Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everything authenticated by Microsoft is tainted

graz.social

Post reply on HN
Print view View original

191–200 of 381 posts

Re: Everything authenticated by Microsoft is tainted

#191

Post by lapinot »

Spivak wrote: post #167
bastard_op wrote: post #104

He's absolutely right, you really can't trust anything they sign anymore. This is why Microsoft has been so defensive about their stance since it occurred. I've said the same since the news got out, but all my Microsoft-y friends I told didn't care. In fact, they all shrugged it off like "what are ya gonna do?" That's exactly the problem - what ARE companies going to do? Migrate OFF windoze? Migrate out of Azure? To…

> own ways to do anything but be a slave to Microsoft I guarantee 99/100 humans on this forum either currently host with AWS/GCP/Azure or have worked at a shop that does. And I bet an outsized portion of those AWS/GCP shops also host on Azure for Azure AD. There is no one that is ready for a de-Microsofted world. Even Linux distros have been increasing their support for integrating into the MS ecosystem and forsaking…

What's wrong with openldap? I mean, apart from being a pita, i thought it was the widely used central auth directory (behind all sorts of sso frontends).

Re: Everything authenticated by Microsoft is tainted

#192

Post by tzs »

squarefoot wrote: post #86
orionblastar wrote: post #50

Earlier quoted context omitted.

I used to work as a federal contractor for the US Military in 1996-1997 and they replaced their Windows Web Servers with Macintosh ones because the Mac had better security. I used to run a Windows 2000 Pro web server, after lack of security I switched to Linux. Microsoft may be popular, but they have big holes in their security. Always has been.

Also worth of mentioning, the USS Yorktown incident which happened in that period. https://www.wired.com/1998/07/sunk-by-windows-nt/

No, that is not worth mentioning because that problem had nothing whatsoever to do with the operating system.

What happened was that someone entered a 0 on a data entry form in a field that was not supposed to be 0. That form was submitted to an application on a server, which used it as a divisor and got a divide by zero exception.

That application did not handle divide by zero exceptions and so was terminated by the OS.

With the server application no longer running terminals around the ship that relied on that application were no longer useful.

Re: Everything authenticated by Microsoft is tainted

#193

Post by stonemetal12 »

EGreg wrote: post #156
the8472 wrote: post #145

Earlier quoted context omitted.

It's not the first time that a company got compromised due to microsoft software. This time it was their cloud offering, the previous N times it was AD, Exchange, Outlook, WSUS (for delayed updates), ... And even if they'd move to something else they'd reach for solutions that also get their tentacles into everything because those solutions are convenient during those time windows where they're not exploited.

Wasn’t SolarWinds Microsoft software being compromised too? When the US govt got hacked they actually did something about it government-wide. Started new security standards. For themselves and their vendors like M$

SolarWinds is the name of company that was compromised, and as far as I can tell was never owned by MS.

Re: Everything authenticated by Microsoft is tainted

#194

Post by dimal »

From Microsoft’s blog post on the incident (Mitigation and Hardening section):

- On June 26, OWA stopped accepting tokens issued from GetAccessTokensForResource for renewal, which mitigated the token renewal being abused.

- On June 27, Microsoft blocked the usage of tokens signed with the acquired MSA key in OWA preventing further threat actor enterprise mail activity.

- On June 29, Microsoft completed replacement of the key to prevent the threat actor from using it to forge tokens. Microsoft revoked all MSA signing which were valid at the time of the incident, including the actor-acquired MSA key. The new MSA signing keys are issued in substantially updated systems which benefit from hardening not present at issuance of the actor-acquired MSA key:

  - Microsoft has increased the isolation of these systems from corporate environments, applications, and users.Microsoft has refined monitoring of all systems related to key activity, and increased automated alerting related to this monitoring.

  - Microsoft has moved the MSA signing keys to the key store used for our enterprise systems.
- On July 3, Microsoft blocked usage of the key for all impacted consumer customers to prevent use of previously-issued tokens.

I’m not a security expert. What are the holes in this strategy?

Re: Everything authenticated by Microsoft is tainted

#195

Post by daxelrod »

lokar wrote: post #178
Spivak wrote: post #167

Earlier quoted context omitted.

