Chinese hackers who breached Microsoft’s (MSFT.O) email platform this year managed to steal tens of thousands of emails from U.S. State Department accounts, a Senate staffer told Reuters on Wednesday.
The staffer, who attended a briefing by State Department IT officials, said the officials told lawmakers that 60,000 emails were stolen from 10 State Department accounts. Nine of those victims were working on East Asia and the Pacific and one worked on Europe, according to the briefing details shared via email by the staffer, who declined to be named.
The staffer works for Senator Eric Schmitt.
U.S. officials and Microsoft said in July that Chinese state-linked hackers since May had accessed email accounts at around 25 organizations, including the U.S. Commerce and State Departments. The extent of the compromise remains unclear.
U.S. allegations that China was behind the breach have strained an already tense relationship between the countries, as Beijing has denied the charges.
So in other words the State Department entrusted their email security to bullshit enterprise Outlook. If only every security professional knew better or something.
I am still amazed every business seems to think Microsoft cloud would be a good idea for security, availability or just stability. Nothing in the history of Microsoft bears this out. I really don’t get it. For just about everything else at work, there’s a company standard set by business needs.
No one takes you seriously if you bitch about the brand of pen or paper or stapler the office buys. You get the company brand of computer, chair, desk, phone, phone service, etc. But if the company tried to tell you to not use Windows and Outlook everyone believes there would be a catastrophic rebellion or failure of all staff to send and receive email or something.
This has always seemed absurd to me, but worse in government that supposedly needs security and privacy.
Microsoft has service contracts with the DOD which to my knowledge have not been compromised.
I think there are some completely valid reasons for businesses to use Microsoft cloud services:
- Shift some of the burden of responsibility to a third party. Organizations love this shit
- Microsoft has some of the best paid security analysts and engineers in the industry. Chances are they’d be able to detect and mitigate attacks attacks better than a small local team of not highly paid sysadmins.
- Microsoft is large enough to get some assistance from 3 letter agencies. That’s almost never going to happen with smaller companies.
Yeah. Exchange in 365 is, in almost every scenario, the far better option than running it on-prem. No more worries about installing the latest CU before attackers get in.
The only scenario where on-prem makes sense is a totally offline environment.
Shift some of the burden of responsibility to a third party. Organizations love this shit This is the only valid suggestion I’ve seen. And I get it - I just think there’s probably better third parties. Microsoft has some of the best paid security analysts and engineers in the industry. Chances are they’d be able to detect and mitigate attacks attacks better than a small local team of not highly paid sysadmins.
I hear this a lot about cloud companies, but see little evidence of it. People post frequently about leaving big cloud companies because of all sorts of reasons, one of which might well be pay. But even if they did have some of the best paid people - they’re not all highly paid people, and I doubt operations support are those people. (Have you ever tried to talk to Microsoft support?)
As I remember and understood it (I’m not doing a deep dive to refresh my memory for a lemmy post, but the overall point I think stands) the recent hack of Microsoft was because of accepting a home end user certificate to authenticate to a business / corporate (and apparently government) accounts. From what has been released, this happened due to a mix of (IMO) questionable design and lack of documentation or knowledge of how the authentication flows worked. These security engineers should have caught this before it landed in operations - because you have to catch these things in design, not rely on everyone using an authentication framework to sort of “cover for accepting multiple trust centers” that should not overlap. The reason this is a design issue is actually because it seems like it came about because of a new feature or function that wanted to allow lower confidence credentials to migrate to higher confidence or something like that.
If the security engineers missed that - they’re not that great. If they were overruled by management, well, that’s actually likely, but doesn’t change the facts that you as a subscriber didn’t OK that (frankly crazy) design change - you weren’t even informed. This is always an issue with the Cloud services, and I don’t see a way around it. Even people with contractual agreements got screwed here.
Microsoft is large enough to get some assistance from 3 letter agencies. That’s almost never going to happen with smaller companies.
I don’t see how that actually helps though. Most of our 3 letter agencies provide public guidance about defensive security recommendations and have for over a decade. There’s plenty of consultants if you can’t hire internally that can guide you through that stuff. The TLAs are not magical - I guess they might tell you you’ve been hacked or may tell you they know you’ve been targetted - but honestly - OF COURSE Microsoft Azure is a target, and we know it’s been hacked. This hack wasn’t revealed by a TLA, or by the “super duper security analysts” - it was a customer going over logs (that are so in the weeds most people didn’t pay for access to these logs at all) who informed Microsoft.
And this is my main counterpoint - when you have a “Fort Knox” you need really really good guards and can never make a mistake. I’m not sure it’s possible to have sufficient defenses when you’re running the e-mail for most businesses and the US government. We need to stop just assuming the Cloud providers have better {insert thing here} because of scale or money. I’d argue it’s pretty obvious they don’t - because they make more money if they don’t have the top end employees and can sell more features if they don’t lock stuff down and actually test before release. I’m going to argue that there’s every reason to believe that most Microsoft employees or contractors doing all functions are more like their support people than some better than you can hire super IT person.
Something something state department.
Something something private e-mail server.
