Microsoft finally explains cause of Azure breach: An engineer’s account was hacked::Other failures along the way included a signing key improperly appearing in a crash dump.

  • foggy@lemmy.world
    link
    fedilink
    English
    arrow-up
    39
    arrow-down
    1
    ·
    1 year ago

    Man, I’d hate to be that guy.

    I wonder if there are repercussions for them? Like, eventually corporate hacking is going to be so sophisticated that even the most tech savvy will be vulnerable.

    • hemko@lemmy.dbzer0.com
      link
      fedilink
      English
      arrow-up
      22
      ·
      edit-2
      1 year ago

      Successful credential theft can really never be blamed on a single individual unless it can be proved to be malice. It’s always a systemic failure, even in cases where the user didn’t follow a process because of X. The issue was the X in the process and another user would have done the same thing eventually.

      And in this case we’re talking about technologically savvy person, an engineer (systems or software idk)

      • spacebirb@lemmy.world
        link
        fedilink
        English
        arrow-up
        4
        arrow-down
        1
        ·
        1 year ago

        Well… we can’t always assume the engineers are technologically savvy, I’ve met some pretty bad ones.

    • Steeve@lemmy.ca
      link
      fedilink
      English
      arrow-up
      7
      ·
      1 year ago

      Why would corporate hacking get sophisticated when the most efficient way to get access is still a simple phishing email?

    • Potatos_are_not_friends@lemmy.world
      link
      fedilink
      English
      arrow-up
      4
      ·
      1 year ago

      Ideally your company follows the swiss cheese model of incidents. It’s not the people, but the processes in place that brought us there.

      The only company I worked where that model didn’t follow was run by a moron who micromanaged, blamed people and was a Big fucking baby. That company went bankrupt after 3 years.

    • Bobby Turkalino@lemmy.yachts
      link
      fedilink
      English
      arrow-up
      2
      ·
      1 year ago

      Probably only if he was found to be grossly negligent. Otherwise, it’s really more of a methodology/procedural failing on the company’s part

  • AutoTL;DR@lemmings.worldB
    link
    fedilink
    English
    arrow-up
    11
    arrow-down
    1
    ·
    1 year ago

    This is the best summary I could come up with:


    Such keys, Microsoft said, are entrusted only to employees who have undergone a background check and then only when they are using dedicated workstations protected by multi-factor authentication using hardware token devices.

    To safeguard this dedicated environment, email, conferencing, web research, and other collaboration tools aren’t allowed because they provide the most common vectors for successful malware and phishing attacks.

    The hack of a Microsoft engineer’s corporate account allowed Storm-0558 to access the crash dump and, with it, the expired Exchange signing key.

    Addressing the second mystery, the post explained how an expired signing key for a consumer account was used to forge tokens for sensitive enterprise offerings.

    Human errors prevented a programming interface designed to cryptographically validate which environment a key from working properly.

    Thus, the mail system would accept a request for enterprise email using a security token signed with the consumer key (this issue has been corrected using the updated libraries).


    The original article contains 734 words, the summary contains 154 words. Saved 79%. I’m a bot and I’m open source!