Interesting to understand the reason for the attack, it's to recover iCloud passwords so they adversaries can sell stolen iPhones! Wow!
Hackers could read non-corporate Outlook.com, Hotmail for six months
51–59 of 59 posts
Re: Hackers could read non-corporate Outlook.com, Hotmail for six months
#52Let me get this straight: They were able to use a single helpdesk account password for six months to read arbitrary emails from arbitrary user accounts. There was no 2fa. There was no auditing. There was no integration with any sort of ticketing system ("you can only access an account if you're working on that specific user's ticket") or paperwork ("reason for access:"). There wasn't a single piece of automated monit…
I've built systems which required "helpdesk" type access and had auditing, but the problem is where do think "audit summary report" is on the TODO pile for the people getting those summaries? I'm guessing it's between "Delete unread" and "I really ought to get around to it but I'm too busy so I never do". Even when it comes to third party audit, those are ring binder driven processes. Does the audit report get genera…
> I've built systems which required "helpdesk" type access and had auditing, but the problem is where do think "audit summary report" is on the TODO pile for the people getting those summaries? I'm guessing it's between "Delete unread" and "I really ought to get around to it but I'm too busy so I never do".
Auditing isn't a system feature, it's a business process feature. A system can have logging and even detection of situations requiring auditing, but if no one is systematically reviewing—auditing—the results, it doesn't have auditing.
Re: Hackers could read non-corporate Outlook.com, Hotmail for six months
#53Earlier quoted context omitted.
I've built systems which required "helpdesk" type access and had auditing, but the problem is where do think "audit summary report" is on the TODO pile for the people getting those summaries? I'm guessing it's between "Delete unread" and "I really ought to get around to it but I'm too busy so I never do". Even when it comes to third party audit, those are ring binder driven processes. Does the audit report get genera…
Yes, I wouldn't expect to find much rigor at Cousin Ricky's house of email. This is Hotmail. They don't have any excuses. They handle a ton of email for a lot of people, people depend on them, and they are a big target. If this was a specially privileged superuser account, it should have had more attention paid to it. Yes, it's hard to scale audits or monitoring to the entire customer support org. But if you only hav…
> Yes, I wouldn't expect to find much rigor at Cousin Ricky's house of email. This is Hotmail. They don't have any excuses.
It's consumer Hotmail. From Microsoft’s perspective, that is probably excuse enough.
Of course, I've seen pretty bad things in large HIPAA covered entities with systems with PHI; insufficient security and accountability of support accounts and recovery processes is found lots of places.
Re: Hackers could read non-corporate Outlook.com, Hotmail for six months
#54Earlier quoted context omitted.
> I don't see how allowing helpdesk operators to help users recover access to their accounts has any relation at all to the helpdesk operators having access to the account itself. They need to be able to access and update account metadata, not the account itself. So in your system the bad guy can't read my email because he only has the ability to access and update account metadata such as my password and the helpdesk…
>That would work, unless any of the bad guys is smarter than you and realises that they can use this metadata to... log into my account and read my email. No need to be so rude and disrespectful. Obviously there needs to be a password reset mechanism. That mechanism can absolutely be designed in a way that does not involve the helpdesk operator having access to the password or the account.
People get locked out of their accounts because in addition to losing their password, they don't have access to the recovery email/phone/whatever which they already set (or never set one at all). If the helpdesk operator has the ability to change or otherwise set a destination for a recovery email/token/pin/secret to be sent then they have the ability to set their own account/device as the trusted reset device/account. There really isn't a way that normal people can use that would allow a helpdesk operator to give them back access to their account without also allowing the helpdesk operator to gain access to the account themselves if they so choose.
Re: Hackers could read non-corporate Outlook.com, Hotmail for six months
#55Earlier quoted context omitted.
I've built systems which required "helpdesk" type access and had auditing, but the problem is where do think "audit summary report" is on the TODO pile for the people getting those summaries? I'm guessing it's between "Delete unread" and "I really ought to get around to it but I'm too busy so I never do". Even when it comes to third party audit, those are ring binder driven processes. Does the audit report get genera…
> I've built systems which required "helpdesk" type access and had auditing, but the problem is where do think "audit summary report" is on the TODO pile for the people getting those summaries? I'm guessing it's between "Delete unread" and "I really ought to get around to it but I'm too busy so I never do". Auditing isn't a system feature, it's a business process feature. A system can have logging and even detection…
This is an excellent point, thank you for putting it that way. I can't correct my post now, but this point is something I will definitely emphasise in any future system where I'm told audit is a requirement but I doubt that my technical work will actually deliver the effect intended because the "business process" part won't get done.
Re: Hackers could read non-corporate Outlook.com, Hotmail for six months
#56Earlier quoted context omitted.
>That would work, unless any of the bad guys is smarter than you and realises that they can use this metadata to... log into my account and read my email. No need to be so rude and disrespectful. Obviously there needs to be a password reset mechanism. That mechanism can absolutely be designed in a way that does not involve the helpdesk operator having access to the password or the account.
People get locked out of their accounts because in addition to losing their password, they don't have access to the recovery email/phone/whatever which they already set (or never set one at all). If the helpdesk operator has the ability to change or otherwise set a destination for a recovery email/token/pin/secret to be sent then they have the ability to set their own account/device as the trusted reset device/accoun…
Gaining access is different from having access though. The mechanism you're describing would require that the bad actor reset the user's password, which would at least set off some alarm bells. That's very different from being able to eavesdrop invisibly.
Re: Hackers could read non-corporate Outlook.com, Hotmail for six months
#57Re: Hackers could read non-corporate Outlook.com, Hotmail for six months
#58Re: Hackers could read non-corporate Outlook.com, Hotmail for six months
#59Storytime! When I worked for MSN/Hotmail around 2000-2003, there were dozens of helpdesk folks who had access to an admin panel to easily view any email and could view/edit PII for anyone with very little (if not zero) accounting or auditing. It was protected by plaintext auth and open to the internet. One employee told me that he caught his wife cheating by reading her mail. Another used it to recover their own stol…
Do you think things like this happen regularly nowadays? Most companies have logging in place but I'd assume there isn't resources to audit those logs unless a compelled by an outside complaint...
I've worked at some rather large companies with insanely relaxed security and auditing standards. I think it's even worse now than before because cloud providers make setting up a database cheap and simple. So today an individual or small team can throw together a production-scale MongoDB in a few hours and start filling it with potentially PII; whereas 10 years ago, something like that stood a good chance of having at least one external DBA/IT-person consulted before going into prod.
My line of thinking is to assume auditing and access controls are lax unless the data in question is part of the company's secret sauce, or is regulated by the government.