Microsoft comes under blistering criticism for “grossly irresponsible” security

https://arstechnica.com/security/2023/08/microsoft-cloud-security-blasted-for-its-culture-of-toxic-obfuscation/

by WalterSobchak • 3 years ago

299 153 3 years ago

1attice3• 3 years ago

Good.

I can't talk about what I saw while working there, but let's just say that I have a nervous tic when someone tells we have a team for security so you need not worry, and when can you have it done by

esafak• 3 years ago

Are there any lessons you can share?

1attice3• 3 years ago

Yes. If your boss tells you that security isn't your concern as an IC, because other (presumably more specialized) minds are going to be reviewing everything later anyway, try to get transferred.

It's not malicious, but the effect is sort of like wearing a blindfold and one hand juggling, throwing things in the air, and presuming that a right hand (a) exists and (b) is not currently holding several other balls.

Everyone was super lovely and awesome and smart, but there is (for whatever reason) an attitude that is one of those things that is handled/reviewed by a special team, like accessibility, or HR, or product design, or backups.

The thing is, we did have a great security team, it's just that expecting them to have local knowledge of every single line of code is obviously unfair to them, and the idea that you can "do security" on any product just by applying a fixed set of rules somewhere way down the pipeline is to grossly misunderstand how vulns happen and work.

Every single IC can and must be on the lookout for vulns. They're vulns. They are literally made out of eyeballs pointed elsewhere.

Security is like hygiene: everyone has to wash their own hands after they go, it makes no sense to think that everyone can save time by having a Department of Hand Sanitization.

ChatGTP2• 3 years ago

Honestly, no one really cares...people will just continue to consume their products as usual.

So long as Microsoft has something interesting to offer consumers and business, security will be the last thing people care about.

Microsoft has had absolutely terrible security since I've had a computer and it's been heavily criticized the whole time. None of this has stopped their meteoric rise to extreme profitability.

tormeh3• 3 years ago

I've realized this about security as well. Unless insurance companies demand higher premiums for choosing Azure, or Azure fails to get certain certifications, then all is well as far as decision-makers are concerned. And this is not even that irrational. Most security issues go unexploited for most companies. Caring about security is IMO a bad business move on average.

ChatGTP2• 3 years ago

After the last Circle CI breach, we were all really annoyed about the way it was handled, IMO It was dishonest and lacked the required transparency for such a breech, we were all quite annoyed and ready to move on, but we've just plugged on using the product like nothing happened.

GitHub was similar, they published their freaking private keys accidently, which should raise some major red flags, we're all just going about our business with GitHub.

I was down voted hard and fast for my original comment but I'd like to see someone actually disprove my point. I've been in this game way too long to know that almost no security issue matters in the eyes of consumers so long as the company offers decent products and has a great marketing team.

I'm ideologically opposed to this lack of inaction and I think you're right, you'd need some type of financial disincentive to change people...

Social media itself is a type of privacy breech and people actually openly engage with it.

blibble5• 3 years ago

I feel as if we've not even scratched the surface in terms of well resourced hostile actors compromising hosted cloud services

can you imagine what would happen if the GRU got into the Teams backend with several year's history?

now consider that the only thing protecting that data is Microsoft software and their internal processes

beebmam• 3 years ago

What are some examples?

akikoo• 3 years ago

My bank's web service is at Azure:

https://www.s-pankki.fi/

(I care)

m463• 3 years ago

Hasn't microsoft been villainized for poor security since windows first launched?

I think this is because of their business model, which is to respond quickly to the market with features, not stability, security or polish.

That said, their intrusive data collection is a nightmare.

a-dub• 3 years ago

i was under the impression that they had made massive investments and really turned that around ... or is that ironically only windows? (or just a mistaken impression?)

blibble5• 3 years ago

the same attitude is still there

the product only has to be just good enough to get some pointy haired boss to approve the purchase

(and he never has to use the software)

btilly• 3 years ago

They did make massive investments in the mid-2000s on Windows security, and really did turn a lot of things around.

But it is a big place. And not everyone gets the memo.

rodgerd• 3 years ago

There was the famous "Bill Gates memo" early in the century that stopped work on pretty much everything except security, citing Windows' atrocious reputation as an existential risk to Microsoft. It lead to a big improvement, including UAC and driver signing.

