Chinese Hackers Raided US Government Email Accounts By Exploiting Microsoft Cloud Bug (techcrunch.com) 27
Chinese hackers exploited a flaw in Microsoft's cloud email service to gain access to the email accounts of U.S. government employees, the technology giant has confirmed. From a report: The hacking group, tracked as Storm-0558, compromised approximately 25 email accounts, including government agencies, as well as related consumer accounts linked to individuals associated with these organizations, according to Microsoft. [...]
Microsoft's investigation determined that Storm-0558, a China-based hacking group that the firm describes as a "well-resourced" adversary, gained access to email accounts using Outlook Web Access in Exchange Online (OWA) and Outlook.com by forging authentication tokens to access user accounts.
Microsoft's investigation determined that Storm-0558, a China-based hacking group that the firm describes as a "well-resourced" adversary, gained access to email accounts using Outlook Web Access in Exchange Online (OWA) and Outlook.com by forging authentication tokens to access user accounts.
Don't worry, everything was PGP encrypted! (Score:4, Interesting)
Of course the reality is different, and very few people encrypt their emails, but maybe this can be a wake-up call? It won't, but it should be.
Re: (Score:2)
The ironic thing is that if something like a YubiKey was used to store the PGP key, PGP would be a very effective way to ensure mails are stored securely. For recovery purposes, an ADK could be added (and stored in an HSM) so if the user left the company, documents would still be decryptable.
Sometimes the simplest things are the best. I do wish YubiKey had more options for PGP/GPG key storage, like the ability to store multiple keys, but it does a good job at what it does, and provides not just a PIN, but
Re: (Score:2)
Re: (Score:2)
I'd also like to see some more work in PGP key storage devices, perhaps on the level of a HSM, where the PGP key can be backed up encrypted or transferred to a new HSM, but never stored in the clear. That way, one doesn't worry about losing everything if their key is lost, but an attacker would never have the ability to get the unprotected key material.
Because people, for the most part, rely on the magic lock icon and the mail provider to handle security, we wind up in these situations. I had similar happ
Re: (Score:2)
Where each device can add a validation, so not only do I have PGP, I have PGP-D (device) validation. Where my key vouches I should be X, but then each device can co-vouch against X. I'm at my desk, wit
Re: (Score:2)
The great thing about a captured audience full of clickbait addicts, is it only takes 25 compromised accounts that happen to "include" government agencies (meaning one account was found), which resulted in clickbait pimps going fucking batshit crazy and calling that shit a "raid" on the United States Government by "Chinese hackers".
It's unreal thinking about the truly ignorant shit History is going to be forced to document as the actual reason this planet will engage in yet another World War, but one thing
Fundamentally flawed technology (Score:2)
Active Directory is much like Sendmail.
Both of them theoretically can be secured but they have flawed architectures that make vulnerabilities likely. The best course of action if you have a well resourced adversary is to simply ban the product. I'd use Postfix or possibly Qmail instead of Sendmail, and I'd use something like Google's directory service over Active Directory.
At this point using Outlook and Active Directory in an environment with well resourced threat actors s just incompetence.
Re: (Score:2)
And you think these alternative products will withstand an attack by a foreign government? Good luck with that.
Re: Fundamentally flawed technology (Score:2)
Their security program is pretty extreme
Re: (Score:2)
There is no such thing as a totally secure system, physical or digital. There are always weak points, for those who are willing to spend enough money to find and exploit them. Bank vaults, Presidential safe rooms, NORAD--they can all be attacked. So can the best-designed digital security apparatus. Every system has tradeoffs, because in the end, you want authorized users to actually be able to *use* the system. And that always necessitates opening up holes in the otherwise airtight security. And government-
Re: (Score:2)
The best thing is defense in depth. You start with AD/AAD as one tier. The email gets sent to the recipient over a TLS protected connection, and the sender and receiver should have GPG or S/MIME keys, ideally on a YubiKey or other hardware device with a button on it. This way, the actual email messages are protected while sitting, they are further secured in flight, and AD/AAD provides authentication.
I'm surprised that S/MIME is not more common, as it forces an attacker to compromise an endpoint in order
Re: (Score:2)
Postfix is nixe. Complex, but things make sense and you can ignore most of the complexity if you do not need it. Had to drop Qmail because of the insanity that DJB practiced back then (don't know whether he still does it) with regards to time management.
I believe the only sane thing you can do with AD and Outlook and Exchange is scrap them. Completely unfixable crap that creates much more problems than they solve.
Re: (Score:1)
...who have to trawl through all that inane drivel. Can you imagine the poor souls having to go through Lauren Boebert's & Marjorie Taylor Green's emails? That could arguably be considered a cruel & inhumane punishment.
While I understand your veiled attempt at humor, it highlights the fact that you have never had to endure the pain and suffering of living under a communist regime.
Fucking strange when Hitler invokes Godwin, while Mao invokes humor and ignorance.
Nobody ever got fired .... (Score:3)
I mean Amazon
I mean Oracle
I mean Peoplesoft
I mean SAS
I mean
Re: (Score:2)
This is an outrage! (Score:2)
The USA would never do anything like this!
How dare China do something like this to such a peaceful nation that never spies on anyone!
Transparency (Score:2)
Re: (Score:2)
Lol (Score:2)
And you wanted to award JEDI to these asshats?
aaand, will the US gov't do anything Back? No. (Score:1)
How to hire a white hat hacker (Score:1)
Digital Asset/USDT Recovery!!! (Score:1)