Hacker News Reader

Comment by insanitybit | Hacker News Reader

I think there's a huge difference between "maybe there is a backdoor" versus "literally all of microsoft, across all orgs, is owned and they have to shut it all down and start from scratch", call me crazy.

View on HN

That's really wishful thinking. Which is fine if you're a small company throwing non-sensitive things into Azure. If OTOH you were working as a SIEM at some company providing 2nd-order cloud services, this is where I would start questioning your qualifications and that company's overall policies.

(… especially when you're not even bringing up the fact that the compromised key was mainly usable to access e-mail)

I did indeed bring that up in another comment. I don't feel the need to repeat all information across all of my comments.

I don't know what your point is.

The "start from scratch" (or as we used to call it, 'nuke from orbit') approach is the only feasible one.

If an attacker had full root across the org for an undetermined (but not short) period, I'm unsure what other approach you think you could take? You can't just run MalwareBytes and call it a day.

Step 1 is to review your existing telemetry. You determine the possible scope of the attack based on the evidence you find. You remediate based on that. You may also want to consider scope that you don't have evidence for but that you lack telemetry for and that you believe an attacker could have accessed - that's fine too.

This comes down to a risk assessment. No company has a breach and just shuts everything down, that is insane. When we perform IR we build a detailed timeline, we collect the scope of potential access, and we form a remediation plan. We don't just go "well hey, anything can happen right? shut it all down".

Nuke it from orbit applies to a workstation, not an enterprise environment.

Nukes can be applied to all kinds of shit. It's easy enough to understand the implication of the phrase that there's no need to pretend it can only apply to specific items.

To me it sounds more like: Most likely backdoors have been planted.

So the question is how you handle such a situation.

Reply on news.ycombinator.com