Also it's worth differentiating between Azure and the rest of the Microsoft silos. The Xbox isn't being cracked on the regular. The microvirt for applications and browsers in desktop Windows seems very well thought out. It seems as though the Azure team are pretty awful, though.

spr93• 3 years ago

microsoft has always had a culture of "just make it work yesterday" that led to shoddy code. they spent a lot of money, some of it on PR and some of it on real work, polishing up some of windows's more egregious problems a couple decades ago. but the attitude is deeply ingrained in the leadership. i also suspect that a lot of cost-cutting demanded by the business side gets implemented by off-shoring work to the cheapest possible workers with the minimum experience necessary to push a product out the door, but im not as familiar with microsoft these days.

ilyt2• 3 years ago

"Villanized" ? It's not villanizification if it's truty..

LargeTomato2• 3 years ago

The villanizificationery of Microsoft is out of control.

AraceliHarker2• 3 years ago

Windows 11 has also been plagued by bugs in the Microsoft Defender UI until recently, and it has been warning users about security risks even when they block Microsoft telemetry. This shows that Microsoft is not taking security seriously.

jrm43• 3 years ago

Yes, and rightly so.

It's hard to even describe how historically bad they've been; they normalized and encouraged unsigned binaries, essentially viruses and worms, and were NEVER punished.

hollerith• 3 years ago

What should the punishment for Arch, Debian and Fedora be, then? Not only are unsigned binaries normal there, but as far as I know, the infrastructure doesn't even exist to check the signature of a binary on execution.

DharmaPolice• 3 years ago

My completely unqualified outsider perspective is that they're a slightly different phenomenon. The old school Microsoft security issues stemmed from security being more or less an afterthought or with comically bad default options. Many years and many billions of dollars later those systems are largely OK. But of course onprem systems are often not patched - but that's arguably not their fault (although Microsoft have made patching much harder than it needs to be, possibly to drive SCCM sales I'm not sure).

Azure...is a whole other thing. Every single service I look at feels like it's been developed two or three times, and renamed at least once...with varying degrees of backwards compatibility/interoperability/deprecation. The security interactions must be a nightmare to properly test for MS. On top of this it feels like there's multiple strategies being enacted simultaneously which makes it hard as an admin user to know you're doing the right thing in general.

Other cloud providers undoubtedly have some of the same issues with complexity/change but AzureAD (now renamed to Entra ID for whatever reason) is being used to manage core things like user accounts and mailboxes for organisations of all shapes and sizes (often without internal security teams).

There's also an unpleasant feeling that security is an upsell opportunity. It's a bad look.

spacebanana7• 3 years ago

The AWS model of each service being operated by a near independent company actually seems much easier to test and secure. Similar to modular code.

whalesalad• 3 years ago

I can’t imagine choosing Azure and the Microsoft stack for building systems. It’s incomprehensible to me.

tormeh3• 3 years ago

It makes sense on an individual level. No one gets fired for buying Microsoft. Maybe they should be, but they won't.

blibble5• 3 years ago

plenty of people have been fired for buying Microsoft

Elon Musk was one of them (at what became Paypal)

intelVISA2• 3 years ago

It's a form of self-harm at this point..?

xnyan• 3 years ago

Our company signed a huge 5 year deal with microsoft for azure services just today. We evaluated all major providers for more than a year, Microsoft offered the best terms by far, and we were able to meet all of our needs using it just as well as with AWS or GCP.

Honest question, why was the decision wrong? It does not matter to me eather way, I’m just an engineer that was brought in to consult on some aspects of the contract.

jiggawatts7• 3 years ago

Because some people prefer to bash things with open source rocks instead of using a proprietary hammer.

There’s an entire subculture of the IT world that spells it “Micro$oft” and refuses to acknowledge its very existence, or a valid option.

I once saw a post about how some Linux tool had support for “every major LDAP directory system” and did not list Active Directory! It’s like… dude… something like 99% of deployed LDAP systems is AD. The rest is a rounding error.

dimgl• 3 years ago

Microsoft offered the best terms by far

How is that possible? I'm guessing you mean the best terms for Windows machines and Windows-based services. As soon as you exit the Microsoft realm, the prices plummet...

whoknowsidont• 3 years ago

I'm extremely interested to know what terms AWS or GCP could not provide you that Azure could. That would be an extremely enlightening post.

