Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everything authenticated by Microsoft is tainted

graz.social

Post reply on HN
Print view View original

341–350 of 381 posts

Re: Everything authenticated by Microsoft is tainted

#341

Post by archon810 »

insanitybit wrote: post #245

Such hyperbole. This was a bad breach, for sure, and we may not fully understand its scope at this point. But... > They were able to implant #backdoors, self-made keys, ... all over the place. I mean, emphasis on able to , as in "in theory, based on what I know, it is POSSIBLE", not that they did . > If you didn't understand until now: basically EVERYTHING at Microsoft got hacked and Microsoft can't (or won't) get ri…

Plot twist: the hackers have already taken over Microsoft and were the ones who published blog posts about how they'd handled the breaches.

Re: Everything authenticated by Microsoft is tainted

#343

Post by johnchristopher »

bastard_op wrote: post #104

He's absolutely right, you really can't trust anything they sign anymore. This is why Microsoft has been so defensive about their stance since it occurred. I've said the same since the news got out, but all my Microsoft-y friends I told didn't care. In fact, they all shrugged it off like "what are ya gonna do?" That's exactly the problem - what ARE companies going to do? Migrate OFF windoze? Migrate out of Azure? To…

> Certainly not, Microsoft-y admin only know Microsoft, they usually can't do much else, it's all they know.

I am a linux sysadmin. Honest question: Would I have an edge on a Microsoft-y admin or are linux sysadmin skillset limited to Linux ? I can find my way around a lot of network appliances (sophos, cisco, junyper, etc.) and I'd expect a windows system to be as capable.

Re: Everything authenticated by Microsoft is tainted

#344

Post by xorcist »

insanitybit wrote: post #327
xorcist wrote: post #325

Earlier quoted context omitted.

If you find yourself owned by, and not only from a 0-day, then yes, you wipe everything clean and re-build with mitigations in place from the start as to not get reinfected in the process. That's pretty much the only option if you safeguard valuable data for your customers. Yes, it's expensive to get breached, so take precautions to make it a rare event and contain it as much as possible when it happens. I don't thin…

I mean, yes, obviously, you have malware on a box you rotate that box. They had keys and they rotated the keys. But the implication here is that the attacker could have done anything and therefor they have to destroy everything , which is unreasonable.

Rotating keys are far from enough. If your keys are compromised, you need to revoke everything. Then you need to assess what the impact is and wipe anything the compromised keys had access to during the period.

This is not theoretical. When the openssl fiasco hit, I worked in a place under financial regulation. Not even the defense sector, which is under much stricter rules. We had to go through all logs to ascertain customer data was intact, and since leaking private keys did not leave a trace in the logs we then wiped clean all systems these keys secured.

This was a massive undertaking to coordinate and minimize downtime for customers but it was deemed necessary to comply with security regulations. To hear that a big juggernaut such as Microsoft doesn't even do this without facing much consequences is mind boggling. I can not understand how that would ever pass an audit.

Re: Everything authenticated by Microsoft is tainted

#346

Post by michaelcampbell »

ramranch wrote: post #333
aydyn wrote: post #330

Earlier quoted context omitted.

> The only selling point Microsoft has for Azure in some domains is that Amazon is their competitor. Can you explain this more? What's wrong with AWS compared to Azure?

The sentence is worded a little confusingly, but my interpretation of it is that for certain companies, since Amazon is a competitor in the business domain of that company, AWS is a nonstarter even if it's product offerings are a better choice. Walmart is the canonical example.

I worked for a company where this exact thing happened, for this exact reason.

I no longer work there, but they chose GCP because AWS wasn't even in the running because of this.

Re: Everything authenticated by Microsoft is tainted

#347

Post by CatWChainsaw »

ChatGTP wrote: post #10
panki27 wrote: post #2

I read a good analogy recently: The titanic (cloud) is sinking, the engine room is already full of water, but the people in the ballroom (execs) are still celebrating with champagne, even though the warnings have been called multiple times.

I read this recently, I found it chillingly similar to our current situation, a truly great read: The Machine Stops by E.M Foster https://web.cs.ucdavis.edu/~rogaway/classes/188/materials/th...

It's pretty impressive that the most accurate depiction of how the future will play out was written before even computers were a thing. Perhaps also a bit sad in what that says about us.

Re: Everything authenticated by Microsoft is tainted

#348

Post by insanitybit »

xorcist wrote: post #344
insanitybit wrote: post #327

Earlier quoted context omitted.

I mean, yes, obviously, you have malware on a box you rotate that box. They had keys and they rotated the keys. But the implication here is that the attacker could have done anything and therefor they have to destroy everything , which is unreasonable.

Rotating keys are far from enough. If your keys are compromised, you need to revoke everything. Then you need to assess what the impact is and wipe anything the compromised keys had access to during the period. This is not theoretical. When the openssl fiasco hit, I worked in a place under financial regulation. Not even the defense sector, which is under much stricter rules. We had to go through all logs to ascertain…

Revoke everything? Everything?

I have literally done incident response I am well aware of what the investigation process is like.

Re: Everything authenticated by Microsoft is tainted

#349

Post by yrro »

seabass-labrax wrote: post #328
yrro wrote: post #127

Earlier quoted context omitted.

More seriously, on my Debian stable system: $ dpkg -l ca-certificates Desired=Unknown/Install/Remove/Purge/Hold | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad) ||/ Name Version Architecture Description +++-===============-============-============-================================= ii ca-certificates 20230311 all Common CA certif…

Are you aware of what applications and services are verified by these keys? I am thinking it might be worth removing these specific root certificates if they are used only for a select number of purposes, considering that the vast majority of 'normal' websites use other CAs like DigiCert or Let's Encrypt.

Among other things, Azure services use certificates issued by those issuers.

Re: Everything authenticated by Microsoft is tainted

#350

Post by gtech1 »

jl6 wrote: post #220

> Security experts like Mike Kuketz think that most probably we need to consider all Microsoft systems that are using their cloud authentication including all Windows hosts are compromised . This is a giant claim. It does seem theoretically possible that a stolen signing key could have been used as part of a bigger attack to access critical services like Windows Update or the Azure control plane, but it does feel lik…

And someone would have noticed illicit activity using a stolen key for 2 years...oh wait
Post reply on HN