Exposing the secret Office 365 detailed activity logs and forensics tool • Hacker News Board

Re: Exposing the secret Office 365 detailed activity logs and forensics tool

#31

Post by voltagex_ » Thu, Jun 28, 2018, 8:31 AM UTC

derefr wrote: post #16

pweissbrod wrote: post #8

Earlier quoted context omitted.

I couldn't agree more. Why is the API not public? Is it because some sort of top secret corporate conspiracy? Or is it that management just decided to avoid the burden of publishing and maintaining an immature or lesser used API? After reading your comment that whole article seemed a little sensationalist

> just decided to avoid the burden of publishing and maintaining an immature or lesser used API "Burden" is an understatement. Any API Microsoft documents becomes part of their ongoing commitment to eternal backward-compatibility. (Heck, even some things they never document at all still end up forced into that commitment, like the internal registry hives in Windows 95.) So Microsoft do everything they can to only doc…

Exchange WS and Lync/Communicator would disagree with you re: eternal backward-compatibility.

Re: Exposing the secret Office 365 detailed activity logs and forensics tool

#32

Post by justinclift » Thu, Jun 28, 2018, 8:54 AM UTC

greglindahl wrote: post #19

kijin wrote: post #12

Earlier quoted context omitted.

If an API is undocumented, how can you know that it doesn't exist? It might very well exist for internal debugging purposes, just not at the URL you might expect. Or maybe it's at the expected URL but returns 404 to everyone whose access token isn't flagged as an employee in the appropriate department. As someone who relies very heavily on logs to debug issues in immature and/or fast-moving products, I would be surpr…

In the modern era, you should expect that the privacy policy contains the details of everything that's logged. You need to know that so you can tell your customers what is logged by your subs.

> In the modern era, you should expect that the privacy policy contains the details of everything that's logged.

Perhaps corporations with a history of abusive tactics and legal shenanigans, would prefer to follow a different path?

Re: Exposing the secret Office 365 detailed activity logs and forensics tool

#33

Post by scandox » Thu, Jun 28, 2018, 9:01 AM UTC

> It was as if Alexander Fleming had discovered penicillin but kept the details hidden in order to make more money. It just seemed wrong.

Because your right to make money is equivalent to other people's right to remain alive.

Re: Exposing the secret Office 365 detailed activity logs and forensics tool

#34

Post by dschuetz » Thu, Jun 28, 2018, 9:08 AM UTC

All this Facebook-bashing in the recent months and then m$ office is spying on everything you do. This is like a "legit" keylogger, which is activated per default, because it's a product feature. But, you have to trust it also per default, it seems. Damn.

Re: Exposing the secret Office 365 detailed activity logs and forensics tool

#35

Post by tallanvor » Thu, Jun 28, 2018, 9:28 AM UTC

pweissbrod wrote: post #8

ExploitsforFun wrote: post #7

I looked at the API calls on the CrowdStrike blog post and I have been using parts of these API's for calls in PowerShell for at least the past year for tracking down issues we have had in Office 365. I can understand how frustrating it can be if your competitors seem to have "secret knowledge". However that knowledge may have been gotten by calling up the very helpful people at MS support, laying out the problem and…

I couldn't agree more. Why is the API not public? Is it because some sort of top secret corporate conspiracy? Or is it that management just decided to avoid the burden of publishing and maintaining an immature or lesser used API? After reading your comment that whole article seemed a little sensationalist

There are a lot of reasons that it might not be public, but a conspiracy is quite low on the list.

My guess is that it's due to one of the following:

* The API isn't considered beta yet. * This was created as somewhat of a side project and hasn't been formalized yet. * Documenting it is on the backlog. * It's meant for internal use in that they may be building in tools in the Security and Compliance center that will be calling it.

