In major gaffe, hacked Microsoft test account was assigned admin privileges — How does a legacy test account grant access to read every Office 365 account?::undefined
How? Human error.
Why? Microsoft is just that kind of company and always has been. Their t’s aren’t crossed and i’s aren’t dotted, and people buy their shit because they’re used to it.
Boeing and Microsoft: same shit, different cloud.
Name one company which does. There aren’t. Every corporation is big, cumbersome and full of people who make mistakes and don’t follow procedures.
Every group of humans.
Which is why I don’t trust “the cloud” in general. Obviously businesses are meant to make profit, not to protect my data. If one is at odds with the other, they will choose profit.
I think this is a good example of a situation where it’s appropriate to say “pwned”.
Let’s bring back leet speak while we’re at it
I’m confident that my knowledge is not sufficiently sharp to use it, but the defiance of mainstream tech industry associated with it I just love.
anyone that expected Microsoft to be faultless hasn’t paid attention to the last 30+ years
Microsoft software may not be flawless, but at least it’s expensive.
😅
This is the best summary I could come up with:
The hackers who recently broke into Microsoft’s network and monitored top executives’ email for two months did so by gaining access to an aging test account with administrative privileges, a major gaffe on the company’s part, a researcher said.
In Thursday’s post updating customers on findings from its ongoing investigation, Microsoft provided more details on how the hackers achieved this monumental escalation of access.
In Thursday’s update, Microsoft officials said as much, although in language that largely obscured the extent of the major blunder.
Threat actors like Midnight Blizzard compromise user accounts to create, modify, and grant high permissions to OAuth applications that they can misuse to hide malicious activity.
They created a new user account to grant consent in the Microsoft corporate environment to the actor controlled malicious OAuth applications.
The threat actor then used the legacy test OAuth application to grant them the Office 365 Exchange Online full_access_as_app role, which allows access to mailboxes.
The original article contains 339 words, the summary contains 156 words. Saved 54%. I’m a bot and I’m open source!
How? Easy: a result of lazy programing. Like every other MS vulnerability.
esit: Just remember, this is a company that designed a remote desktop protocol for their OS in a way that it could be exploited to remotely log in and take over control. You’d think, this was the exact type of threat that it should’ve been tested against.
