Microsoft lost its keys, and the government got hacked

https://techcrunch.com/2023/07/17/microsoft-lost-keys-government-hacked/

by tim_sw • 3 years ago

317 140 3 years ago

michaelteter2• 3 years ago

Perhaps preceding your list of related links you could state that the following is a list of (recent?) related HN submissions.

nubinetwork3• 3 years ago

I'll consider it.

sysop073• 3 years ago

You thought perhaps they commented a list of random unrelated HN submissions?

djbusby• 3 years ago

How did you even get all those so fast?

nubinetwork3• 3 years ago

Search box, typed in Microsoft and scrolled through a week's worth of submissions.

mschuster914• 3 years ago

Look at hn.algolia.com, they index pretty much everything on here.

yladiz• 3 years ago

Just posting these links, some of which have no comments, is a bit much and not actually helpful. It would be better to do a little more curation and choose the most active ones.

bcjordan• 3 years ago

Played with writing a little script to format/sort that:

Microsoft takes pains to obscure role in 0-days that caused email breach - https://news.ycombinator.com/item?id=36740133 - (64 comments)

Microsoft still unsure how hackers stole Azure AD signing key - https://news.ycombinator.com/item?id=36731731 - (9 comments)

WSJ: China allegedly hacked Microsoft Azure - https://news.ycombinator.com/item?id=36693469 - (6 comments)

Microsoft Warns That a Chinese Cyberattack Breached Government Email Accounts - https://news.ycombinator.com/item?id=36697272 - (5 comments)

Thousands of Microsoft Customers May Have Been Victims of Hack Tied to China - https://news.ycombinator.com/item?id=36692494 - (3 comments)

Microsoft government email compromised (and quietly fixed) - https://news.ycombinator.com/item?id=36696852 - (3 comments)

WSJ: China Hacking Undetectable from Less Expensive Microsoft Services - https://news.ycombinator.com/item?id=36713560 - (2 comments)

Chinese Hackers Breached Government Email Accounts, Microsoft Says - https://news.ycombinator.com/item?id=36690598 - (1 comments)

China-based hackers breached US gov email accounts, say Microsoft, White House - https://news.ycombinator.com/item?id=36694188 - (1 comments)

Microsoft mitigates 0-day, allowing forged AD tokens - https://news.ycombinator.com/item?id=36708294 - (1 comments)

A cloud flaw gave Chinese spies a key to Microsoft’s kingdom - https://news.ycombinator.com/item?id=36716028 - (1 comments)

Chinese hackers breach email of Commerce SEC Raimondo and State Dept officials - https://news.ycombinator.com/item?id=36719412 - (1 comments)

13 posts with no comments: https://gist.github.com/bcjordan/b579960792ee146f905c3e66f39...

dmvdoug2• 3 years ago

And yet, fascinatingly, very very little discussion. 60-ish comments was the most on any of those posts.

2OEH8eoCRo03• 3 years ago

Mentioning China negatively is the kiss of death.

TheRealDunkirk2• 3 years ago

Yeah, this is really, really weird.

formerly_proven2• 3 years ago

This really surprised me when I learned of this story on the weekend. Very little discussion, very little reception in IT news.

Someone hacked Azure AD[1] and accessed the data of 25+ orgs and the reaction is *crickets*?

[1] I'm not exactly sure which Azure component was hacked and the MS communication seems intentionally unclear and obtuse on this. It sounds like the private keys of Azure-internal auth servers were stolen, but technically those private keys were not supposed to work for the accounts/orgs in question, except they did, and, in any case, MS doesn't disclose how the private keys (one? multiple?) of their cloud auth servers were stolen.

NVHacker• 3 years ago

"Use MS products and you will get hacked" is not exactly news, is it ?

JamesonNetworks• 3 years ago

Seems like they are assuming the same key was used to forge tokens and jump from that assumption to the conclusion that they found all instances of requests. If more keys were used to generate more tokens, isn’t it possible this attack had a much wider surface area?

breadwinner• 3 years ago

As a rule of thumb, hacks are always worse than initially thought. See https://circles.page/5680a56b5c28af0998656e09/Hacks-worse-th...

jamesjuicy55• 3 years ago

Absolutely. Maybe Louisiana and Oregon DMV hacks?

