258
Microsoft Azure Hit With The Largest Data Breach In Its History; Hundreds Of Executive Accounts Compromised (techreport.com)
submitted 10 months ago by kid@sh.itjust.works to c/cybersecurity@sh.itjust.works
29 comments fedilink hide all child comments

For the first time in the history of Microsoft, a cyberattack has left hundreds of executive accounts compromised and caused a major user data leak as Microsoft Azure was attacked.

According to Proofpoint, the hackers use the malicious techniques that were discovered in November 2023. It includes credential theft through phishing methods and cloud account takeover (CTO) which helped the hackers gain access to both Microsoft365 applications as well as OfficeHome.

all 30 comments
sorted by: hot top controversial new old
[-] SorteKanin@feddit.dk 59 points 10 months ago

The reason why so many people fell for this attack was because it was carried out through malicious links embedded in documents. These links led to phishing websites but the anchor text of these links was “View Document”. Naturally, no one was suspicious of a text like that.

On one hand, I know we shouldn't blame people for falling for this stuff. People are often not educated well enough on the dangers and it's not reasonable to expect it. We should build things to be systematically secure even in the face of people falling for phishing.

On the other hand it's difficult not to be frustrated with this kind of thing... People really should know better than clicking random links and typing their password.

[-] echo64@lemmy.world 78 points 10 months ago

Azure products ask you for your identity and signin a lot. Honestly, I'm asked to log in again at least once every 24 hours. That's assuming I don't traverse some sort of service wall where I'm now in a different system after clicking a link.

I do cloud engineering for a living, and I would probably fall for at least some phishing things around Azure, specifically because azure identity management is so obtuse and constantly asking for things.

It's absolutely on the system that Microsoft designed , and the practices they encourage, and the mitagations that apparently don't exist.

[-] trk@aussie.zone 52 points 10 months ago

MS products in general are a Rube Goldberg machine of domain redirects and authentication requests so you could easily(...?) slip another sneaky phishing site in the middle of the 14th ball drop and 18th cup-on-a-string-swinging-over-a-gap and I'd be one to fall for it. I use 1Pass and it's pretty much constantly popping up in MS website dialogue boxes demanding another password sacrifice before it will let me access some MS service that I was just on five minutes ago.

[-] shadowSprite@lemmy.world 9 points 10 months ago

My school uses MS for a bunch of the logins. 2FA is setup through your phone, which isn't annoying or anything. So anytime I login, I need my phone handy, and then I have to type in the stupid code into my phone and then a password to approve it and then maybe 25% of the time it decides me clicking "yes this is me" actually means "no, deny!" and boots me out and then I have to authenticate a different way. And if I sign into a different school website that uses the same damn MS login it kicks me from any other school websites I'm currently logged into so I have to log back into them even if they're still open in another tab and I'm actively working in then. So yeah, I'd like to think I'm smart, but I'd definitely just rush through another MS authentication request because I'm so damn sick of them.

[-] Rentlar@lemmy.ca 38 points 10 months ago

bing bing bing bing!

"Sign into your Microsoft account" here...

"Link your Microsoft account to Edge/[Insert MS product here]"

"Let's get you signed in" there.

"Try our Windows Hello! A new method of accessing your Microsoft account!" over there.

"Sorry you can't use your organization account here, sign into your personal account"

This is the monster Microsoft unleashed upon itself.

[-] BeardedSingleMalt@kbin.social 16 points 10 months ago

Microsoft, and all the cybersecurity folks who blindly accept any recommendation from third party firms.

When we need to remote in to our work PCs we have to use our Microsoft account with MFA just to access the remote connections, then use the same credentials to access the pool, then if we want to RDP into our PC we use the same credentials.

[-] Sunforged@lemmy.ml 13 points 10 months ago

Thank you. Security verification has become so cumbersome that people just try to push through without thinking.

[-] snooggums@midwest.social 6 points 10 months ago

Yeah, needing to sign back into multiple systems after doing something different for 15 minutes is just exhausting.

[-] wizardbeard@lemmy.dbzer0.com 8 points 10 months ago

The amount of times I have had to do an MFA challenge for non-elevated access stuff while on company owned hardware connected to the company owned network is absurd.

[-] Potatos_are_not_friends@lemmy.world 4 points 10 months ago

Azure products ask you for your identity and signin a lot. Honestly, I'm asked to log in again at least once every 24 hours

I'm security minded and I absolutely hate using Microsoft because of this very reason.

I have a Microsoft account because stupid ass Windows needs it, I wanted PC GamePass and I was sick of constantly doing workarounds for the past 15 years. And what do I get for it? I need to log in for so many things. Accidentally open up Microsoft word? Login. Open game pass? Login. Play a game? Login. Game suddenly crashes? Oh because it failed to authenticate and I had to login into game pass again.