Re: Exposing the secret Office 365 detailed activity logs and forensics tool

#36

Post by Jaruzel » Thu, Jun 28, 2018, 10:35 AM UTC

notslang wrote: post #17

> The tide turned on Friday, June 8. Out of the blue, an email popped onto the forensics community mailing list. It contained a single link, to an Anonymous video. All that video said was "the API you seek is called Activities". Am I missing the joke, or is the name of the API literally the only thing that they needed to get this working?

I've not delved into the code, but typically a lot of APIs when called without any parameters can return an XML page containing the schema of what it can do. So yes, it's totally plausible, that if you already knew how Office 365 APIs worked, all you needed was the name of the unknown API.

Re: Exposing the secret Office 365 detailed activity logs and forensics tool

#37

Post by Eech0Shu » Thu, Jun 28, 2018, 11:40 AM UTC

scandox wrote: post #33

> It was as if Alexander Fleming had discovered penicillin but kept the details hidden in order to make more money. It just seemed wrong. Because your right to make money is equivalent to other people's right to remain alive.

I don't think there is a right to compel others to unlimited spending to keep you alive. Sure, pencilin is comparatively easy to grow and hopefully you live in a country with universal healthcare that covers it, but if it were some more expensive substance that can't be covered the analogy holds.

Re: Exposing the secret Office 365 detailed activity logs and forensics tool

#38

Post by shiftpgdn » Thu, Jun 28, 2018, 12:56 PM UTC

ExploitsforFun wrote: post #7

I looked at the API calls on the CrowdStrike blog post and I have been using parts of these API's for calls in PowerShell for at least the past year for tracking down issues we have had in Office 365. I can understand how frustrating it can be if your competitors seem to have "secret knowledge". However that knowledge may have been gotten by calling up the very helpful people at MS support, laying out the problem and…

This is absolutely not true. I called O365 yesterday (well, they called me at my request) to investigate a potential data breach. All the guy on the phone could do was to read to me out of a technicians manual and then suggest I purchase the Azure Active Directory P2 plan at $9/user/month.

Re: Exposing the secret Office 365 detailed activity logs and forensics tool

#39

Post by izacus » Thu, Jun 28, 2018, 1:04 PM UTC

lixtra wrote: post #22

derefr wrote: post #16

Earlier quoted context omitted.

> just decided to avoid the burden of publishing and maintaining an immature or lesser used API "Burden" is an understatement. Any API Microsoft documents becomes part of their ongoing commitment to eternal backward-compatibility. (Heck, even some things they never document at all still end up forced into that commitment, like the internal registry hives in Windows 95.) So Microsoft do everything they can to only doc…

They could just flag it “volatile”, “unstable” or something. It’s very unlikely that Microsoft did not properly document the api internally and as you see it’s leaking out anyway.

If you'll ever develop a single simple API you'll find out that doesn't work at all. People will use unstable APIs and people will blame YOU and only you when they break.

Re: Exposing the secret Office 365 detailed activity logs and forensics tool

#40

Post by ropman76 » Thu, Jun 28, 2018, 1:35 PM UTC

shiftpgdn wrote: post #38

ExploitsforFun wrote: post #7

I looked at the API calls on the CrowdStrike blog post and I have been using parts of these API's for calls in PowerShell for at least the past year for tracking down issues we have had in Office 365. I can understand how frustrating it can be if your competitors seem to have "secret knowledge". However that knowledge may have been gotten by calling up the very helpful people at MS support, laying out the problem and…

This is absolutely not true. I called O365 yesterday (well, they called me at my request) to investigate a potential data breach. All the guy on the phone could do was to read to me out of a technicians manual and then suggest I purchase the Azure Active Directory P2 plan at $9/user/month.

There is a blog post from 2015 about an API for security and compliance motoring. https://www.microsoft.com/en-us/microsoft-365/blog/2015/04/2...

I respect that fact that CrowdStrike and others have spent the time with the api and made life a lot easier for others. As someone who has spent more time than he wanted with the Office 365 API I am a fan of people who make my life easier. That being said I am not buying the drama that these API's have been hidden.