2OEH8eoCRo03• 3 years ago

Microsoft still doesn’t know — or want to share — how China-backed hackers stole a key that allowed them to stealthily break into dozens of email inboxes, including those belonging to several federal government agencies.

dralley• 3 years ago

Speculation: insider threat

2OEH8eoCRo03• 3 years ago

That would be my amateur guess as well which scares me in a couple of ways.

victor1062• 3 years ago

One of the reasons why we moved away from using Microsoft products for our identity management to Okta.

Not that they are bad products per se, but as many organizations use Microsoft products they are prime targets for too many hackers and it’s hard going to bed thinking that your identity info might be hacked someday and/or not knowing if it will be.

The surface area that Azure/Microsoft have is just too large for it to assume to be protected by one company whose security as not been the most stellar. So we are actively moving to GCP as well.

likecarter• 3 years ago

Okta has been hacked a couple times now...

azemetre• 3 years ago

Was about to say, wasn't all their source code stolen too?

https://techcrunch.com/2022/12/22/okta-breach-source-code-gi...

Okta looked very bad during the entire saga where they kept denying they were hacked until the proof was insurmountable. Pretty sure there was a large discussion on HN at the time too.

EthanHeilman• 3 years ago

To toot my own companies horn[0] we designed our authentication protocol OpenPubkey[1] to have two signers on tokens:

1. The IDP signer (like microsoft or google) 2. The Cosigner (like bastionzero.com)

...so that even if microsoft's signing key is stolen, the attacker also needs to compromise the cosigner's signing key as well. It's like multisig for authentication tokens.

I don't know if OpenPubkey would have helped in this particular case as the details are still coming out[2], but I think the future of authentication schemes must require that authentication tokens must be signed by multiple signers at different organizations; Authentication systems with single point of compromise signing keys is too fragile. Or put another way authentication via multiple independent roots of trust is just too powerful of a security tool not to use.

[0]: BastionZero, https://bastionzero.com

[1]: OpenPubkey: Augmenting OpenID Connect with User held Signing Keys, https://eprint.iacr.org/2023/296

[2]: It appears the key stolen was an MSA key, not an Azure AD signing key. The MSA architecture might not fit into the OpenPubkey model (or it might I don't know enough about MSA signing keys work to say). Had it been an Azure AD signing key then OpenPubkey would mitigate the theft of an Azure AD Signing key. https://www.microsoft.com/en-us/security/blog/2023/07/14/ana...

fsociety• 3 years ago

Okta is also a prime target for hackers, and likely has a smaller security budget than Microsoft.

AtNightWeCode• 3 years ago

We use MS for some stuff and did use Okta for others. But... Okta fkd up and can never be used in any enterprise today. We migrated from it. Everybody should. Now we use MS and Google. Okta is probably the most over-priced service in history of CS especially considering the poor sec design. They do however solve the US-Franchise-Corp bs that I guess it was designed for.

exabrial• 3 years ago

Any Windows product/system is a liability. I'm not sure how to put this lightly. It was designed to create a monopoly first before any other goal.

And it's not that the alternatives are perfect, but Windows is as secure as swiss cheese.

Rygian• 3 years ago

as secure as swiss cheese

In IT security jargon, the "Swiss cheese" model is a good practice: https://en.wikipedia.org/wiki/Swiss_cheese_model

nyolfen• 3 years ago

this is not windows

lostmsu2• 3 years ago

Any Windows product/system is a liability.

A self-evident realization: every single product/system is a liability.

TheRealDunkirk2• 3 years ago

I know this is a bit of a thread jack, but this same attitude now playing out on Xbox in the console space. The recent FTC attempt to block the Activision merger surfaced emails saying that they were just going to outspend Sony to further consolidate and buy a higher position in the market, because they can.

