Hackers could read non-corporate Outlook.com, Hotmail for six months

Post by jammygit » Mon, Apr 15, 2019, 6:07 PM UTC

tialaramex wrote: post #5

saulrh wrote: post #3

Let me get this straight: They were able to use a single helpdesk account password for six months to read arbitrary emails from arbitrary user accounts. There was no 2fa. There was no auditing. There was no integration with any sort of ticketing system ("you can only access an account if you're working on that specific user's ticket") or paperwork ("reason for access:"). There wasn't a single piece of automated monit…

I've built systems which required "helpdesk" type access and had auditing, but the problem is where do think "audit summary report" is on the TODO pile for the people getting those summaries? I'm guessing it's between "Delete unread" and "I really ought to get around to it but I'm too busy so I never do". Even when it comes to third party audit, those are ring binder driven processes. Does the audit report get genera…

Post by dsfyu404ed » Mon, Apr 15, 2019, 6:12 PM UTC

runn1ng wrote: post #6

saulrh wrote: post #3

Let me get this straight: They were able to use a single helpdesk account password for six months to read arbitrary emails from arbitrary user accounts. There was no 2fa. There was no auditing. There was no integration with any sort of ticketing system ("you can only access an account if you're working on that specific user's ticket") or paperwork ("reason for access:"). There wasn't a single piece of automated monit…

Microsoft claims it was just 3 months. Otherwise, on point.

Post by Bhilai » Mon, Apr 15, 2019, 6:21 PM UTC

Post by arcbyte » Mon, Apr 15, 2019, 6:31 PM UTC

saulrh wrote: post #9

tialaramex wrote: post #5

Earlier quoted context omitted.

I've built systems which required "helpdesk" type access and had auditing, but the problem is where do think "audit summary report" is on the TODO pile for the people getting those summaries? I'm guessing it's between "Delete unread" and "I really ought to get around to it but I'm too busy so I never do". Even when it comes to third party audit, those are ring binder driven processes. Does the audit report get genera…

Yes, I wouldn't expect to find much rigor at Cousin Ricky's house of email. This is Hotmail. They don't have any excuses. They handle a ton of email for a lot of people, people depend on them, and they are a big target. If this was a specially privileged superuser account, it should have had more attention paid to it. Yes, it's hard to scale audits or monitoring to the entire customer support org. But if you only hav…

Post by tialaramex » Mon, Apr 15, 2019, 6:35 PM UTC

0xffff2 wrote: post #7

tialaramex wrote: post #5

Earlier quoted context omitted.

I've built systems which required "helpdesk" type access and had auditing, but the problem is where do think "audit summary report" is on the TODO pile for the people getting those summaries? I'm guessing it's between "Delete unread" and "I really ought to get around to it but I'm too busy so I never do". Even when it comes to third party audit, those are ring binder driven processes. Does the audit report get genera…

>Now, you can build systems where it's just impossible for even your own people to get access. But that has a high cost, as you will see in every thread where people castigate Google because they got locked out of something. Why can't Google just hire helpdesk people who have super-user access, they ask... I don't see how allowing helpdesk operators to help users recover access to their accounts has any relation at a…