Microsoft Signing Key Stolen by Chinese

https://www.schneier.com/blog/archives/2023/08/microsoft-signing-key-stolen-by-chinese.html

by DemiGuru • 3 years ago

79 27 3 years ago

h2odragon• 3 years ago

Wise person once said: "Trust is the necessary precondition for betrayal."

Big organizations like Microsoft cannot be more secure than one individual's systems; someone runs their servers and they wear pants and make mistakes, just like we do.

What the big shop can do is cover up their mistakes and confuse responsibility once they're made. As well as providing an easy one stop shop for bad actors with things like GitHub ("subvert the world's infrastructure all at once!").

badrabbit6• 3 years ago

A) only a handful of companies can even afford to secure their infra as much as MS. Security is relative to threat actors, not absolute. One individual cannot defend themselves against an APT team (P=persistent).

B)I don't know if you heard about infamous mass-exploitations like the recent moveit or russia with solarwinds but an APT will still pwn everyone. One stop shop or not. Having one place is actually good because you won't have 1000+ incident responses and remediation is also a one stop action as is figuring out scope and impact.

fatfingerd3• 3 years ago

I'm not really sure about this logic. Is an APT going to use anything but old vulnerabilities against an off cloud shop that might have unique auditing to burn them? Are they going to develop a new one for such a shop when the payout couldn't be a fraction of what a success would return from even a minor cloud vendor?

On top of that you also have all the same regular vectors of desktop/mobile OSes, etc. So the cloud isn't really an adequate defense if you are a real target and is just one much more handy cookie cutter vector that will almost certainly trawl your data accidentally to an APT group when a mistake makes it practically free.

jhoelzel4• 3 years ago

Its almost like centralizing software to mayor clouds is not such a good idea after all ;)

Governments should own their own datacenters and access should be highly regulated.

If you can spend billions on military projects that go nowhere, you should be able to spend a couple of million on people that create a networking structure for your that is based on RBAC, that is not owned by somebody else

DemiGuru• 3 years ago

I would go even further and say that governments should consider having their own OS. There is no reason why Windows 10 and 11, with their ever increasing number of ads and information sieve, would belong there.

fsociety• 3 years ago

If it doesn’t belong there then it doesn’t belong here.

lockhouse• 3 years ago

Sadly, the federal government doesn’t have a great track record here either…

https://en.m.wikipedia.org/wiki/Office_of_Personnel_Manageme...

toomuchtodo• 3 years ago

It's duct tape and hope all the way down.

(infosec/grc practitioner)

landemva• 3 years ago

Governments should own their own datacenters

Most government data should be on local in-country leased infrastructure. Government should not be building palaces and isolated from the people. It's my government and for the most part should be open.

badrabbit6• 3 years ago

A nation state compromises a cloud infra and that's your takeaway? Was your takeaway after solarwinds the opposite? To move it to the cloud?

It's almost as if it is very easy to make reductionist statements without considering the nuances of the subject.

While you're at it, stop using gmail and other webmail and selfhost. I am sure it will be more secure? Lol.

jhoelzel4• 3 years ago

At least do some research my friend. Hackers compromised a digitally signed SolarWinds Orion network monitoring component, opening a backdoor into the networks of thousands of SolarWinds government and enterprise customers. Solarwinds was the exact same problem. the cloud service was centralized and thousands of server where hacked because of it.

just because you install something yourself does not make it self hosted.

Lastly this was a supply chain attack. which means too that if the government is able to roll their own stuff, or use open source products that can be reviewed properly, this would not have happened.

mrguyorama• 3 years ago

The federal government should absolutely have their own software development department that exists entirely to make software for governments. I'm so tired of us saying "nononono government can't do it efficiently" just so we can spend 10x as much on a "contractor" who works only ever for the government and spends all their R&D on circumventing government procurement contract clauses.

svaha1728• 3 years ago

Microsoft really needs to split like Google and Alphabet. Having the top leadership rush full on into AI and Low Code / No Code solutions is counter to running a successful cloud business.

Dudester230602• 3 years ago

Wasn't Pichai rushing somewhere this very summer? The sort of rushing that starts when you lag behind?

isanjay• 3 years ago

Two of the most user hostile companies of our times.

jsnell• 3 years ago

Previous discussions below. Scheier's claim that this is related to SolarWinds is new AFAIK, but also seems like it's entirely speculation?

https://news.ycombinator.com/item?id=36740133

https://news.ycombinator.com/item?id=36770235

https://news.ycombinator.com/item?id=36823007

https://news.ycombinator.com/item?id=36979532

https://news.ycombinator.com/item?id=36731731

tempnow987• 3 years ago

I don't understand how they extracted the key from the HSM. How is this even possible - the vendor of the HSM should be named!

rickstanley• 3 years ago

I don't understand, is this a breach in MS Azure accounts or personal accounts or both? I mean, I use Authenticator to log in from my phone and I have disabled the password as a way to log in; am I also a potential victim of this attack?

freedude• 3 years ago

Senator Wyden thinks that the Solarwinds breach could have provided valuable insight to prevent incidents like this one.

" On May 12, 2021, President Biden issued Executive Order 14028, which among other things, created a Cyber Safety Review Board, whose first task would be to study the SolarWinds incident. That review never took place — the Board was subsequently directed by the Department of Homeland Security to study another hacking incident. I have repeatedly pushed CISA and DHS to direct the Board to study the SolarWinds incident, but have been rebuffed. Had that review taken place, it is quite likely that Microsoft’s poor data security practices around encryption keys would have come to light, and this most recent incident might have been averted. "

[PDF] https://www.documentcloud.org/documents/23888590-wyden_lette...

Microsoft Signing Key Stolen by Chinese

Related Stories