This Microsoft Entra ID Vulnerability Could Have Been Catastrophic (wired.com) 31
Security researcher Dirk-jan Mollema discovered two vulnerabilities in Microsoft's Entra ID identity platform that could have granted attackers administrative access to virtually all Azure customer accounts worldwide. The flaws involved legacy authentication systems -- Actor Tokens issued by Azure's Access Control Service and a validation failure in the retiring Azure Active Directory Graph API.
Mollema reported the vulnerabilities to Microsoft on July 14. Microsoft released a global fix three days later and found no evidence of exploitation. The vulnerabilities would have allowed attackers to impersonate any user across any Azure tenant and access all Microsoft services using Entra ID authentication. Microsoft confirmed the fixes were fully implemented by July 23 and added additional security measures in August as part of its Secure Future Initiative. The company issued a CVE on September 4.
Mollema reported the vulnerabilities to Microsoft on July 14. Microsoft released a global fix three days later and found no evidence of exploitation. The vulnerabilities would have allowed attackers to impersonate any user across any Azure tenant and access all Microsoft services using Entra ID authentication. Microsoft confirmed the fixes were fully implemented by July 23 and added additional security measures in August as part of its Secure Future Initiative. The company issued a CVE on September 4.
"and found no evidence of exploitation" (Score:2)
Re: (Score:2)
Could be way too many logs on multiple servers, some possibly in-memory rather than file based that they'd have to know about in order to wipe all trace of their activities. Or at least thats how a proper service provider would implement things, but then this is MS after all.
Re: (Score:1)
Re: (Score:2)
Even if you have logs you need to have someone able to process and interpret them.
I'm just waiting for the day someone successfully makes an intrusion and then locks out everyone using Entra / Microsoft Accounts from their computers. If you can't log in anymore and you have bitlocker enabled on your hard drive then you'd lose everything.
Re: (Score:2, Troll)
It is easy to not find evidence of something if you don't look to hard.
This is a case where even if there were IOCs and you found them the clean up would be nearly impossible. Think about their 'Shared Responsibility Model' and the implication here. If MS were acknowledge some kind of serious breach occurred in their core Entra-ID IAM platform...they'd either have to be able to be able to conclusively identify all the impacted subscriptions or every single one of their subscribers would have to kick off th
Re: (Score:2)
I think you have a good point.
It's yet another example of human systems which are affected by perverse incentives.
I can't think of anyone in this situation who would want the truth to be known... if they have found evidence that this has been exploited.
And after all, any security researcher or hacker would have been focusing on trying to find poor validation logic, amongst other things -- it's not some counterintuitive side channel.
I really can't think of anyone who'd really want it to be known that this ha
Re: (Score:2)
And just to be clear, I'm commenting on incentives and the relatively small number of people in positions of authority at a corporation or a client who would be in a position to make a decision to keep this quiet. I'm not talking about the average ethical person who just wants to do the right thing -- they may want to, but they'll be under pressure by the perverse incentive structure. And it's speculative whether there has been any actual breach or any wider impacts. It's just a scenario.
Re: (Score:3)
You are trolling but I will answer this anyway because there are people who honestly think like you do.
If someone discovers an exploit in a major service provider, and immediately goes public with it, then that means every criminal in the world learns about it. And that, in turn, motivates them to focus on figuring out how to exploit themselves. That, in turn, puts every single user of the service at risk of being victimized. Such victimization can lead to severe losses of money and livelihoods.
Thus, by
WTF is Entra ID (Score:3, Interesting)
I had to look this up, apparently Entra ID is an evolution of ADFS or Active Directory Federation in the cloud. I guess you get what you deserve if you're using Microsoft security products in the cloud. Also, Entra ID is a terrible name but AD is a terrible product so I guess its an evolution of the same terrible security issues.
Re: (Score:3)
I guess you get what you deserve if you're using Microsoft security products in the cloud.
I guess you get what you deserve if you're using the cloud.
