all for anyone to ensure privacy. (Scott McNeally of Sun said that already in the late 1990s).

Well I respect Scott, but this is not his great moment. Let's change this to be still completely true: You have no property, it is impossible to ensure or guarantee property and there's no incentive at all for anyone to ensure property. Well we did find a way to actually do ensure property. It is called the law (and a government to enforce it). Just an idea to use this tried and tested concept on privacy as well.

>2. There is no security and every kind of security has been, was designed to, or will be compromised.

First this has always been true. Every lock can be picked. Fortunately not everyone can pick a lock. That is the reason why most of us still lock the door.

>3. All your digital information is already public or will become public at some point. (btw: Every top-tier consultancy operates under that assumption)

You mean those top-tier consutancy firms mentiond in this book: "The Big Con" by Muzzucato and Collington, Penguin, 2023? I can see that they sell the assumption, but they are not operating by it. If that were true McKinsey for example would have known their advice to Purdue Pharma would become public and they would lose big on it.

In short people who claim privacy is not important mean: _your privacy_ is not important and they are overly confident they can keep ahead of the information disparity to keep themselves private. See how hard, ironically, Google is working to keep all their information private in a public anti-trust trail.

My elderly aunt keeps her secrets on a notepad in her desk. I suppose a spy or a housecleaner (if she had one) could know her secrets but it won't be "hacked".

The whole "you have no privacy or no security" is false and only impacts the terminally online.

Do what the intelligence agencies do. Stop letting other people store your secrets. Put them in a nice heavy locking box. Guard them with a firearm.

#1. You have no privacy ONLINE. Providers have perverse incentives to sell you out down the river. Therefore, you DEFEND yourself by keeping a shallow online presence. If you are a casual user, you keep as little information online, specially in social media, as possible. If you need an online presence, you ASSESS the risks and pay time and money to MITIGATE those risks. If you don't see a Return-Of-Investment on those mitigation efforts, chances are you have been CONNED into thinking you need an online presence, but you probably DONT.

#2. There is no ABSOLUTE security. All possible defense measure CAN be circumvented, not not necessarily WILL be circumvented. You ASSESS as many risks as you can imagine, and MITIGATE only those where you expect a positive ROI. The ones you don't mitigate, you ASSUME. The ones you cannot afford to assume, you DO NOT TAKE by refusing to use the system.

#2.a Corollary to #2. If you take ZERO risk management, you still have a BASELINE level of security based on the risk-reward analysis by the criminogenic/sociopath portion of the population; they will not attempt an invasion if they do not expect to get away with it, or to gain something out of it. The more cynical people in the know claim there's no security, the more this baseline approaches zero and the more vulnerable the general population is.

#2.b Even if you are not part of the general population, the lower the BASELINE, the more time and money you PERSONALLY have to invest in risk management to achieve a bearable level of safety. Cynicism is costing US time and money, pal; don't pee/shit on the village's wheel just because it looks edgy!!!

#3. All your CURRENT digital information is already public or will become public AT SOME POINT. You can do better and pick the technologies that will push that point FURTHER into the FUTURE. And for not yet digitalized information, you may make conscious decisions whether the convenience is worth the risk.

And those people had already hacked an engineer's account. Because the chances of stumbling upon this key when only hacking one engineering account are very low, it's reasonable to assume many MS engineering accounts had already been hacked.

Basically, your MS account is not safe.

Anyways, I've worked at companies that are absolutely targeted by nation states.

for some, this sounds like a nonsensical choice. for others, a defining moment of leadership.

The Machine Stops by E.M Foster

https://web.cs.ucdavis.edu/~rogaway/classes/188/materials/th...

I'm not saying cloud computing is the solution to every problem, and nor should it be, but calling it a sinking ship is simply absurd.

Frankly, I grow so tired of people thinking everything is a boolean choice. The real problem with the cloud is people who see things as binary statements: "cloud is cheaper", "cloud is more expensive", "self hosting is easier", "cloud is easier", "cloud is more secure", "on-prem is more secure", etc. All of those statements are true just as all of those statements are false. The reality is far more nuanced and it depends entirely on the constraints of your business at that point in time. Such as what engineers / skill sets do you have on your team? Capital to buy hardware, your physical location, the product you're trying to build... etc.

But the problem with nuanced arguments is they're subjective to the immediate problem you're trying to solve. So you cannot debate them with other people as those other people are trying to solve different problems with different teams and different tools. And thus we end up with people posting bullshit blanket statements like "the cloud is a sinking ship" or the linked article that boasts that the cloud is less secure.

Bloated security theater being profitable also doesnt help. One example is smartphones as TAN generators for online banking replacing TAN lists. While you can now charge customers per SMS, the second factor got quite a bit more easy to attack.

This essentially makes all key western companies and public orgs, hosted on azure, probable targets. It's highly unlikely that they only stole state dept. emails, when they had access to banks, finical orgs, etc.

Indeed, their very ability to steal emails from the US state dept! makes it likely a breach at other less protected vital biz/orgs occured.