As someone who has used Azure, AWS, and GCP since their inception but mainly Azure for very unfortunate career choices -- I can assure you Azure has the most problems of any sort you can imagine.

Your MS rep (if you're big enough to have contact with one) will most assuredly be using their checkbook for you guys or your client. I'm not being melodramatic. This isn't even an original opinion or experience (go ahead, look around HN). And it certainly isn't some cultural "M$" backlash as another poster put it.

If this post seems editorial it's because after nearly a decade of this nonsense I'm just simply exasperated, and it greatly confuses me when people who are within the MS ecosystem don't know how bad they have it with Azure. It's basically unacceptable that MS gets away with it.

From AKS to WAF to Cosmos DB take your pick. You will run into issues and you will run into them continually.

Personally with my experience, Azure is not something I could ethically ever recommend to anyone.

ilyt2• 3 years ago

It's pretty much best of the bad choice when it comes to cloud providers.

One of fun things we had with our MS experience was writing code that should work according to docs, returned nonsensical errors (not documented, generic kind of error) from their API, only for that to magically start working next day...

Even the basic stuff appears to be shoddy in places, for example I received notification about meeting that I was added to 5 days ago about 3h before the meeting.... when the meeting author edited the meeting to add next person.

Also trying to find what made e-mail land into spam in cloud exchange is near-impossibility... and whitelisting them in global rules just doesn't fucking work for no good reason. It's utter mess.

mkatx• 3 years ago

In a corporate setting, I've experienced many problems with Microsoft and their services.

Just off the top of my head, we had a ms forms, a couple actually, that as soon as they hit 50k entries, broke in weird ways. Not accepting new entrys, dropping entries, etc..

That's just one example I immediately recall where I could code up a better solution in a short amount of time, that just shouldn't be a thing with a large cloud/service provider like Ms.

tlb• 3 years ago

How did this process rate the relative security of the clouds? How much does security matter to your business?

A common bureaucratic failure mode when evaluating competitors is to make a bunch of categories:

Performance: 4/5 Ease of use: 4/5 Cost: 3/5 Security: 0/5

and then average them. When for these categories, you probably should compare the minimum rather than average.

ClumsyPilot• 3 years ago

Some of their systems are fune. Knowing wich ones, thats tough

mr_toad2• 3 years ago

C#, VSC, and those are my two examples.

Gigachad• 3 years ago

I worked at a place that used Azure and was told "When Microsoft has a problem, customers understand, its like a natural disaster, can't be avoided. When AWS has a problem customers say 'Huh, what's AWS, fix it now'"

I can't remember any outages in the few years I worked there though.

mr_toad2• 3 years ago

Lack of vested interest. Tick the boxes, blame someone else when shit hits the fan, assuming they haven’t jumped ship before then.

magicalhippo3• 3 years ago

We're a small B2B company. For VMs, AWS doesn't have a data center in our country (Norway) which is important due to data storage regulations, nobody sane picks Google for anything they need to rely on... so it's Azure or some local players.

We've tried the latter, twice, they got bought and support quality tanked both times. We don't want to manage hardware yet, so...

Also, customers want MSSQL, and managed MSSQL is nice since it's trivial to scale up and down with the needs of the customer.

Started using their other services like Service Bus, Blob Storage and Application Insights. We're using .Net so integration is quite simple.

It wasn't my call, but there weren't that many great alternatives from what I can see.

nl• 3 years ago

nobody sane picks Google for anything they need to rely on..

In the case of GCP this is untrue.

We're using .Net so integration is quite simple.

This is the reason for most deployments. They are MS shops so the go with the MS Cloud.

matheusmoreira3• 3 years ago

customers want MSSQL

Why would they want that when PostgreSQL exists? That's like saying customers "want" Oracle databases despite the existence of this post:

https://news.ycombinator.com/item?id=18442941

cpitman• 3 years ago

There are plenty of companies that effectively cannot use AWS because it is owned by Amazon, and either they or one of their customers is in direct competition with Amazon. For example, if you are a vendor for Walmart, they do not want their data ever landing on AWS.

fredski42• 3 years ago

This!

temporallobe• 3 years ago

We are, ostensibly for cost savings, moving to Azure Virtual Desktops for our local development environments. It’s going to be a glorious shit show.

