The aftermath to the recent Microsoft Azure hack by suspected PRC actors.
What is the solution to this? Make sure cloud services are open source so they can be independently vetted? If government and corporate entities chose to use open source solutions, most are presented “as is” with no warranty.
Recently I was doing some Azure integration work, with OAuth, Teams and Outlook. At one point I noticed that logging in with a MS account causes my browser to do ~10 redirects between different services while downloading over 30 MB of Javascript and thought “Huh, this looks like decades of technical debt. Either MS devs are waaay smarter than me or this is a pile of garbage”. I guess both could be true.
All their services are like that! Redirects for days. It’s an absolute gong show believe me. It’s way worse than the public knows.
I’ve done some contracts there and yeah, while they are incredibly smart, there’s so much bloated corpo overhead that they are restricted by red tape. I’m not surprised a simple login takes 30 redirects at all.
They have no choice but to be smarter than us on account of the pile of garbage they’ve been given.
Or they simply hope, that the pile of garbage is smarter than the attackers.
Funny how on the consumer side, they keep pushing TPMs and other intrusive technologies under the guise of security, and they can’t even keep their shit together on the business end long enough for people to actually believe them.
Edit: Typo
I gotta stand up for my boy TPM. I manage a lot of Windows systems, and TPM does a lot of heavy lifting. I’m an open source advocate, but I recognize that without TPM, most users wouldn’t bother with encrypting their device.
And since Microsoft has strongly integrated it in their stack, it significantly reduces the need for regular signins and user focused security. Of course, this does require you to invest in their stack. There’s little to no support for machine level authentication for Linux. But in business, it really does make a practical and useful difference in security.
Oh yeah. Of course old tpm (1.2) that was the only key to the Castle isn’t great in the hand of someone with some know how and alligator clips since it communicated in clear text at the bus level so key extraction was possible. But for most folks security model, who cares. If it was a risk the business handled it with a pass phrase and tpm.
Apple does security prettt well and integrated too. Especially for most that don’t care.
Security theater. Like always.
It really is ridiculous at this point. Just a few weeks back they renamed one of their products on the backend (for no good reason) and broke a ton of stuff with no recourse besides “fix it yourself”. Pile on the endless updates and constant vulnerabilities and I don’t see how anyone can willingly choose to build new projects on it. They can’t even ship a usable replacement to win32!
On second thought though, pretty much every recent super-scalable cloud enterprise project of note is not Windows-centric anymore. Docker? Redis? Grafana? Kubes? The list goes on.
Why businesses continue to trust Microsoft I’ll never quite understand. The number of breaches Microsoft has had overall the last 5 years is amazing. Compare that to what I believe is the ZERO breaches Google has had in the same time frame. Not that Google is to be trusted, but if anything of magnitude would have happened there it would have certainly leaked by now.
Cloud at this point is very hard to ignore. Internal IT team sizes shrinking, it’s becoming harder running all of those business needs internally. Businesses will learn the hard way when they continue to put their trust in the cloud, especially Microsoft’s. Some facets of IT are just too much work to bother with keep hosting internally. Exchange is a steaming pile of garbage. I managed it for years, so I can see why people cloud their email. Which I’m all for, because email is just a bitch to run in general. But use Gmail or something else. It’s a night and day difference. I’m dreading the day my company decides that Microsoft is the better deal just because Office needs updating. Instead of keeping the status quo, spend the money training employees on alternatives and run as far as you can from Microsoft’s hold.
Microsoft makes a lot of good products but keeping them secure is an after thought.
deleted by creator
I forgot about the build bug. Ghost token I was unaware of. Ok so two? And ghost token required users to have had a allowed the malicious app in question.
Meaningful customers is an opinion. I can list a bunch.
deleted by creator
Why businesses continue to trust Microsoft I’ll never quite understand.
Technological debt and an easy path to hybrid environments.
“This incident demonstrates the evolving challenges of cybersecurity in the face of sophisticated attacks. We continue to work directly with government agencies on this issue, and maintain our commitment to continue sharing information at Microsoft Threat Intelligence blog."
Translation: Fixing bugs cost way to much more money than just leaving them in, so in order to save the profits, we just wait them out. If the shit hits the fan, we can still start looking into the issue and maybe get some PR coverage to distract the public.
But we still happily support government agencies to exploit the barndoor-sized holes in our software for whatever nefarious reasons they have because they pay us for that.
deleted by creator
Vendor lock-in. Accessibility to many tools for “non-technical” users. Groupthink. Bundles and anti-interoperability (see vendor lock-in). Fright of open source. Non-technical executives who trust the wrong people. That’s just off the top of my head.
Money and the fact that C-suite still has no f*%! clue about technology. They can tweet now. yay.
This is the best summary I could come up with:
Responding to Wyden’s letter last week, Microsoft brushed off the criticisms, saying: “This incident demonstrates the evolving challenges of cybersecurity in the face of sophisticated attacks.
Tenable is discussing the issue in only general terms to prevent malicious hackers from learning how to actively exploit it in the wild.
It is for this reason that we are withholding all technical details.” While Yoran’s post and Tenable’s disclosure avoid the word vulnerability, the email said the term is accurate.
The post came on the same day that security firm Sygnia disclosed a set of what it called “vectors” that could be leveraged following a successful breach of an Azure AD Connect account.
“The default configuration exposes clients to the described vectors only if privileged access was gained to the AD Connect server,” Ilia Rabinovich, director of adversarial tactics at Sygnia, wrote in an email.
I’m a bot and I’m open source!
I’m in favour of that regulation solely due to how much it would piss off Apple.
Beyond that, anyone who engages these services gets what they fucking deserve. Governments should be required to only use open-source software and host their own servers, everyone else is free to make stupid decisions.
Governments should be required to only use open-source software and host their own servers
As a citizen, I appreciate this sentiment. As a government employee, it’s misguided at best.
Governments compete with the private sector for skilled IT labor, but the take-home compensation for government jobs often doesn’t compare to private, and even retirement contributions and other benefits aren’t much better, leaving fewer and less skilled applicants to government jobs, since they don’t want to take a pay cut. This leads to a situation where employees that are hired to government don’t have the basic skills to maintain servers or host their own systems. Open source is seen as a naughty word, because if the person maintaining an open-source system leaves, finding a qualified replacement will be near impossible. Often times, contractors run complex platforms because the internal talent just isn’t present within the government’s staff. This leaves governments to rely on the most common tooling, which is unfortunately Microsoft/Adobe/Oracle/SAP dominated, in order to have hope of finding candidates capable of maintaining existing systems and expanding new features/tools. The public doesn’t have any desire to increase taxes in order to pay for a more skilled public sector workforce, so we’re stuck in this Microsoft and crappy closed source dominated environment. It really sucks to live with on a daily basis, because I know there’s so much great OSS out there, but the people surrounding me are completely incapable of getting it running and keeping it running.