There's nothing in any of Microsoft's revealed communications over the years where they ever seem to aspire to make better products. I mean, sure, obviously, there are pockets inside the company, but that has never seemed to be the purview of the board or the executives. If there's a thought leader in there somewhere who had passion to make great products like Jobs, I can't think of who it would be.

I almost feel bad for Microsoft, and I say this as a Microsoft-hater and Linux zealot who ran it on the desktop for 19 years before switching to Mac. It's the legacy backward-compatibility that makes Windows so attractive to a lot of organizations which makes it so vulnerable. OTOH, corporate IT divisions love it because Microsoft lets them do all sorts of stupid things to it, like prevent me from changing the desktop background, so it's kind of a deserved punishment.

nashashmi2• 3 years ago

Heartbleed did not affect windows.

zingababba• 3 years ago

Interesting that it aligned with their AAD rebrand.

jtbayly• 3 years ago

This headline does a good job of pointing out why we shouldn't allow backdoors in encryption.

naikrovek3• 3 years ago

no one said it was a backdoor, though. you have to have a key to encrypt stuff, and it was that key which got leaked, somehow. a backdoor is a way around the use of a key to see secret messages, or an alternate key which allows you to view messages without compromising the key which encrypts messages in normal operation.

could have been a backdoor, sure, could have been something else. could have been carelessness. could have been blackmail. could have been a rogue employee. could have been malware, spear fishing, or any one of a hundred other things.

did I miss something or are you premature in blaming this on a backdoor?

ketralnis• 3 years ago

They didn't say it was an intentional backdoor. But if it were, the result would be the same.

It's hard to secure encryption keys. If you had a backdoor based on a key that you had to keep secret, leaks like these can happen. If Microsoft (or anyone) can't keep their encryption keys secure, they'd be equally unable to keep a backdoor key secure for the same reason.

thephyber• 3 years ago

But an encryption back door is either a second key that someone else holds or it is some piece of information the public should not know about.

Either way, when the details about the back door leak, the system ceases to retain the properties of secure encryption.

thomastjeffery• 3 years ago

no one said it was a backdoor, though.

That includes the comment you are replying to.

Spooky232• 3 years ago

If Microsoft can’t manage to hold onto these critical encryption keys, why do you think that <insert nation state x> will?

When your data is stolen because you were working in Cancun and the Mexican CIA was compromised, will you ever even know?

The point isn’t blaming a back door, it’s just pointing out that the more stakeholder that possess a key, the higher the probability of a compromise.

nashashmi2• 3 years ago

Wasn't there a time when Microsoft shared it's code with China govt on a locked computer in a locked room with access to only a few people as a demonstration that there product did not have backdoors for western countries to spy on China?

somerandomqaguy• 3 years ago

IIRC it wasn't just China, I think it was any government that required an audit of the Windows source code. I can't remember if the US government though requested access.

Zelphyr2• 3 years ago

I hate to go negative. I really do because, usually it doesn't improve the discourse whatsoever.

However, I feel like it needs to be said: Microsoft makes bad products[1]! They're overpriced, insecure, slow (it's astounding to me how slow their web properties are), and hard to use. Easily some of the worst UI I've ever seen and, what's worse, they've been like that my entire career. They keep slapping lipstick on the same pigs and claiming to have reinvented themselves.

Their support is so ungodly bad that it literally took one of their reps over a day to figure out what timezone I'm in. Meanwhile, two of my employees' emails were being randomly CC'd to the CEO for no apparent reason. The cause? Nobody knows. It just stopped happening. Even Microsoft couldn't tell me why it happened.

With a $2.5 trillion market cap, it may seem like they're killing it but, I really think they're riding on momentum just like IBM did. Twenty years ago, IBM's market cap was double what is is now and, in my experience, their products are every bit as bad (admittedly, I have almost no exposure to their big iron products).

So, what are our alternatives? I know many people who don't like Apple for various reasons. Linux on the desktop has been promised for 20 years. It's closer than it has ever been to being a solid replacement but I don't know that it's quite there yet.