There, FTFY.
Re: (Score:3)
Probably to distinguish it even further from regular on-prem AD.
Re: WTF is Entra ID (Score:2)
They just been renaming their Azure-whatever to Entra-whatever and O365 to M365â¦. Who knows why, it is the same M$ oil tanker slop still but some marketing suit-n-tie probably thought it will make greedy investors happy because it sounds new and exciting, or whatever.
Re: (Score:1)
lol "entra" means in spanish "[it] enters" or "[can] enter".
the service for "keeping unauthorized things out" is called "can enter"
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Fun fact, Microsoft's Azure cloud infrastructure is primarily based on Linux. Also, you can spin up Linux virtual machines as part of cloud services. Even the microservices ("Azure Apps") can run Linux.
Windows is the curse of the non-technical class.
Re: (Score:2)
I guess you get what you deserve if you're using Microsoft security products in the cloud.
Precisely what did people get here? A security vulnerability automatically patched in the back end quickly with no evidence of exploit? It sounds like this was addressed faster than any windows server patch ever was, including past Active Directory.
I'm not sure what you're saying here, that we should all switch to the cloud because of how quickly the issue was addressed and how seriously Microsoft took the situation? I think you're trying to say something negative about a story that is actually a rather big
Re: (Score:2)
Oh, you hadn't heard? Maybe you knew it as Azure Active Directory.
They can't seem to settle on a name they like.
Re: (Score:2)
My company uses Microsoft for email. Managing users is a mess with two systems ("Admin" and "Entra"). We don't use Microsoft for any Windows logins or anything resembling the cloud AD.
Earlier this year, one of my users lost access to his authenticator app. I followed instructions I found on the web, which went through the "Admin" web pages. Didn't work. I got on a support call with Microsoft, in which they could see my screen. They talked me through the same steps as I had performed earlier. Didn't work, ev
Sigh. (Score:1)
It's inevitable that something like this will appear regularly, and one day it will be silently exploited.
At that point, everyone will scramble back to on-prem, but until then we have to tolerate this cloud nonsense, apparently.
Re: (Score:2)
I just attended an HPE/MS webinar about "Azure Local", or simply Azure On Premise. I haven't been so amused in quite a while.
Re: (Score:2)
Re: (Score:2)
It's inevitable that something like this will appear regularly, and one day it will be silently exploited.
That has already happened and MS did not notice at all. After 2 years, one of their customers noticed:
https://www.cisa.gov/sites/def... [cisa.gov]
The utter catastrophe of the MS cloud "strategy" is slowly getting worse and worse. Most "decision makers" at MS customers are deep in denial because they do not have an exit strategy. But there is really no way this is going to end in any other way than very badly. MS still cannot get basic stuff right at this time. That simply means they cannot fix the crap they built anym
I hope he got a large reward (Score:2)
Something of the order of $1,000,000. We need to see bug hunters rewarded massively to encourage them to report the issue to the software builder.
It would be interesting to know what the NSA, FSB, MSS or Mossad would have paid for the bugs...
Re: (Score:2)
He probably got nothing, but may have gotten legal threats. Others will not even try to do the right thing these days, because there is no reward for that.
It appears your pessimism about MS is wrong (Score:2)
This article points to rewards being given, with one over $100k.
https://www.techradar.com/pro/... [techradar.com]
Next time may not be so lucky (Score:2)
I'm not saying cloud is necessarily riskier than on-premises*, but cloud failures can easily make headlines due to the scope, and such could set the likes of MS into a financial tailspin. While that is perhaps a good thing, they'll hurt a lot of customers in desperation for cash during their spiral to Hell.
* The average org didn't manage on-premises well either.
MS is too dumb to make this work (Score:2)
This is not the first time they made really bad mistakes like that. And they continue to make them. "Security is our highest priority" is nothing but a lie. At this time, the only valid conclusion is that MS cannot do this right and is incapable of learning.
Only could have been catastrophic :o (Score:2)