LargeTomato2• 3 years ago

We found a bug in azure today where our security key was too big and their auth stack failed. They will try to push a fix in two weeks. They're doing their best.

lambersley• 3 years ago

Large enterprises using MS Office suite eventually rolled into O365. Sharepoint, same. MS cloud offerings were simply evolutionary. Enterprises simply had to shift from capex to opex. This is why they stayed.

llama052• 3 years ago

Sadly for a lot of these companies it's more of a "business" decision than a technical one. Having said that I will not work for a company in the future that has their primary infrastructure in Azure.

girvo• 3 years ago

I can tell you why places that previous consulting contracts I've taken used it:

1. Its cheaper

2. They're already a C# shop so it just "feels right"

Thats about it, really. That appears to be the sum of the thought that went into it. And that also explains why they had to bring myself (and others) in as very expensive consultants to un-fuck various systems...

OhMeadhbh• 3 years ago

Many years ago in 2003(?) I interviewed for the role of Security Architect for the Office group (the guys who made Excel, Word, Power Point and (I think) Access.) My resume was reasonably good: I had spent the early 90s doing cryptography at Nortel, RSA (back when they were an engineering company) and Certicom. But I was a software engineer and in the late 90s doing Security Architecture for IBM and "several government agencies you might have heard of." I was REALLY ready to leave DHS at the time so was kind of motivated to bring what I learned about writing secure software to industry.

About this time there was a "security stand-down" going down at MSFT in part because several federal customers LITERALLY had to solicit an ACT OF CONGRESS in order to continue to use Win2K (or an early version of XP) with all it's known security flaws. Do not ask me about the version of Win2K in nuclear submarines. (Really. Don't ask me. That was someone else's project. I really don't know anything about it other than the rumors that were swirling around BlackHat.)

So here I am, coming in as some guy who's hip to secure software development and tools and how to convince devs to do the right thing re: security even though they're under a deadline. My third interview of the day was this guy who supposedly wrote Excel and was the "third highest ranking coder in all of MSFT" (not Simonyi, I would have recognized him.) And his first question was "So... how's your QA skills?" This isn't what I'm thinking I'm interviewing for, so I say "Pardon?" and he replies...

"This security thing is bullshit. Bill's going to eventually realize it's bullshit and in a couple months we'll go back to writing software the same way we used to. So I'm going to have to find a job for you and I'm thinking QA; that's the same thing as security."

I did not get that job.

I believe Michael Howard or Dave Leblanc got it. They went on to write a pretty decent book about secure product development and if you're a microsoft shop and have heard of the Secure Development Lifecycle, it's largely because of Michael and Dave.

(Don't worry, I was fine. I went on to work at Handspring and PalmSource and a bunch of enterprisey dev shops that were hip to the idea of developing secure code. And my life was probably filled with fewer headaches than anyone at MSFT.)

But... I remembered that interaction. Microsoft keeps saying "oh yeah! we're big on security!" And in many ways they are. MSVC (or DevStudio or .NET whizbang or whatever they call it now) have several very cool fuzzing and analysis tools. I've heard the Azure group is better about security than they were, though that's rather a low bar. I feel for them since they have a metric boat-load of legacy code and a development methodology that sort of guarantees failure.

They are also the strangest and most conceited group of developers I've met (with the possible exception of Amazon or Facebook or Netflix.) Come to think of it... what the heck is it about these FAANG companies? I bet I'm just meeting the duds. There have GOT to be decent developers in there somewhere.

They're all HUGE dev organizations and I appreciate how difficult it is to get that many developers pointing in the same direction at the same time. But at the end of the day, MSFT has a culture that really doesn't care about security. Or at least that's my take on it. I'm sure there are plenty of places in Redmond where people care about writing code that isn't buggy or vulnerable. But it's 20 years later and it still hasn't spread far enough.

So it goes.

bluGill2• 3 years ago

Amazon has credit cards, they are liable for billions if that system is broke into. Facebook and google dont have that, but they are still directly the target of hackers as part of their core business. Excel gets hacked, but the victim is not Microsoft.

luckydata3• 3 years ago

Google definitely does.

blibble5• 3 years ago

do they actually run the credit card or is it their name slapped on another company's product?

my UK "Amazon" card was really a NewDay card and the US one seems to be provided by Synchrony Bank

should really be called "Amazon Basics" credit card

drivebycomment• 3 years ago

You think having consumer credit card numbers in the database somehow is a big enough motivation to keep better security. You may want to consider overwhelming evidences of various consumer facing companies - Target, Home Depot, Heartland Payment System, etc - who had gross and basic breach of the credit card numbers.

derefr• 3 years ago

Come to think of it... what the heck is it about these FAANG companies?

Mostly: hiring people for perceived "talent" over actual engineering skills (especially engineering soft skills.)

Imagine interviewers highlighting someone's CV because they've won Putnam math competitions, while round-filing some other CVs because "they write Haskell/Erlang/Rust/etc on some hobby project, and so they might try to push for it at work and then burn out when they find out we won't do it here."

Now imagine the people hired by a process like that, going on to hire other people, and so on.

I bet I'm just meeting the duds.

That too. In a big org, nobody with "real shit to do" is going to spend time interviewing. They're going to push that off on someone whose time can be wasted. Which means company culture gets decided by a bunch of people whose time isn't worth anything...

intelVISA2• 3 years ago

IME nowadays FAANG is mostly a retirement home for LC grinders lol, they were technically relevant once, no denial, but that time is loong past

falsandtru2• 3 years ago

He also faulted Microsoft for waiting five years to refresh the signing key abused in the attacks

Too long.

falsandtru2• 3 years ago

I'm really surprised that anyone downvoted this comment.

insanitybit5• 3 years ago

TBH the issues that I've seen with Azure are pretty shocking. Like "I don't believe anyone did a basic pentest against that system even once" levels of shocking. That's insane for a company the size of Microsoft.

These vulns are cross tenancy violations, which, again, is insane. That's as bad as it gets for the cloud.

This incident demonstrates the evolving challenges of cybersecurity in the face of sophisticated attacks.

The insane thing is that some of these vulns are as easy to discover as just running nmap. I'm sort of shocked that people haven't run into them accidentally. Hardly sophisticated.

I'm not trusting Azure with shit.

midoridensha4• 3 years ago

That's insane for a company the size of Microsoft.

Why? Why does company size have anything at all to do with the security of their product?

Microsoft has been making shoddy, horribly insecure products for decades now. Do you need me to list all the email viruses and other such things that were running rampant in the 90s and 2000s?

What's truly insane is that people keep expecting Microsoft to do better, and then being disappointed when they don't. The common saying is "the definition of insanity is doing the same thing and expecting a different result", and that's exactly what most people do in regards to Microsoft and product quality or security.

insanitybit5• 3 years ago

Why? Why does company size have anything at all to do with the security of their product?

Because they have a massive security team. Size has a lot to do with security.

What's truly insane is that people keep expecting Microsoft to do better, and then being disappointed when they don't.

Microsoft has done a ton of impressive security work when it comes to Windows, they've really stepped up their game. They've invested quite heavily.

bagacrap3• 3 years ago

Size is correlated with resources. Microsoft should have the resources to throw at this problem.

Unfortunately the Microsoft approach to software engineering is to set a bunch of monkeys loose on a room full of keyboards, rather than to spend their considerable resources vying for top talent.

(Obviously they do have some good engineers, no offense if you're one of them, it's simply that from my sample size of 5, 80% were just warm bodies with email access.)

nvy3• 3 years ago

Why? Why does company size have anything at all to do with the security of their product?

Because they have the money to hire people who know what they're doing, though it seems they are having difficulty selecting the right candidates.

sublinear• 3 years ago

"the definition of insanity is doing the same thing and expecting a different result"

This is a nitpick, but it's often completely reasonable to expect a different result by doing the same thing. Nothing against what you wrote, I just hate this saying so much. It's usually wrong to assume things are context-free. Most of life is defined by routine. Erosion carved out the surface of the earth, breathing and eating keeps you alive, etc.

At some point the definition of "same" comes under scrutiny and you will find that it's impossible to truly do the exact same thing more than once, and yet even if it was possible you might still get a different result because other things you had no control over changed. Entropy makes it all just so.

prepend• 3 years ago

Remember when cosmosdb users could read other users databases? [0]

It was so boneheadedly stupid, it was like a sysadmin making all user directories readable by all users. Not sure how that would not be tested. And made me worry about what other vulnerabilities lurk in Azure.