It saddens me to say, I don't know what the answer is. I just know that we need to get away from Microsoft products and fast.

1: In my experience, the only two exceptions are VS Code and SQL Server.

mschuster914• 3 years ago

With a $2.5 trillion market cap, it may seem like they're killing it but, I really think they're riding on momentum just like IBM did. Twenty years ago, IBM's market cap was double what is is now and, in my experience, their products are every bit as bad (admittedly, I have almost no exposure to their big iron products).

People are only not shitting on IBM so much anymore because they sold off Lotus Notes...

fatfingerd• 3 years ago

I don't see Lotus Notes as all that different than other Offices products developed by big Tech. I think it would be similar to Google's business platform with some more legacy automation but not unlike SalesForce or ServiceNow.

Having used Microsoft recently, after Google for work, I'm absolutely flabbergasted at how terrible Word, Teams, Outlook, etc are. I would describe the average Microsoft product as a zombie in its own feature set, at war with a different version of itself, and attempting to steal organs from other products to try to transition to every possible entirely different role in the suite.

Attempting to use a Microsoft product is like watching developers capitulate to some kind of bizarre internal political war between Product managers.

mozman• 3 years ago

I have always believed that MS products are designed in a way to maximize the value of commercial support, certificates, etc.

It's walled garden for lack of a better time and solving problems easily and quickly dilutes the value of MSCE and the army of paid consultants that exist.

It is a completely different universe from Linux

Zelphyr2• 3 years ago

I've had to get their certifications. They're just as much garbage as the rest of their offerings. The courses they provide are nothing but marketing material. They don't improve your understanding of the products at all.

I found out later that they use their certs as filters for resellers to help Microsoft identify which ones are serious players. What a waste of time and money.

MrDresden• 3 years ago

After spending 5 years of corporate work having to wrestle with Azure (in a ci/cd capacity) I would never recommend Microsoft's cloud offerings to anyone.

Problem is that there is no other provider I would rather recommend. They are all bad in one way or another.

whynotkeithberg• 3 years ago

I like the Azure bash cli... That's about the only thing I like from Azure.

flopriore• 3 years ago

"Problem is that there is no other provider I would rather recommend. They are all bad in one way or another."

Could you explain a little further what you don't like about Azure and why you would still recommend it over the competitors?

badrabbit• 3 years ago

The big red issue with MS is they elaborately make it very difficult to integrate outside their ecosystem and they love holding customers hostage to ridiculous restrictions, but also Azure is very difficult to centrally manage things for all subscriptions. Others are as well but not as much. I actually like the azure UI and CLI as well as many if their offerings, but it's so difficult to piece together a bigger picture or make small changes without doing a ton of work and more MS products being involved.

Also,unrelated: Azure AD is now "Entra ID" (????) now lol.

GordonS• 3 years ago

As a counterpoint:

I've worked with both Azure cloud and Azure DevOps (or whatever the feck they call it now) for a long time (maybe 10 years?), a lot in a corporate setting, but also for my startup.

Apart from the same price issues that exist across all the big 3 cloud providers, I actually really like Azure.

mschuster914• 3 years ago

AWS is pretty decent in my experience, and when managed with Terraform (which is all but a requirement if you don't want to go completely b0nkers) it's a breeze to manage.

navigate8310• 3 years ago

So, what are our alternatives? I know many people who don't like Apple for various reasons. Linux on the desktop has been promised for 20 years. It's closer than it has ever been to being a solid replacement but I don't know that it's quite there yet.

When most people hear the word "Microsoft," their initial thoughts typically revolve around Windows and, at most, Office. However, it is important to note that a significant portion of Microsoft's profits actually comes from their Dynamics 365 offerings.

orangepurple• 3 years ago

Linux on the desktop is here. Go all-in on KDE. Everything is seamless and just works.

azinman24• 3 years ago

This has nothing to do with large scale enterprise email security.

naikrovek3• 3 years ago

Everything is seamless and just works.

I have zero confidence in that testimonial, given my own experience with open source desktop environments, and KDE. zero confidence whatsoever.

kingrazor• 3 years ago

My experiences with Linux have been anything but seamless.

ElectricalUnion2• 3 years ago

The only Linux desktop environment that I found that looks and feels integrated and polished is Gnome, but that is because it's a slow as molasses, corporate focused and dumbed down copycat of the other mainstream OSes.

mceachen• 3 years ago

seamless and just works

Just say “better.” Gnome and KDE are decidedly not perfect, but they are both quite usable even by casual windows-only non-techies.

FWIW I’ve been using Linux as my primary desktop OS for more than 20 years—it does no one any good to oversell it. Touchpad scrolling rate is still broken on Gnome/Firefox. Angels have to sing (or use xorg) to make s3 suspend work. Fedora auto-update can break if there’s “too many” packages to update. Touchpad scrolling can be misinterpreted as swipe-left or swipe-right by KDE on some hardware.

The point is, if you bang against any of these sorts of issues in Windows, you’re frequently stymied. On Linux, you can either fix it, or at least route around the damage with an alternative.

o1y32• 3 years ago

None of the comments here seem to address desktop OS in enterprise/government environment, which is what this article about. Linux desktop OS your personal computer? Sure. In an organization where most users are not technical, and where vendors do not release their software? Good luck.

Aerbil313• 3 years ago

Linux Mint Cinnamon is here as well. It’s more seamless than Windows. Unless you need to specifically run windows-only software. Still I’ll take dual booting or having separate machines rather than using windows as mu daily driver every day of the week.

naikrovek3• 3 years ago

what does this have to do with the article, though? You just had a rant ready for when you saw a Microsoft-is-at-fault story came up?

throw109202• 3 years ago

It's unrelated to the article, and blatantly violates the HN guidelines:

Eschew flamebait. Avoid generic tangents. Omit internet tropes.

https://news.ycombinator.com/newsguidelines.html

I flagged it - I suggest you do, too.

azinman24• 3 years ago

I’d go with Gmail…

genmud• 3 years ago

Their pricing has become bonkers over the last few years. Most people in traditional businesses need o365 for word/excel/powerpoint, and you effectively get email for free, so for many companies its a no brainer.

giancarlostoro• 3 years ago

It saddens me to say, I don't know what the answer is.

I think the answer is a company willing to put in the work to force GPU manufacturers to provide high quality hardware drivers for a commercial Linux Distro. I mean all out partnership with the various vendors. Then sell prebuilts, maybe someone like System76 has come close, or has the capacity to do so. The Linux issues for me always seem to be hardware specific. Then its just making sure whatever the default DE is, has enough necessary polish.

mistrial92• 3 years ago

people making massive income from the system exactly the way it is, do not care about doing this

taeric5• 3 years ago

I'm curious on the non-sequitur to GPU stuff? At large, running machine learning code has been easily doable in linux for a long time. Frustratingly hard, yes, but no harder than in Windows. Often more repeatable and cheaper to fan out to a fleet of machines, to boot.

Is there another aim of GPU that I'm ignoring?

Microsoft makes fine enterprise software, sadly. To know and believe that, though, you have to see what the alternatives are in the enterprise world. It is atrociously bad.

I do think Chromebooks are an interesting use case showing you don't need massive software. Schools have taken to those very well and are almost certainly competing with most enterprises for number of users and use cases.

_a_a_a_• 3 years ago

MS SQL dev here, and I disagree because it's been going downhill in terms of code quality and especially documentation for a long while. Absolutely classic example why https://www.mssqltips.com/sqlservertip/3074/use-caution-with... but there are others

formerly_proven2• 3 years ago

However, I feel like it needs to be said: Microsoft makes bad products[1]! They're overpriced, insecure, slow (it's astounding to me how slow their web properties are), and hard to use. Easily some of the worst UI I've ever seen and, what's worse, they've been like that my entire career. They keep slapping lipstick on the same pigs and claiming to have reinvented themselves.