I would absolutely fall for this if I had to use microsoft products at work because of logging fatigue.

[-] valkyre09@lemmy.world 37 points 10 months ago

I work on service desk.

Nobody knows their password. It’s always a fucking song and dance when I ask them to type it in.

Except of course when they click a phishing link. Then they know every single piece of information required.

Blows my mind

[-] deweydecibel@lemmy.world 14 points 10 months ago

work on service desk.

Nobody knows their password.

If they did they wouldn't be contacting the service desk.

[-] OrderedChaos@lemmy.world 10 points 10 months ago

I often get confused at how someone could log into the computer and yet after that is done have no idea what their password is. I sometimes have them lock their computer so they can remember it again. Facepalm.

[-] wizardbeard@lemmy.dbzer0.com 10 points 10 months ago

Been on both ends of this (IT support and "forget password after entering it correctly"). The secret is muscle memory/subconcious habit.

Used to have the same issue with the dial combo lock on my locker at school. If I thought about it I could never open it. If I distracted myself just enough then I'd get it open without really knowing what I did.

That said, at my place we had someone forgetting their password literally minutes after a call to have it reset, multiple times a day. Don't know what the issue was, but we had to escalate it to HR and the person was out for a good while.

[-] tophneal@sh.itjust.works 8 points 10 months ago

Totally agree about the muscle memory. I recall having access to a CO DNR database at a previous job. It was one of three alphanumeric passwords assigned to me with no option to change them. I realized one day after having my hand in the wrong place on the keyboard that I didn’t really remember it, but my subconscious did

[-] kid@sh.itjust.works 34 points 10 months ago

A better summary:

The text discusses a series of cybersecurity breaches affecting Microsoft, involving sensitive data theft from US government officials and organizations, attributed to Chinese hackers. Microsoft's delayed response to discovered security flaws, including a 90-day wait for a partial fix, is criticized. Senator Ron Wyden has called for Microsoft's accountability. The breaches underscore the growing issue of security vulnerabilities in tech companies, leading to expectations that the US government will require companies to promptly disclose security incidents within a strict timeframe.

[-] walter_wiggles@lemmy.nz 8 points 10 months ago

Thanks kid

[-] virtueisdead@lemmy.dbzer0.com 13 points 10 months ago

every day i lose my mind a little more at how much trust hundreds of thousands of companies across the world place in third parties like microsoft to handle literally all of their sensitive data, as if that could be a good idea in any universe

[-] filcuk@lemmy.zip 13 points 10 months ago

While I don't disagree it's dangerous, most companies handling their own data would likely do a lot worse, just with smaller chance of being targeted.

[-] virtueisdead@lemmy.dbzer0.com 2 points 4 months ago

That's a fair point to be honest but it would mean more job openings for me, so... /j

[-] Treczoks@lemm.ee 3 points 10 months ago

Especially when history has shown that Microsoft had and has issues with security basically everywhere.

[-] Detheroth@lemmynsfw.com 2 points 10 months ago

Not just companies. Governments. I know of entire governmental departments that run exclusively off of a M$ environment. People who deal with capital C Confidential information are backing it up into OneDrive. It's lunacy.

[-] Metal_Zealot@lemmy.ml 7 points 10 months ago

Lol

[-] Loki@lemmy.world 4 points 10 months ago

This piece reads like it was generated by an LLM from prompts supplied by a twelve year old who knows nothing about cybersecurity. I was really looking forward to reading the article from the headline

[-] kid@sh.itjust.works 1 points 10 months ago

Do you mean the text accompanying the post? That is the first two paragraphs from the article.

The "better summary" I posted later was actually generated by chatgpt.

[-] KuroeNekoDemon@sh.itjust.works 4 points 10 months ago

What's sad is that my former university uses Microsoft products for literally everything and they think Duo is going to keep my uni email secure. Until they encrypt that bitch and enhance their security that email is as good as dead

[-] LEDZeppelin@lemmy.world 2 points 10 months ago

Flashback from 2016 Russian hack on DNC emails

[-] thecrotch@sh.itjust.works 1 points 10 months ago

Wouldn't blow my mind if this was a state actor, it's a huge breach during an election year

[-] sadreality@kbin.social 1 points 10 months ago

Satya is too focused on creeping on you tbh

this post was submitted on 19 Feb 2024
258 points (97.4% liked)

Cybersecurity

5846 readers
117 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Community Rules

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

founded 2 years ago
MODERATORS
kid@sh.itjust.works
Lanky_Pomegranate530@midwest.social