[0] https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-v...

insanitybit5• 3 years ago

The vulns from wiz were so bad I basically wrote off Azure that day. And not bad like 'impact is high', bad like 'did anyone in your massive security org actually look at this?'.

sylens• 3 years ago

I get the general sense that Azure is a frankenstein of a bunch of services they had built before as well as some that were formerly internally used, and have since been published/scaled up for customers

Nothing seems to have been designed to naturally fit together, everything feels like its glued on

minedwiz• 3 years ago

Hey, don't forget acquired companies' codebases awkwardly shoehorned into being an Azure RP.

FreshStart• 3 years ago

It's funny, cause liability can scale, so if all of this can be hacked and will be hacked, the lawsuits by companies will bury Microsoft?

hulitu2• 3 years ago

Nothing seems to have been designed to naturally fit together, everything feels like its glued on

This is a trademark of Windows since the beginning.

Veserv2• 3 years ago

Microsoft certifies to the government that they can not protect against moderately skilled attackers via their Common Criteria certifications as seen on their security homepage [1][2]. These are the only security certifications they mention on that page (FIPS is also mentioned, but it is more of a crypto certification than a security certification). They specifically certify that they only conform to EAL1 [3][4] which only requires AVA_VAN.1 which is the ability to protect against attackers with a "Basic attack potential" [5]. The evaluation methodology required by AVA_VAN.1 can be seen on their certification report [6]. Effectively, they do a Google search for "Windows CVE" then they check that all the search results are patched. That's it. I am not joking. That is how they certify security. I am not joking. Seriously.

To be fair, Microsoft has historically certified to conform to EAL4 which requires AVA_VAN.3 which is the ability to protect against "Enhanced basic" attackers and includes a actual penetration test. However, despite decades of attempts, they have never once successfully certified any product against AVA_VAN.4 which is the ability to protect against "Moderate" attackers. They have literally never once been able to protect against "Moderate" attackers. And they have the certifications to prove that they absolutely, positively, can not.

It is the height of idiocy that anybody listens to or trusts anything that Microsoft says at all about security. The have literally certified that the height of their ability is abject incompetence and the total inability to protect against "moderately" skilled attackers. Until they can definitely prove and certify otherwise, their claims of security should be completely ignored as the useless trash that it is.

[1] https://learn.microsoft.com/en-us/windows/security/

[2] https://learn.microsoft.com/en-us/windows/security/security-...

[3] https://www.commoncriteriaportal.org/pps/

[4] https://www.commoncriteriaportal.org/files/ppfiles/PP_OS_V4....

[5] https://www.commoncriteriaportal.org/files/ppfiles/PP_OS_V4.... Page 53

[6] https://www.commoncriteriaportal.org/files/epfiles/2022-21-I... Page 14

matheusmoreira3• 3 years ago

What exactly are moderate and advanced attackers? The documents cited only seem to go up to the "enhanced basic level" you mentioned which is penetration testing with public vulnerability search.

nerdjon• 3 years ago

Something that bothers me a bit more about this, I feel like I have not really heard about many of these issues while thinking that I have been doing a decent job of staying on top of things like this by paying attention to hacker news. Does Azure things just not filter up as much as I would expect or did I just happen to miss them?

It isn't like Azure is just ignored in the industry, time and time again I see it billed as the "non amazon aws" for companies that don't want to support AWS due to Amazon.

I feel like I hear more about GCloud issues than I do Azure issues which is concerning given how little GCloud is used even compared to Azure.

luckydata3• 3 years ago

GCloud is probably used MORE than Azure. Microsoft has a lot of stuff that's not cloud in their revenue to make it look bigger. Leaked numbers show GCloud revenue are actually about even with Azure.

https://www.cnbc.com/2022/12/21/google-leaked-doc-microsoft-...

jzebedee2• 3 years ago

This doesn't come close to the actual market share you'll find in the likes of Gartner or others. The cloud landscape has long been AWS, Azure, and GCloud as a distant third.

jsnell• 3 years ago

The story of the stolen signing keys did have trouble picking up the traction it deserved early on, but eventually got multiple highly upvoted submissions:

https://news.ycombinator.com/item?id=36770235

https://news.ycombinator.com/item?id=36823007

https://news.ycombinator.com/item?id=36740133

1vuio0pswjnm7• 3 years ago

https://traffic.megaphone.fm/RFEI6083180368.mp3?updated=1690...

