Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft actions following attack by nation state actor Midnight Blizzard

msrc.microsoft.com

Post reply on HN
Print view View original

151–160 of 204 posts

Re: Microsoft actions following attack by nation state actor Midnight Blizzard

#151

Post by fauigerzigerk »

lazyasciiart wrote: post #145
fauigerzigerk wrote: post #142

Earlier quoted context omitted.

That may be how Microsoft would like to portray it but I disagree. A production system is a system that is operated to serve its actual purpose rather than being used as a development or testing environment. From the point of view of in-house IT, the company's email server is a production system. It is what they produce for their in-house customers.

That is how it has been defined at every SAAS company I have worked for. When someone says there is an outage in production, it means your product .

In the context of an outage at a service provider this slightly sloppy language is sufficient to convey all relevant meaning.

In the current context, this language is part of a pattern to carefully choose words in such a way as to downplay what has happened.

As I said, the work of the CEO, the cybersecurity team and the legal team is part of the overall production process at a software company.

Re: Microsoft actions following attack by nation state actor Midnight Blizzard

#152

Post by alexdns »

slackr wrote: post #134

Why do they say "nation state actor", isn't "state actor" the correct term? I thought Russia, like the UK and many other states, is a multinational state, including numerous languages and cultures.

> Why do they say "nation state actor"

A Nation-State is the idea of a homogenous nation governed by its own sovereign state—where each state contains one nation.

Re: Microsoft actions following attack by nation state actor Midnight Blizzard

#153

Post by GartzenDeHaes »

mr_mitm wrote: post #150
raccoonDivider wrote: post #138

Earlier quoted context omitted.

I've always wondered why infosec people love this expression so much. Maybe "nation state" just sounds more impressive. Who cares what the state is composed of? Or is it "nation/state", one or the other?

Clearly only a nation-state threat actor could have pulled off this highly sophisticated cyber attack of ... Spraying passwords

Seems a bit out of style to blame the Russians, but I guess that describes Microsoft in general.

Re: Microsoft actions following attack by nation state actor Midnight Blizzard

#154

Post by astrange »

rightbyte wrote: post #127
kgeist wrote: post #98

>Microsoft has identified the threat actor as Midnight Blizzard, the Russian state-sponsored actor also known as Nobelium How do they identify those groups?

They are just making it up. Security people seems to be of the militaristic type ofent, so I guess they add a slive of war mongering to it to to play ball. Iran, North Korea and what not. Very convenient since it is not falsifiable in practice.

They are certainly identifiable from their work. State hackers are professionals and they work like other professionals do; they work 9-5 in their local time zone and they have modular implants with code reuse. Amateurs aren't like this.

Re: Microsoft actions following attack by nation state actor Midnight Blizzard

#156

Post by AznHisoka »

fauigerzigerk wrote: post #142
lazyasciiart wrote: post #137

Earlier quoted context omitted.

No, they are not. Production systems are the systems that are producing money. If they stop running for an hour, it directly costs the company money through SLA penalties, etc. If the internal email server goes down for an hour, it might cause some employee productivity loss, depending on the timing.

That may be how Microsoft would like to portray it but I disagree. A production system is a system that is operated to serve its actual purpose rather than being used as a development or testing environment. From the point of view of in-house IT, the company's email server is a production system. It is what they produce for their in-house customers.

The only defintion that matters is the practical definition that most people would think of, not what the “book” says. Whenever someone tells me “production is down” I think that customers are screwed. If they told me our internal email servers are down, I would smack them in the head cause my stress levels went up for nothing. Internal servers is not production.

Re: Microsoft actions following attack by nation state actor Midnight Blizzard

#157

Post by amai »

„compromise a legacy non-production test tenant account and gain a foothold, and then used the account’s permissions to access a very small percentage of Microsoft corporate email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions, and exfiltrated some emails and attached documents.“

Does a non-production test account usually have permission to access email accounts of the senior leadership team? Is that a security best practice?

Re: Microsoft actions following attack by nation state actor Midnight Blizzard

#158

Post by Symbiote »

alexdns wrote: post #152
slackr wrote: post #134

Why do they say "nation state actor", isn't "state actor" the correct term? I thought Russia, like the UK and many other states, is a multinational state, including numerous languages and cultures.

> Why do they say "nation state actor" A Nation-State is the idea of a homogenous nation governed by its own sovereign state—where each state contains one nation.

And that definition doesn't describe the Russian Federation. There are many nations within Russia, ones you may have heard of are Bashkortostan (in the news this month due to protests) and Chechnya (civil wars in the 1990s). It is not a homogeneous federation.

https://en.wikipedia.org/wiki/Republics_of_Russia

Re: Microsoft actions following attack by nation state actor Midnight Blizzard

#159

Post by thanksgiving »

AznHisoka wrote: post #156
fauigerzigerk wrote: post #142

Earlier quoted context omitted.

That may be how Microsoft would like to portray it but I disagree. A production system is a system that is operated to serve its actual purpose rather than being used as a development or testing environment. From the point of view of in-house IT, the company's email server is a production system. It is what they produce for their in-house customers.

The only defintion that matters is the practical definition that most people would think of, not what the “book” says. Whenever someone tells me “production is down” I think that customers are screwed. If they told me our internal email servers are down, I would smack them in the head cause my stress levels went up for nothing. Internal servers is not production.

I think I disagree but we might be in agreement based on your thoughts… internal servers that are in the path of data pipelines that customers need are also production. For example, let’s say you have a warehouse and there is some way to manage inventory in there. No customer goes into Microsoft dynamics themselves. However, this Microsoft dynamics is production because our customers rely on the data this provides.

It doesn’t matter to customers if Microsoft teams is down and we are talking to each other internally using iMessage and signal but anything that is in the data path is production.

Re: Microsoft actions following attack by nation state actor Midnight Blizzard

#160

Post by fauigerzigerk »

AznHisoka wrote: post #156
fauigerzigerk wrote: post #142

Earlier quoted context omitted.

That may be how Microsoft would like to portray it but I disagree. A production system is a system that is operated to serve its actual purpose rather than being used as a development or testing environment. From the point of view of in-house IT, the company's email server is a production system. It is what they produce for their in-house customers.

The only defintion that matters is the practical definition that most people would think of, not what the “book” says. Whenever someone tells me “production is down” I think that customers are screwed. If they told me our internal email servers are down, I would smack them in the head cause my stress levels went up for nothing. Internal servers is not production.

But we're not talking about a service outage. In the context of an outage at a service provider I might agree with you.

In this instance, a system used by the cybersecurity team to do its actual job was breached - not some development or testing server.

We don't know what it was exactly that these attackers were looking for or what they found. But it is absolutely possible that the information they gained enables them to protect an ongoing or future attack against Microsoft's customers.

Post reply on HN