Comment by dimal | Hacker News Reader

Comment by dimal | Hacker News Reader

Parent Full thread

From Microsoft’s blog post on the incident (Mitigation and Hardening section):

- On June 26, OWA stopped accepting tokens issued from GetAccessTokensForResource for renewal, which mitigated the token renewal being abused.

- On June 27, Microsoft blocked the usage of tokens signed with the acquired MSA key in OWA preventing further threat actor enterprise mail activity.

- On June 29, Microsoft completed replacement of the key to prevent the threat actor from using it to forge tokens. Microsoft revoked all MSA signing which were valid at the time of the incident, including the actor-acquired MSA key. The new MSA signing keys are issued in substantially updated systems which benefit from hardening not present at issuance of the actor-acquired MSA key:

  - Microsoft has increased the isolation of these systems from corporate environments, applications, and users.Microsoft has refined monitoring of all systems related to key activity, and increased automated alerting related to this monitoring.

  - Microsoft has moved the MSA signing keys to the key store used for our enterprise systems.

- On July 3, Microsoft blocked usage of the key for all impacted consumer customers to prevent use of previously-issued tokens.

I’m not a security expert. What are the holes in this strategy?

The problem is that you have no way to verify what may or may not have been done by malicious actors using compromised keys in the meantime.

If you have immutable, permanent audit logs, you can go through all actions authenticated with something directly or indirectly signed by the leaked key. However, building such an audit log in a way that someone with maximum permissions still can't tamper with it is not easy — and not cheap. (And, worst case, the audit log may not have the necessary detail; e.g. just listing an authenticated identity, but not the way authentication was established — thus not allowing easy identification of possibly compromised access.)

As such, the hole in the strategy is that it doesn't account for other persistent backdoors that may have been added while access using this leaked key was possible. It only prevents further exploitation of the issue. But depending on the sophistication level of the attackers — which seems extremely high considering how the key was apparently stolen — it's nigh impossible to figure out how many secondary avenues of access they have established.

The problem with THAT line of thinking is:

* We already have confirmation that the US government has been tapping internet infrastructure, accessing back doors in BigTech backends, and compromising industry-wide encryption and RNG standards.

So there is no way to prove that SOMEONE at the NSA doesn't have the ability to access all of the information on the internet.

And, since the NSA is just more humans, that means there's no way to prove that someone else hasn't sold that ability or specific subsets of the data to malicious actors.

Post Snowden revelations, you have to do risk analysis. Is some US or Five Eyes Government Agency able to access all your personal information or business competitive secrets? Probably Yes. Can one of your competitors? Probably Not. Can a malicious neighbor or drug cartel that would then use it to extort you for money? Probably not.

So even in this hypothetical example where everything authenticated by Microsoft is tainted, it's not clear if it actually changes this equation significantly.

Could this be said for just about _any_ intrusion? Once you’ve been compromised, is there any way to know that no back doors were installed? Is this situation different than others?

Well, it really depends on the maximum privilege achieved by the intrusion, a user getting compromised hopefully can't do much more than exfiltrate data they have access to; local admin could compromise the OS or even the BIOS, then there's possibly multiple levels of domain admin, and then there's a compromise of the authentication system itself…

One big problem is that there's no way of knowing what other holes/backdoors were introduced during the period when the attacker had all those credentials. Maybe they are immediately able to get the new key.

Let's hope someone has spent the last 3 months reinstalling Azure from the original CD.

FCKGW-RHQQ2-YXRKT-8TG6W-2B7Q8

Thanks. I used to have that on a piece of paper taped to my tower. I don't have that tower but instantly recognized it.

You can but you need to install NT4 first, then do all the upgrades

[Laughs in Trusting Trust Problem]

"MSN Limited Edition Gold CD" is actually a thing.

Why is there no way of knowing? I would think Microsoft is able to do forensic snapshot comparisons for their datacenters -- at least, I would assume a trillion dollar company does.

Establishing that ability costs money (i.e. having snapshots & co.), and actually executing it costs further money.

Absent either customers paying for it, or regulations requiring it, Microsoft certainly won't sink money out of the goodness of their heart. I don't believe there are a lot of regulations for this — and how many customers do you think would pay for something like this? Realistically? :-(

I mean, they at least have SOC2 compliance, and obviously a lot more (FEDRAMP). To get those certifications an auditor is going to make sure you have basic shit in place like logging, etc.

They're not going to make sure of anything, in my experience, except that an org's IT management had a disappointing conversation with their team and then aspirationally checked boxes claiming to have things in place.

yeah, but SOC auditors barely understand the stuff you’re providing as proof.

It's gonna depend on the auditor, but yeah of course SOC2 doesn't mean "you're secure" but unless you actively lie to your auditor you're going to have some basic stuff in place.

no one can do what you suggest. it's nonsense.

These points seem to dispute the "the keys are compromised and still in use" and the "everything is tainted" title.

The article does not claim the keys are still in use. It specifically says "missing containment actions". Everything is tainted because you don't know what secondary actions were executed using the compromised keys.

Reply on news.ycombinator.com