Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft lost its keys, and the government got hacked

techcrunch.com

Post reply on HN
Print view View original

11–20 of 151 posts

Re: Microsoft lost its keys, and the government got hacked

#11

Post by yladiz »

nubinetwork wrote: post #2

https://news.ycombinator.com/item?id=36690598 https://news.ycombinator.com/item?id=36692494 https://news.ycombinator.com/item?id=36693121 https://news.ycombinator.com/item?id=36693469 https://news.ycombinator.com/item?id=36694188 https://news.ycombinator.com/item?id=36696413 https://news.ycombinator.com/item?id=36696852 https://news.ycombinator.com/item?id=36697272 https://news.ycombinator.com/item?id=36699844 https:…

Just posting these links, some of which have no comments, is a bit much and not actually helpful. It would be better to do a little more curation and choose the most active ones.

Re: Microsoft lost its keys, and the government got hacked

#12

Post by dmvdoug »

nubinetwork wrote: post #2

https://news.ycombinator.com/item?id=36690598 https://news.ycombinator.com/item?id=36692494 https://news.ycombinator.com/item?id=36693121 https://news.ycombinator.com/item?id=36693469 https://news.ycombinator.com/item?id=36694188 https://news.ycombinator.com/item?id=36696413 https://news.ycombinator.com/item?id=36696852 https://news.ycombinator.com/item?id=36697272 https://news.ycombinator.com/item?id=36699844 https:…

And yet, fascinatingly, very very little discussion. 60-ish comments was the most on any of those posts.

Re: Microsoft lost its keys, and the government got hacked

#13

Post by 2OEH8eoCRo0 »

dmvdoug wrote: post #12
nubinetwork wrote: post #2

https://news.ycombinator.com/item?id=36690598 https://news.ycombinator.com/item?id=36692494 https://news.ycombinator.com/item?id=36693121 https://news.ycombinator.com/item?id=36693469 https://news.ycombinator.com/item?id=36694188 https://news.ycombinator.com/item?id=36696413 https://news.ycombinator.com/item?id=36696852 https://news.ycombinator.com/item?id=36697272 https://news.ycombinator.com/item?id=36699844 https:…

And yet, fascinatingly, very very little discussion. 60-ish comments was the most on any of those posts.

Mentioning China negatively is the kiss of death.

Re: Microsoft lost its keys, and the government got hacked

#14

Post by sysop073 »

michaelteter wrote: post #3
nubinetwork wrote: post #2

https://news.ycombinator.com/item?id=36690598 https://news.ycombinator.com/item?id=36692494 https://news.ycombinator.com/item?id=36693121 https://news.ycombinator.com/item?id=36693469 https://news.ycombinator.com/item?id=36694188 https://news.ycombinator.com/item?id=36696413 https://news.ycombinator.com/item?id=36696852 https://news.ycombinator.com/item?id=36697272 https://news.ycombinator.com/item?id=36699844 https:…

Perhaps preceding your list of related links you could state that the following is a list of (recent?) related HN submissions.

You thought perhaps they commented a list of random unrelated HN submissions?

Re: Microsoft lost its keys, and the government got hacked

#15

Post by TheRealDunkirk »

dmvdoug wrote: post #12
nubinetwork wrote: post #2

https://news.ycombinator.com/item?id=36690598 https://news.ycombinator.com/item?id=36692494 https://news.ycombinator.com/item?id=36693121 https://news.ycombinator.com/item?id=36693469 https://news.ycombinator.com/item?id=36694188 https://news.ycombinator.com/item?id=36696413 https://news.ycombinator.com/item?id=36696852 https://news.ycombinator.com/item?id=36697272 https://news.ycombinator.com/item?id=36699844 https:…

And yet, fascinatingly, very very little discussion. 60-ish comments was the most on any of those posts.

Yeah, this is really, really weird.