Listening to the cybersecurity person interviewed here play down the significance, one is left to possibly believe cybersecurity folks rely on Microsoft to keep them employed.

According to this podcast, the only reason the government discovered this breach is because they were paying Microsoft for the "privilege" to see who was accessing their email. Most customers were not paying thus would never have discovered similar unwanted access.

If charging for this transparency is a "business model", as the podcast suggests, and there were only a relatively small number of "customers", it really makes one wonder. How much money were they making from this "business model".

excalibur• 3 years ago

Noticed that, did you?

jrm43• 3 years ago

Well that's about 20 years late, but okay :)

Animats• 3 years ago

Amit Yoran, right again. He was once head of computer security for Homeland Security, and become unpopular for pointing out that Microsoft was the problem.

Eisenstein• 3 years ago

The senator went on to pin blame on Microsoft for the recent mass breach of the Departments of State and Commerce and the other Azure customers. Specific failings, Wyden said, included Microsoft having “a single skeleton key that, when inevitably stolen, could be used to forge access to different customers’ private communications.”
"Microsoft’s engineers should never have deployed systems that violated such basic cybersecurity principles"

I hope someone quotes this line back when they inevitably introduce a 'we want a backdoor to encryption' legislation.

philsnow• 3 years ago

What does "forge access" even mean? I would have said "gain access".

Although, even worse, the private key could likely have been used to actually forge communications from those parties.

jquast• 3 years ago

How much of Azure infrastructure is managed by Windows? Are they using their own operating systems, hardware devices, drivers, firmware blobs and tools, or are they struggling like everyone else to glue all that FOSS together securely?

Too• 3 years ago

Some of it uses this https://en.m.wikipedia.org/wiki/CBL-Mariner. The rest is likely a crazy mix of Windows, Linux and other home built tools.

yencabulator2• 3 years ago

CBL is a mix of Linux and Microsoft home built tools.

jiggawatts7• 3 years ago

It’s a mix. A lot of their PaaS services are Microsoft Service Fabric under the hood, running on Windows Server.

This is vaguely like Kubernetes but worse.

So for example they can’t do zone affinity for traffic routing, so all of their zone-redundant traffic ping-pongs between data centres like crazy.

If you use just a couple of layers of their services like private endpoints and app gateway, you can expect to see 15ms response times.

aoetalks• 3 years ago

You can do zone affinity with service fabric. It’s difficult, but not impossible.

cookiengineer• 3 years ago

Honestly I don't understand how any company can rely on Microsoft for security, and how they can get away with blaming their customers so often.

You can literally kerberoast Azure AD by default, and that's a known to be used in the wild attack vector since 2014. In a cloud service. Today.

Spammers literally rent Azure VMs because they know that the IP range of azure is not processed by Outlooks/Exchanges email filters.

So often researchers did the right thing and disclosed everything correctly just to get Microsoft to say "oh yeah here is another RCE, but we don't give a damn. Oh, and there is no patch either."

It's just so ridiculous.

There's even unfixed RCEs of VBA from the Office 2013 days which still work, because the mentality of never touch a running software creeped into how Office is built (which is: have a literal copy of all outdated Office versions for the sake of compatibility).

And then people wonder why "Hackers" always say that Microsoft is insecure and why ISO27001 is now a google dork to find easy to hack victims.

dhab• 3 years ago

I am compiling these as a case against adoption of Microsoft

Can anyone provide references for these proving their current existence?

warrenm• 3 years ago

Wonder how this headline and article jives with Azure achieving FedRAMP statuses, DoD IL5, and other security certifications?

If Azure is as bad as this article makes them sound, does that mean most major security certifications are also as pointless they look from the outside? Like the pointless ISO 9001 certification - which only states "we have a process; here's the process; we follow the process; we don't deviate from the process"?

yencabulator2• 3 years ago

As someone who's worked on obtaining Common Criteria and FIPS certifications, I fully believe security certifications have little to do with security. Especially if you don't carefully read the definition of Security Target therein; that part is very much like the arbitrary process in your ISO 9001 mention.

johnea• 3 years ago

Nice to see the legislators catching up to decades old news:

https://www.pressenterprise.com/2015/06/10/cartoons-broken-w...

Microsoft comes under blistering criticism for “grossly irresponsible” security

Related Stories