Whistleblower paints a picture of a corporate culture where Azure sales and feature innovation were stressed over all to product managers, and the many security flaws that were reported as part of this rapid development were pushed to “won’t fix” status.
CEO Satya Nadella has specifically noted that Microsoft’s security initiative and focus on cyber threats must always come ahead of any other concern, including feature additions and improvement and support for legacy products.
Microsoft’s security breach, which essentially gave the Chinese hackers the ability to walk into any Exchange Online email account and ended up impacting at least 500 people in high-ranking positions, would have been unthinkable at one time.
The January attack on Microsoft was worse than initially reported, with an update from the company indicating the Russian hackers may have stolen source code and accessed private email exchanges between corporate accounts and customers.
While a break-in by a group of Russian state sponsored hackers might initially seem understandable, the Microsoft security breach was eventually traced back to a simple password spray on a legacy test account with some questionable permissions.
The core of this data leak is an oversight in creating SAS tokens for sharing purposes. The AI researchers had properly secured the account in all other aspects, but did not seem to realize that a URL shared on GitHub was misconfigured.
The Microsoft report reveals several security oversights that might have acted as chokepoints to stop the Chinese hackers from successfully using the signing key had they been functioning as intended.
Recent high-profile mishaps by a number of cloud services, but particularly those run by Microsoft, have triggered a security review by the Department of Homeland Security’s Cyber Safety Review Board (CSRB).
Microsoft reports that Chinese hackers were able to gain access to select high-level US government email accounts via forged tokens. The breach window appears to have been from about mid-May to July 4. It was first detected in mid-June at the State Department.
Anonymous Sudan claims to have stolen 30 million Microsoft accounts and is offering them up for $50,000, but the company says that the sample it posted cannot be authenticated and that there are no signs of a data breach.