> own ways to do anything but be a slave to Microsoft I guarantee 99/100 humans on this forum either currently host with AWS/GCP/Azure or have worked at a shop that does. And I bet an outsized portion of those AWS/GCP shops also host on Azure for Azure AD. There is no one that is ready for a de-Microsofted world. Even Linux distros have been increasing their support for integrating into the MS ecosystem and forsaking…

My entire adult life and career has been MS free. It’s not that rare.

MS is still probably somewhere in the supply chain of software you use.

They have contributed to the Linux Kernel, they own GitHub and NPM, they make an extremely popular editor, among other things.

It’s a different set of risks than depending on them directly, but they’re still there.

Re: Everything authenticated by Microsoft is tainted

#196

Post by lokar »

argiopetech wrote: post #184
lokar wrote: post #178

Earlier quoted context omitted.

My entire adult life and career has been MS free. It’s not that rare.

It's not that rare for developers and sys admins. It's pretty rare outside of that, particularly if you're on a corporate-managed system. Wander down to HR or finance or legal and see how many *nix systems you see.

I think ours have macs

Re: Everything authenticated by Microsoft is tainted

#197

Post by erksa »

foepys wrote: post #42
victor106 wrote: post #23

This issue is specific to Azure and Microsoft. I find AWS and GCP to be fine. Microsoft has some of the worst security vulnerabilities and practices I have ever seen. I can’t for the life of me figure out how executives at big Fortune 500 move their workloads to Azure. The only selling point Microsoft has for Azure in some domains is that Amazon is their competitor. I wish Amazon just let AWS be it’s own thing. I als…

Microsoft is luring in non-tech companies with Active Directory and Office 365 and then catches them with promises about good integration into all services. Once the companies are in the Azure dashboard, why not try those fancy services they offer? It's all smoke and mirrors but it works.

From what I've heard from cloud consultants in Scandinavia (which is going through a huge move to the cloud as many places) the Microsoft Azure sales machine is on another level compared to competitors.

Microsoft will show up with 10 sales engineer, while others might just be a contractor or a zoom call.

They present themself as the authority for non-technical business and is winning a lot on that.

They're good at capturing market share, no doubt about it.

Re: Everything authenticated by Microsoft is tainted

#198

Post by Ylpertnodi »

bluepizza wrote: post #163
TedDoesntTalk wrote: post #149

Earlier quoted context omitted.

> deserve what they get sadly This is incredibly insensitive and dismissive, and victim-blaming.

Hard disagree. This is professional negligence. How would you feel if your doctor only prescribed medicine from one single supplier?

If the single supplier supplied the correct medicine, and it works, why worry?

Re: Everything authenticated by Microsoft is tainted

#199

Post by Spivak »

lokar wrote: post #178
Spivak wrote: post #167

Earlier quoted context omitted.

> own ways to do anything but be a slave to Microsoft I guarantee 99/100 humans on this forum either currently host with AWS/GCP/Azure or have worked at a shop that does. And I bet an outsized portion of those AWS/GCP shops also host on Azure for Azure AD. There is no one that is ready for a de-Microsofted world. Even Linux distros have been increasing their support for integrating into the MS ecosystem and forsaking…

My entire adult life and career has been MS free. It’s not that rare.

Your whole office? Like sure whatever, I don't use Windows but that doesn't count. The IT directory server is Azure AD and is the SSO for everything non-dev related Slack/JIRA/the office VPN.

Re: Everything authenticated by Microsoft is tainted

#200

Post by nerdbert »

dimal wrote: post #194

From Microsoft’s blog post on the incident (Mitigation and Hardening section): - On June 26, OWA stopped accepting tokens issued from GetAccessTokensForResource for renewal, which mitigated the token renewal being abused. - On June 27, Microsoft blocked the usage of tokens signed with the acquired MSA key in OWA preventing further threat actor enterprise mail activity. - On June 29, Microsoft completed replacement of…

One big problem is that there's no way of knowing what other holes/backdoors were introduced during the period when the attacker had all those credentials. Maybe they are immediately able to get the new key.
Post reply on HN