The whole of the azure cloud, and esp. the whole of managed MS apps at major institutions was compromised for at least a year. This is apocalyptic.

https://arstechnica.com/security/2023/08/microsoft-cloud-sec...

The company can recognize that "there is no choice" is not a valid option. There are many choices if the company actually cared to invest into choices. That requires learning and actually vetting your vendors though. That's hard work. Good luck getting people to do hard work.

I'd be curious to know what kind of problems could be only solved through a cloud-only solution. It's a honest question; I'm not old enough to remember actually using mainframes but in my days companies had their own IT staff, gear and storage. I understand that hiring a IT team of 3 could not be viable for a small 10 people startup, but I'm sure there are solutions in between before being forced to entirely surrender everything to someone else's data center.

That said, good luck implementing and managing that in a large organization.

I remember when the Network Computer was going to put Microsoft out of business. It was Sun providing the NC and JavaOS, Netscape providing the Web Browser and anyone who wanted to license the NC to make their own. Internet was too slow then as everything was stored on the Internet, which because the Cloud model. Microsoft bundled IE with Windows to destroy Netscape and made Dotnet destroy Java.

This is embarrassing for Microsoft. All their cloud services have been hacked. Data has been leaked. Could lead to lawsuits.

Regarding mandatory updates, try Reboot Blocker.

The short answer is...yes.

Of course it isn't easy. Of course it would take time. But it's certainly not impossible. It's certainly been done.

I'm not defending MS but the idea that they're some sort of siren and companies can't help themeselves...well, please get me a list of those companies so we short the shocks if they're that incompetent.

Migrating will be relatively cheap. No wonder they’re hobbling the tools (/tinfoil), they see the threat.

This is incredibly insensitive and dismissive, and victim-blaming.

The ironic part is that Bitcoin and Ethereum, altcoins like Filecoin and the entire space of decentralized protocols (EVM, the coming-soon FVM, etc) was designed to eliminate centralized middlemen, including banking cartels, Amazon (which is being sued for monopolistic practices) and the soon-to-come CBDCs etc. In fact, all the responsible protocols (IPFS, UniSwap on Ethereum, Aave marketplace etc etc.) kept humming along regardless of bull and bear markets. It’s just distributed code!

But middlemen were able to convince the public that their centralized companies “ARE web3” and then overpromised yields and other crap.And now the public conflates that with all decentralized protocols that carry value — that’s why we can’t have nice things.

And a bunch of fly-by-night teams cloned contracts delivering no utility at all and some even put backdoors in them. Like PHP “give me the spaghetti codes” crowd and Javascript script kiddies and HTML personal sites with <blink> tags script kiddies… but with some money invested.

Cryptographers were right to protest the word “crypto” being associated with this.

Hard to take your comments seriously with such obvious disdain against the company and ridiculous victim blaming.

I guarantee 99/100 humans on this forum either currently host with AWS/GCP/Azure or have worked at a shop that does. And I bet an outsized portion of those AWS/GCP shops also host on Azure for Azure AD.

There is no one that is ready for a de-Microsofted world. Even Linux distros have been increasing their support for integrating into the MS ecosystem and forsaking alternatives because how prevalent AD is. Even the most prominent alternative FreeIPA is designed to compliment an AD installation, not replace it. The best supported directory/central login server on Linux is AD.

Ok. So are you suggesting that the most practicable alternative is to be a slave to [list of 100+ other vendors]? Going out of your way to defenestrate a trillion dollar technology vendor is a bit bananas to me. If you are trying to run a business, I think you are completely fucking yourself over with this sort of attitude.

How much business convenience are you willing to squander over these principles? And, are you truly upholding your principles on a consistent basis or is this a reductive "at least it's not Microsoft" line of thinking? Microsoft is a big place. Some parts good some parts bad. You may be leaving a lot of upside on the table by never considering them as an option.

We are a "Microsoft shop", but we still use other vendors when it makes sense. I don't trip over myself trying to get 100% off AWS over some ridiculous tribalism. Their domain registration and S3 object stores work really well for us so we continue to use them, even when it creates a bit of integration overhead (SCIM identity sync w/ AAD, etc).

This is mixed with an ever increasing legislative push and higher fines for leaking PII.

All architectures based on certificate authorities are fundamentally fragile in the same way. People look at me like my head is spinning when I suggest just adding ephemeral self-signed CA root certs to deployment pipelines (or, god forbid, use SSH keys, or even symmetric keys).

However, those approaches have a much, much smaller attack surface than HTTPS or standard X.509 SSH authentication, so I'll keep recommending it.

I think the reason for the pushback is that, in this space, attack surface is roughly proportional to monetization potential.

Test it out, if curious - Pretty straight-forward. And a heck of a lot more economical.

If an admin is able to navigate in all that shit, I don't know why they would not understand e.g. random unix tools.

I am a linux sysadmin. Honest question: Would I have an edge on a Microsoft-y admin or are linux sysadmin skillset limited to Linux ? I can find my way around a lot of network appliances (sophos, cisco, junyper, etc.) and I'd expect a windows system to be as capable.