Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everything authenticated by Microsoft is tainted

graz.social

Post reply on HN
Print view View original

291–300 of 381 posts

Re: Everything authenticated by Microsoft is tainted

#291

Post by insanitybit »

bogwog wrote: post #273
jerska wrote: post #262

Earlier quoted context omitted.

Of course you patch it, but you don’t assume that every system affected by this 0-day got exploited. You try to check if some were and it’s obvious that people at Microsoft are doing exactly that. Not saying that MS’s response was great, but I agree with GP that the whole thing is hyberbolic.

> Of course you patch it, but you don’t assume that every system affected by this 0-day got exploited. Uhh, what? Of course you do. Why give the benefit of the doubt to hackers who hacked you with malicious intentions? That's the type of security nonsense that I'd expect from... Well, Microsoft lol

So every time a 0day is released you buy a net new device? Cause there are 0days like... every day.

Re: Everything authenticated by Microsoft is tainted

#292

Post by darepublic »

I just remember the Microsoft 2fa flow was very janky. And that there would be a pointless prompt that would popup everytime replete with a don't ask again checkbox. However none of the options actually did anything it was a pointless thing you had to click through every time. That corporate pastel coloured jank. That inattention to small details to help out the user. Classic MS

Re: Everything authenticated by Microsoft is tainted

#293

Post by smt88 »

ladams wrote: post #157
TedDoesntTalk wrote: post #149

Earlier quoted context omitted.

> deserve what they get sadly This is incredibly insensitive and dismissive, and victim-blaming.

Is it? Every large company has a well compensated CTO whose job it is to think through these sorts of hypotheticals. But “nobody gets fired for choosing Microsoft”, and so the monopoly continues…

Some of my large enterprise clients require us to use Microsoft too, so that decision can radiate outward beyond large, conservative companies.

Re: Everything authenticated by Microsoft is tainted

#294

Post by jameshart »

hedora wrote: post #231
bastard_op wrote: post #104

He's absolutely right, you really can't trust anything they sign anymore. This is why Microsoft has been so defensive about their stance since it occurred. I've said the same since the news got out, but all my Microsoft-y friends I told didn't care. In fact, they all shrugged it off like "what are ya gonna do?" That's exactly the problem - what ARE companies going to do? Migrate OFF windoze? Migrate out of Azure? To…

Moving off Windows or Azure or whatever probably isn't adequate. All architectures based on certificate authorities are fundamentally fragile in the same way. People look at me like my head is spinning when I suggest just adding ephemeral self-signed CA root certs to deployment pipelines (or, god forbid, use SSH keys, or even symmetric keys). However, those approaches have a much, much smaller attack surface than HTT…

I’m not sure exactly what role in what sort of deployment pipeline you’re suggesting for ephemeral root certs here, and you may well have a solid handle on how to do this safely.

But one reason I might initially look at you with alarm if you suggest self-signing or symmetric keys as part of a solution in general is… while it might reduce the attack surface, attack surface is not the only thing to worry about. Another thing to consider is the ‘fuckup surface’ of a particular architecture.

And one problem that self managed key distribution strategies tend to run into is that they massively increase your fuckup surface. Losing the keys to everything can become a real danger.

I’m a big believer in building security systems that also reduce the blast radius of dumb errors (accidentally running rm -rf /* is harmless if you religiously run with least privilege).

Saying ‘I’m going to build my own trust root’ generally seems to me like it probably increases the blast radius.

Re: Everything authenticated by Microsoft is tainted

#295

Post by eqvinox »

mycall wrote: post #270
nerdbert wrote: post #200

Earlier quoted context omitted.

One big problem is that there's no way of knowing what other holes/backdoors were introduced during the period when the attacker had all those credentials. Maybe they are immediately able to get the new key.

Why is there no way of knowing? I would think Microsoft is able to do forensic snapshot comparisons for their datacenters -- at least, I would assume a trillion dollar company does.

Establishing that ability costs money (i.e. having snapshots & co.), and actually executing it costs further money.

Absent either customers paying for it, or regulations requiring it, Microsoft certainly won't sink money out of the goodness of their heart. I don't believe there are a lot of regulations for this — and how many customers do you think would pay for something like this? Realistically? :-(

Re: Everything authenticated by Microsoft is tainted

#296

Post by insanitybit »

ChatGTP wrote: post #44
ranting-moth wrote: post #36

Earlier quoted context omitted.

But the cloud is much safer. It's not like someone is going to hack the whole Microsoft cloud. Oh, hang on ...

Funny as this was one of the winning arguments when we went to the cloud, couldn’t possible be safer to host your own, right ? RiGhT?

This has largely held true for AWS and I think it's still a meaningful argument in a broader discussion when determining how you want to build your company infrastructure.

Re: Everything authenticated by Microsoft is tainted

#297

Post by insanitybit »

ChatGTP wrote: post #13
MaKey wrote: post #3

Give it a few years and then on-prem hardware and simple server hosting will become fashionable again.

Microsoft has fucked up forever, look at their share price…I hope you’re right but I doubt it.

Microsoft obviously cares about its stock but it also relies on long term contracts with large enterprise and government - those aren't rolling overnight, maybe not at all, but there will be immense pressure from these massive organizations to fix things.

Re: Everything authenticated by Microsoft is tainted

#298

Post by temac »

bastard_op wrote: post #104

He's absolutely right, you really can't trust anything they sign anymore. This is why Microsoft has been so defensive about their stance since it occurred. I've said the same since the news got out, but all my Microsoft-y friends I told didn't care. In fact, they all shrugged it off like "what are ya gonna do?" That's exactly the problem - what ARE companies going to do? Migrate OFF windoze? Migrate out of Azure? To…

The concept of Microsoft-y admins supposedly unable to work with other tools is insane. There is not much in common between let's say Windows and MS365. Even within MS365 the integration between various tools is often not seemless and when you start using powershell admin common there are completely random differences between the way you login, plus where some features are implemented is also completely random (e.g. tons of non email things in exchange, at least accessed through the exchange ps connector)

If an admin is able to navigate in all that shit, I don't know why they would not understand e.g. random unix tools.

Re: Everything authenticated by Microsoft is tainted

#299

Post by eqvinox »

insanitybit wrote: post #228
dimal wrote: post #194

From Microsoft’s blog post on the incident (Mitigation and Hardening section): - On June 26, OWA stopped accepting tokens issued from GetAccessTokensForResource for renewal, which mitigated the token renewal being abused. - On June 27, Microsoft blocked the usage of tokens signed with the acquired MSA key in OWA preventing further threat actor enterprise mail activity. - On June 29, Microsoft completed replacement of…

These points seem to dispute the "the keys are compromised and still in use" and the "everything is tainted" title.

The article does not claim the keys are still in use. It specifically says "missing containment actions". Everything is tainted because you don't know what secondary actions were executed using the compromised keys.

Re: Everything authenticated by Microsoft is tainted

#300

Post by Deathcrow »

mycall wrote: post #270
nerdbert wrote: post #200

Earlier quoted context omitted.

One big problem is that there's no way of knowing what other holes/backdoors were introduced during the period when the attacker had all those credentials. Maybe they are immediately able to get the new key.

Why is there no way of knowing? I would think Microsoft is able to do forensic snapshot comparisons for their datacenters -- at least, I would assume a trillion dollar company does.

no one can do what you suggest. it's nonsense.
Post reply on HN