Some think tank should make an analysis how many billions of dollars are lost in productivity across the globe if you compare the current MS Office stuff to an alternate of "the Windows 2000-era stuff, but with security patches" or "the FOSS office stack, with more money behind it".

Anyone wanna estimate how many digits that number has?

(Teams, while being ungodly slow, at least has the value proposition of being an integrated product - persistent chat, file sharing and voice / video calls - that really didn't exist in 2000)

yoyohello132• 3 years ago

It's even more hilarious because Microsoft are always loudly exclaiming telemetry is necessary for software improvement but based on how buggy and terrible most of their software is telemetry doesn't seem to be helping.

sharts• 3 years ago

Microsoft exists to make money. If it made good products, it would not make money.

prepend• 3 years ago

Good products are not required to make money.

petemir• 3 years ago

One anecdote I have about Microsoft is that I once set up in Hotmail my birthday 5 months in advance to what it was, probably to bypass some 18yo check. Eventually (5 months later, probably) I set it back to normal.

Since then, for a couple of years, my father got a notification saying that it was my birthday (and he even obliged to congratulate me, once; he was -- and luckily is -- old :) ). That setting was not available anymore anywhere, and my birthday was set to the correct date, but the problem still happened. I contacted Microsoft, but it was like they had no idea what I was talking about nor what could be the problem.

So yeah, I don't trust them nor like them either.

collsni• 3 years ago

Isn't cloud fun?

Same keys to everyone's kingdom!

Incipient• 3 years ago

What's with all this fairly overt state sponsored hacking and everyone going "aww shucks" and moving on quietly?

mikrotikker3• 3 years ago

War with China already started in the cyber space. In fact its probably the pre war intelligence gathering and backdoor installations

neilv• 3 years ago

Did anyone start getting Microsoft "single use code" emails last night?

(Maybe if you have an Microsoft consumer account that you don't use, forgot you had, and might be incompletely set up.)

dgoodell• 3 years ago

I work for NASA. Our budget is like $25B. We’re definitely inefficient and wasteful, but we still do a lot of new things. Just not nearly as much as we could.

Microsoft’s operating budget was like $123B last year. There are bugs in office products that have been there for years

What exactly are they doing with all that money?

sundarurfriend• 3 years ago

Funding the current AI revolution, for example?

https://techcrunch.com/2019/07/22/microsoft-invests-1-billio... https://techcrunch.com/2023/01/23/microsoft-invests-billions... https://www.reuters.com/technology/microsoft-talks-invest-10...

throwaway290• 3 years ago

MS is not "funding AI revolution", it is throwing a lot of money to OpenAI (which may as well be considered part of MS considering how much they owe it) to let it keep prices artificially low so users get addicted while it bleeds those money. Simultaneously trying to carve a moat to get some ROI on those money later.

mistrial92• 3 years ago

you the user are not the customer, management and legal are the customer. You the user, are last, and least, in the priorities.

krono• 3 years ago

Based on my own dealings with Microsoft from such a management role over the years:

The only customer Microsoft seems to care about or is really even cognizant of its responsibilities towards, is Microsoft itself. Every single one of its products and services exists solely because and only for as long as some division of Microsoft believes it requires those specific things and whatever they're meant to evolve into over time, in order to manage its increasingly complex and ever expanding internal operations.

It's like a snake eating its own tail.

reportgunner• 3 years ago

What exactly are they doing with all that money?

Paying for ads and for developers that make ads I suppose.

iJohnDoe• 3 years ago

Speculation. This type of key issuance is given to FBI and NSA and other partnerships Microsoft has. China hacked their way up to get the keys.

yttribium• 3 years ago

American companies are generally forbidden by EEOC rules from having reasonable security precautions unless some product is associated with a government contract and can require full blown security clearances. As a result you can safely assume that any given department with a juicy portfolio is fully compromised by foreign intelligence.

pjdemers• 3 years ago

This sounds like an inside job.

amai• 3 years ago

What do you expect? Microsoft is a gaming company. They don’t care about security.

Microsoft lost its keys, and the government got hacked

Related Stories