The aftermath to the recent Microsoft Azure hack by suspected PRC actors.
What is the solution to this? Make sure cloud services are open source so they can be independently vetted? If government and corporate entities chose to use open source solutions, most are presented “as is” with no warranty.
Funny how on the consumer side, they keep pushing TPMs and other intrusive technologies under the guise of security, and they can’t even keep their shit together on the business end long enough for people to actually believe them.
Edit: Typo
It really is ridiculous at this point. Just a few weeks back they renamed one of their products on the backend (for no good reason) and broke a ton of stuff with no recourse besides “fix it yourself”. Pile on the endless updates and constant vulnerabilities and I don’t see how anyone can willingly choose to build new projects on it. They can’t even ship a usable replacement to win32!
On second thought though, pretty much every recent super-scalable cloud enterprise project of note is not Windows-centric anymore. Docker? Redis? Grafana? Kubes? The list goes on.
I gotta stand up for my boy TPM. I manage a lot of Windows systems, and TPM does a lot of heavy lifting. I’m an open source advocate, but I recognize that without TPM, most users wouldn’t bother with encrypting their device.
And since Microsoft has strongly integrated it in their stack, it significantly reduces the need for regular signins and user focused security. Of course, this does require you to invest in their stack. There’s little to no support for machine level authentication for Linux. But in business, it really does make a practical and useful difference in security.
Oh yeah. Of course old tpm (1.2) that was the only key to the Castle isn’t great in the hand of someone with some know how and alligator clips since it communicated in clear text at the bus level so key extraction was possible. But for most folks security model, who cares. If it was a risk the business handled it with a pass phrase and tpm.
Apple does security prettt well and integrated too. Especially for most that don’t care.
Recently I was doing some Azure integration work, with OAuth, Teams and Outlook. At one point I noticed that logging in with a MS account causes my browser to do ~10 redirects between different services while downloading over 30 MB of Javascript and thought “Huh, this looks like decades of technical debt. Either MS devs are waaay smarter than me or this is a pile of garbage”. I guess both could be true.
They have no choice but to be smarter than us on account of the pile of garbage they’ve been given.
“This incident demonstrates the evolving challenges of cybersecurity in the face of sophisticated attacks. We continue to work directly with government agencies on this issue, and maintain our commitment to continue sharing information at Microsoft Threat Intelligence blog."
Translation: Fixing bugs cost way to much more money than just leaving them in, so in order to save the profits, we just wait them out. If the shit hits the fan, we can still start looking into the issue and maybe get some PR coverage to distract the public.
But we still happily support government agencies to exploit the barndoor-sized holes in our software for whatever nefarious reasons they have because they pay us for that.
This is the best summary I could come up with:
Responding to Wyden’s letter last week, Microsoft brushed off the criticisms, saying: “This incident demonstrates the evolving challenges of cybersecurity in the face of sophisticated attacks.
Tenable is discussing the issue in only general terms to prevent malicious hackers from learning how to actively exploit it in the wild.
It is for this reason that we are withholding all technical details.” While Yoran’s post and Tenable’s disclosure avoid the word vulnerability, the email said the term is accurate.
The post came on the same day that security firm Sygnia disclosed a set of what it called “vectors” that could be leveraged following a successful breach of an Azure AD Connect account.
“The default configuration exposes clients to the described vectors only if privileged access was gained to the AD Connect server,” Ilia Rabinovich, director of adversarial tactics at Sygnia, wrote in an email.
I’m a bot and I’m open source!