196
submitted 8 months ago by L4s@lemmy.world to c/technology@lemmy.world

In major gaffe, hacked Microsoft test account was assigned admin privileges — How does a legacy test account grant access to read every Office 365 account?::undefined

you are viewing a single comment's thread
view the rest of the comments
[-] autotldr@lemmings.world 10 points 8 months ago

This is the best summary I could come up with:


The hackers who recently broke into Microsoft’s network and monitored top executives’ email for two months did so by gaining access to an aging test account with administrative privileges, a major gaffe on the company's part, a researcher said.

In Thursday’s post updating customers on findings from its ongoing investigation, Microsoft provided more details on how the hackers achieved this monumental escalation of access.

In Thursday’s update, Microsoft officials said as much, although in language that largely obscured the extent of the major blunder.

Threat actors like Midnight Blizzard compromise user accounts to create, modify, and grant high permissions to OAuth applications that they can misuse to hide malicious activity.

They created a new user account to grant consent in the Microsoft corporate environment to the actor controlled malicious OAuth applications.

The threat actor then used the legacy test OAuth application to grant them the Office 365 Exchange Online full_access_as_app role, which allows access to mailboxes.


The original article contains 339 words, the summary contains 156 words. Saved 54%. I'm a bot and I'm open source!

this post was submitted on 28 Jan 2024
196 points (99.5% liked)

Technology

58586 readers
5702 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS