<story><title>Everything authenticated by Microsoft is tainted</title><url>https://graz.social/@publicvoit/111147782761723981</url></story><parent_chain><item><author>insanitybit</author><text>Such hyperbole. This was a bad breach, for sure, and we may not fully understand its scope at this point. But...&lt;p&gt;&amp;gt; They were able to implant #backdoors, self-made keys, ... all over the place.&lt;p&gt;I mean, emphasis on &lt;i&gt;able to&lt;/i&gt;, as in &amp;quot;in theory, based on what I know, it is POSSIBLE&amp;quot;, not that they &lt;i&gt;did&lt;/i&gt;.&lt;p&gt;&amp;gt; If you didn&amp;#x27;t understand until now: basically EVERYTHING at Microsoft got hacked and Microsoft can&amp;#x27;t (or won&amp;#x27;t) get rid of the intruders. Everything authenticated by Microsoft is tainted. Even #Windows auth.&lt;p&gt;Microsoft&amp;#x27;s response also seems to clearly state that they have rotated the keys, moved them to a more secure storage, etc. They don&amp;#x27;t say they&amp;#x27;ve removed the attackers, I guess, but they certainly don&amp;#x27;t indicate that the attack is ongoing. Certainly they don&amp;#x27;t indicate that all auth is forever broken.&lt;p&gt;I feel like the conclusions being drawn are extreme.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;msrc.microsoft.com&amp;#x2F;blog&amp;#x2F;2023&amp;#x2F;09&amp;#x2F;results-of-major-technical-investigations-for-storm-0558-key-acquisition&amp;#x2F;&quot; rel=&quot;nofollow noreferrer&quot;&gt;https:&amp;#x2F;&amp;#x2F;msrc.microsoft.com&amp;#x2F;blog&amp;#x2F;2023&amp;#x2F;09&amp;#x2F;results-of-major-tec...&lt;/a&gt;</text></item></parent_chain><comment><author>eqvinox</author><text>&amp;gt; I feel like the conclusions being drawn are extreme.&lt;p&gt;You linked Microsoft&amp;#x27;s investigation report on the exploit.&lt;p&gt;The attackers first managed to get access to Microsoft&amp;#x27;s development network, noticed a crashdump, &lt;i&gt;understood the possible significance of that&lt;/i&gt;, dug through it, found a private key, then acquired enough insight into Microsofts authentication systems to understand how this key &lt;i&gt;could be used beyond its intended purpose&lt;/i&gt; and then executed on that.&lt;p&gt;And you don&amp;#x27;t believe they left persistent backdoors in some high-profile targets?&lt;p&gt;The conclusions being drawn are … entirely appropriate.  Your argument maaaaaybe makes some sense applied to general public random cloud customers.  Backdooring indiscriminately just increases the risk of discovery.  But large companies and government users?  You have to assume compromise, anything else is incredulously naïve.&lt;p&gt;cf.:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.microsoft.com&amp;#x2F;en-us&amp;#x2F;security&amp;#x2F;blog&amp;#x2F;2023&amp;#x2F;07&amp;#x2F;14&amp;#x2F;analysis-of-storm-0558-techniques-for-unauthorized-email-access&amp;#x2F;&quot; rel=&quot;nofollow noreferrer&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.microsoft.com&amp;#x2F;en-us&amp;#x2F;security&amp;#x2F;blog&amp;#x2F;2023&amp;#x2F;07&amp;#x2F;14&amp;#x2F;ana...&lt;/a&gt;&lt;p&gt;&amp;gt; Storm-0558 operates with a high degree of technical tradecraft and operational security. The actors are keenly aware of the target’s environment, logging policies, authentication requirements, policies, and procedures. Storm-0558’s tooling and reconnaissance activity suggests the actor is technically adept, well resourced, and has an in-depth understanding of many authentication techniques and applications.</text></comment>
<story><title>Everything authenticated by Microsoft is tainted</title><url>https://graz.social/@publicvoit/111147782761723981</url></story><parent_chain><item><author>insanitybit</author><text>Such hyperbole. This was a bad breach, for sure, and we may not fully understand its scope at this point. But...&lt;p&gt;&amp;gt; They were able to implant #backdoors, self-made keys, ... all over the place.&lt;p&gt;I mean, emphasis on &lt;i&gt;able to&lt;/i&gt;, as in &amp;quot;in theory, based on what I know, it is POSSIBLE&amp;quot;, not that they &lt;i&gt;did&lt;/i&gt;.&lt;p&gt;&amp;gt; If you didn&amp;#x27;t understand until now: basically EVERYTHING at Microsoft got hacked and Microsoft can&amp;#x27;t (or won&amp;#x27;t) get rid of the intruders. Everything authenticated by Microsoft is tainted. Even #Windows auth.&lt;p&gt;Microsoft&amp;#x27;s response also seems to clearly state that they have rotated the keys, moved them to a more secure storage, etc. They don&amp;#x27;t say they&amp;#x27;ve removed the attackers, I guess, but they certainly don&amp;#x27;t indicate that the attack is ongoing. Certainly they don&amp;#x27;t indicate that all auth is forever broken.&lt;p&gt;I feel like the conclusions being drawn are extreme.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;msrc.microsoft.com&amp;#x2F;blog&amp;#x2F;2023&amp;#x2F;09&amp;#x2F;results-of-major-technical-investigations-for-storm-0558-key-acquisition&amp;#x2F;&quot; rel=&quot;nofollow noreferrer&quot;&gt;https:&amp;#x2F;&amp;#x2F;msrc.microsoft.com&amp;#x2F;blog&amp;#x2F;2023&amp;#x2F;09&amp;#x2F;results-of-major-tec...&lt;/a&gt;</text></item></parent_chain><comment><author>bilekas</author><text>&amp;gt; This was a bad breach, for sure, and we may not fully understand its scope at this point&lt;p&gt;&amp;gt; I mean, emphasis on able to, as in &amp;quot;in theory, based on what I know, it is POSSIBLE&amp;quot;, not that they did.&lt;p&gt;When you consider the potential implications, and possible scenarios, from a security perspective you have to assume that they&amp;#x27;re not just &amp;quot;possible&amp;quot; but a reality.&lt;p&gt;If you find a zero day exploit, you don&amp;#x27;t just ignore patching it because &amp;quot;well nobody else probably has it&amp;quot;.</text></comment>