Hacker News Reader

Comment by insanitybit | Hacker News Reader

Such hyperbole. This was a bad breach, for sure, and we may not fully understand its scope at this point. But...

> They were able to implant #backdoors, self-made keys, ... all over the place.

I mean, emphasis on able to, as in "in theory, based on what I know, it is POSSIBLE", not that they did.

> If you didn't understand until now: basically EVERYTHING at Microsoft got hacked and Microsoft can't (or won't) get rid of the intruders. Everything authenticated by Microsoft is tainted. Even #Windows auth.

Microsoft's response also seems to clearly state that they have rotated the keys, moved them to a more secure storage, etc. They don't say they've removed the attackers, I guess, but they certainly don't indicate that the attack is ongoing. Certainly they don't indicate that all auth is forever broken.

I feel like the conclusions being drawn are extreme.

https://msrc.microsoft.com/blog/2023/09/results-of-major-tec...

View on HN

> I feel like the conclusions being drawn are extreme.

You linked Microsoft's investigation report on the exploit.

The attackers first managed to get access to Microsoft's development network, noticed a crashdump, understood the possible significance of that, dug through it, found a private key, then acquired enough insight into Microsofts authentication systems to understand how this key could be used beyond its intended purpose and then executed on that.

And you don't believe they left persistent backdoors in some high-profile targets?

The conclusions being drawn are … entirely appropriate. Your argument maaaaaybe makes some sense applied to general public random cloud customers. Backdooring indiscriminately just increases the risk of discovery. But large companies and government users? You have to assume compromise, anything else is incredulously naïve.

cf.:

https://www.microsoft.com/en-us/security/blog/2023/07/14/ana...

> Storm-0558 operates with a high degree of technical tradecraft and operational security. The actors are keenly aware of the target’s environment, logging policies, authentication requirements, policies, and procedures. Storm-0558’s tooling and reconnaissance activity suggests the actor is technically adept, well resourced, and has an in-depth understanding of many authentication techniques and applications.

I think there's a huge difference between "maybe there is a backdoor" versus "literally all of microsoft, across all orgs, is owned and they have to shut it all down and start from scratch", call me crazy.

That's really wishful thinking. Which is fine if you're a small company throwing non-sensitive things into Azure. If OTOH you were working as a SIEM at some company providing 2nd-order cloud services, this is where I would start questioning your qualifications and that company's overall policies.

(… especially when you're not even bringing up the fact that the compromised key was mainly usable to access e-mail)

I did indeed bring that up in another comment. I don't feel the need to repeat all information across all of my comments.

I don't know what your point is.

The "start from scratch" (or as we used to call it, 'nuke from orbit') approach is the only feasible one.

If an attacker had full root across the org for an undetermined (but not short) period, I'm unsure what other approach you think you could take? You can't just run MalwareBytes and call it a day.

Step 1 is to review your existing telemetry. You determine the possible scope of the attack based on the evidence you find. You remediate based on that. You may also want to consider scope that you don't have evidence for but that you lack telemetry for and that you believe an attacker could have accessed - that's fine too.

This comes down to a risk assessment. No company has a breach and just shuts everything down, that is insane. When we perform IR we build a detailed timeline, we collect the scope of potential access, and we form a remediation plan. We don't just go "well hey, anything can happen right? shut it all down".

Nuke it from orbit applies to a workstation, not an enterprise environment.

Nukes can be applied to all kinds of shit. It's easy enough to understand the implication of the phrase that there's no need to pretend it can only apply to specific items.

To me it sounds more like: Most likely backdoors have been planted.

So the question is how you handle such a situation.

> This was a bad breach, for sure, and we may not fully understand its scope at this point

> I mean, emphasis on able to, as in "in theory, based on what I know, it is POSSIBLE", not that they did.

When you consider the potential implications, and possible scenarios, from a security perspective you have to assume that they're not just "possible" but a reality.

If you find a zero day exploit, you don't just ignore patching it because "well nobody else probably has it".

Of course you patch it, but you don’t assume that every system affected by this 0-day got exploited. You try to check if some were and it’s obvious that people at Microsoft are doing exactly that.

Not saying that MS’s response was great, but I agree with GP that the whole thing is hyberbolic.

> Of course you patch it, but you don’t assume that every system affected by this 0-day got exploited.

Uhh, what? Of course you do. Why give the benefit of the doubt to hackers who hacked you with malicious intentions? That's the type of security nonsense that I'd expect from... Well, Microsoft lol

So every time a 0day is released you buy a net new device? Cause there are 0days like... every day.

It's one thing if it's your laptop, but another if it's a system with billions of users.

A released 0day is an oxymoron..

I have a 0 day. I release it. I released the 0 day.

Hehe pedant but after that action, it's no longer a 0day...

Yes it is.

It's named so because you have "0 days" to patch it; it's not referring to the age of the vuln.

Evertime a 0day thar granted privilege escalation was found on installed bins/libs, we ran a script that looked at setsuids on anything and everything and did a report on what was found. We managed to find a crypto miner once.

Obviously I won't run it on my personal computer, but i'm not renting my pc to anyone.

Literally no one is suggesting that they don't perform a thorough investigation.

If you find yourself owned by, and not only from a 0-day, then yes, you wipe everything clean and re-build with mitigations in place from the start as to not get reinfected in the process.

That's pretty much the only option if you safeguard valuable data for your customers. Yes, it's expensive to get breached, so take precautions to make it a rare event and contain it as much as possible when it happens.

I don't think the article is unreasonable. This is cloud infrastructure sold to companies with defense industry contracts where breaches are taken seriously.

I mean, yes, obviously, you have malware on a box you rotate that box. They had keys and they rotated the keys. But the implication here is that the attacker could have done anything and therefor they have to destroy everything, which is unreasonable.

Rotating keys are far from enough. If your keys are compromised, you need to revoke everything. Then you need to assess what the impact is and wipe anything the compromised keys had access to during the period.

This is not theoretical. When the openssl fiasco hit, I worked in a place under financial regulation. Not even the defense sector, which is under much stricter rules. We had to go through all logs to ascertain customer data was intact, and since leaking private keys did not leave a trace in the logs we then wiped clean all systems these keys secured.

This was a massive undertaking to coordinate and minimize downtime for customers but it was deemed necessary to comply with security regulations. To hear that a big juggernaut such as Microsoft doesn't even do this without facing much consequences is mind boggling. I can not understand how that would ever pass an audit.

Revoke everything? Everything?

I have literally done incident response I am well aware of what the investigation process is like.

Everything a potentially compromised key has signed, yes. What are we discussing here? This is standard procedure by every compliance processes I have ever had the misfortune to work with, but for quite good reasons. Hope alone won't pass an audit.

OK but "everything" and "everything the key may have signed" are obviously so insanely different.

> I mean, yes, obviously, you have malware on a box you rotate that box.

"The box" in this case is their entire org.

> When you consider the potential implications, and possible scenarios, from a security perspective you have to assume that they're not just "possible" but a reality.

No you don't. You definitely don't want to assume otherwise and you spend the time derisking and investigating, but if you have zero evidence to support the situation you don't just consider it the case anyways.

I'm sure Microsoft is provided all the resources they need to flush out any embedded binaries and ill-configurations including every federal agency available.

Plot twist: the hackers have already taken over Microsoft and were the ones who published blog posts about how they'd handled the breaches.

Reply on news.ycombinator.com