Re: Microsoft lost its keys, and the government got hacked

#16

Post by formerly_proven »

dmvdoug wrote: post #12
nubinetwork wrote: post #2

https://news.ycombinator.com/item?id=36690598 https://news.ycombinator.com/item?id=36692494 https://news.ycombinator.com/item?id=36693121 https://news.ycombinator.com/item?id=36693469 https://news.ycombinator.com/item?id=36694188 https://news.ycombinator.com/item?id=36696413 https://news.ycombinator.com/item?id=36696852 https://news.ycombinator.com/item?id=36697272 https://news.ycombinator.com/item?id=36699844 https:…

And yet, fascinatingly, very very little discussion. 60-ish comments was the most on any of those posts.

This really surprised me when I learned of this story on the weekend. Very little discussion, very little reception in IT news.

Someone hacked Azure AD[1] and accessed the data of 25+ orgs and the reaction is *crickets*?

[1] I'm not exactly sure which Azure component was hacked and the MS communication seems intentionally unclear and obtuse on this. It sounds like the private keys of Azure-internal auth servers were stolen, but technically those private keys were not supposed to work for the accounts/orgs in question, except they did, and, in any case, MS doesn't disclose how the private keys (one? multiple?) of their cloud auth servers were stolen.

Re: Microsoft lost its keys, and the government got hacked

#17

Post by breadwinner »

JamesonNetworks wrote: post #9

Seems like they are assuming the same key was used to forge tokens and jump from that assumption to the conclusion that they found all instances of requests. If more keys were used to generate more tokens, isn’t it possible this attack had a much wider surface area?

As a rule of thumb, hacks are always worse than initially thought. See https://circles.page/5680a56b5c28af0998656e09/Hacks-worse-th...

Re: Microsoft lost its keys, and the government got hacked

#18

Post by coldpie »

formerly_proven wrote: post #16
dmvdoug wrote: post #12

Earlier quoted context omitted.

And yet, fascinatingly, very very little discussion. 60-ish comments was the most on any of those posts.

This really surprised me when I learned of this story on the weekend. Very little discussion, very little reception in IT news. Someone hacked Azure AD [1] and accessed the data of 25+ orgs and the reaction is *crickets*? [1] I'm not exactly sure which Azure component was hacked and the MS communication seems intentionally unclear and obtuse on this. It sounds like the private keys of Azure-internal auth servers were…

I saw the headline scroll by on my Ars Technica feed[1] but I admit I didn't bother to read it because there's like 10 major security breaches every single day. Just another one to add to the pile, there's more interesting things to read about.

[1] https://arstechnica.com/security/2023/07/microsoft-takes-pai...

Re: Microsoft lost its keys, and the government got hacked

#19

Post by lacrimacida »

2OEH8eoCRo0 wrote: post #13
dmvdoug wrote: post #12

Earlier quoted context omitted.

And yet, fascinatingly, very very little discussion. 60-ish comments was the most on any of those posts.

Mentioning China negatively is the kiss of death.

On HN? I don’t see censored comments with China mentions and this thread has been visible yet very few comments. What sort of manipulation I’ve seen on HN is threads being flagged or drop from top 30 to top 240 within an hour. Im suspect intel agencies have some ability to tilt the scales here on HN.

Re: Microsoft lost its keys, and the government got hacked

#20

Post by tgv »

formerly_proven wrote: post #16
dmvdoug wrote: post #12

Earlier quoted context omitted.

And yet, fascinatingly, very very little discussion. 60-ish comments was the most on any of those posts.

This really surprised me when I learned of this story on the weekend. Very little discussion, very little reception in IT news. Someone hacked Azure AD [1] and accessed the data of 25+ orgs and the reaction is *crickets*? [1] I'm not exactly sure which Azure component was hacked and the MS communication seems intentionally unclear and obtuse on this. It sounds like the private keys of Azure-internal auth servers were…

There was one issue where bing search results could be editted for any query by random users with an AAD account, and made to include a script that sends the Azure credentials of the user that happened to use that query to god-knows-where. And it wasn't the only service that was practically open. And another great thing: there were no logs.

That's an amazingly big, world-wide security hole, and how much interest did it draw? Hey, look, there's a celebrity scandal over there.

Post reply on HN