Slashdot Mirror
Office 365 Flaw Allowed Anyone To Log In To Almost Any Business Account (threatpost.com)
Reader msm1267 writes: A severe vulnerability in the way Microsoft Office 365 handles federated identities via SAML put an attacker in a position to have access to any account and data, including emails and files stored in the cloud-based service. Microsoft pushed through a mitigation to the service on Jan. 5, seven hours after being notified by researchers Yiannis Kakavas and Klemen Bratec. "The attack surface was quite big (Outlook Online, OneDrive, Skype for Business, OneNote -- depending on what the company has paid for in terms of licensing)," Kakavas and Bratec told Threatpost via email. "And a malicious user exploiting this vulnerability could have gained access to very sensitive private and company information (emails, internal documents etc. )." Office 365 users who had configured domains as federated were affected. The list includes British Airways, Microsoft, Vodafone, Verizon and many others, as mentioned in a report published late Wednesday.
Why the fuck are these authentication/authorization systems so goddamn complex?! Anyone who has worked with PAM or Kerberos or OAuth will know what I'm talking about. This is the kind of stuff that needs to be extremely simple so that it's easily understand, easily implemented, and easily verified. But what we end up with are terribly complex systems that end up being difficult for anyone to get a good grasp of, and this results in all kinds of problems.
Convenience and security are always opposed. Having all your eggs in one basket sure is convenient but Office365 covers a wide variety of services in complex configurations and this sort of thing is bound to happen. It will happen to all of these big services (iCloud, Google, AWS etc.) if it hasn't already.
A simple configuration mistake can also be amplified into a very big problem.
And I say that as someone who thinks Office365 is helpful for my business.
Oh look, the federated model fails yet again.
Can the "single sign on" zealots be tarred and feathered yet?
"But federation works if you know what you're doing!" Sure, it (mostly) works IF there are people who know what they're doing and IF you pay them to do it and IF this is true at the end of both providers and IF you keep paying them to maintain it.
Oh Shit!
If Microsoft builds a self-driving car, I will leave the road for a few years until they all crash. At a minimum until version 3.11.
"First they came for the slanderers and i said nothing."
So what else is new?
Microsoft software - insecure at any time.
It is not a bad as it sounds. It is mitigated much because no one would ever be so dumb as to combine a "cloud-based service" and "very sensitive information" without also adding a very serious SLA allowing for equally serious punitive damages, now would they?
The executives in charge of Office 365 were sacked immediately. No wait, they were given bonuses. Never mind.
Friends don't let friends use online applications to do offline jobs like text processing. Standalone office applications have no account hacking problems.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
The report mentions that the issue was disclosed to MS on 5th of January and fixed in 7 hours. This strikes me as odd because we literally had login issues and performance problems with Office 365's portal page on the 6th. Coincidence?
SAML is so overly complicated it crazy... Of course it's full of security issues like this... Give it a few years and someone might finally do a simple spec...
Convenience and security are always opposed.
No, not really... Because if it's not convenient then people are going to have stupid passwords, and they are going to write the passwords down in a text file and sync it over dropbox :)
:)
Humans are the worst security risk... If you can't eliminate the humans, your best bet is to make it as convenient as possible for them.
We all know how to send emails safely with GPG, but unless it's very very secret we never do this, because it's inconvenient.
The best thing we can do for security is making it convenient and to do the right thing..
In the end, it's not the zero day software issues that's going to get you... Most of the time, it's those pesky humans that will make a mistake
When talking security of systems I'm building, I always enjoy joking about how I am the biggest security threat, he he... If only I was joking.
Sounds great. On android, if I want to share a photo: I press the camera icon, press the take picture icon. After that, I press the pic of the photo, and then press send. I choose who I want to send it to and I'm good to go.
OpenBSD is this easy, right?
The list includes..Microsoft...
That's really strange. Microsoft, of all companies, should know how buggy and insecure Microsoft products are.
To rain on your security.
Think of all the haxxors that will have cached copies of all your confidential data!!! The cloud is truly a wondrous place! Clouds, rainbows and flying unicorns! Just watch out for all the unicorn shit while your head is in the clouds.
"If Microsoft builds a vacuum cleaner it will be the only MS product that wouldn't suck" :)
Vulnerability found (nearly five months ago), vendor notified, vendors fixed immediately.
Where is the story?
Honestly any business using the "cloud" is utterly insane. Quit being cheapskates and buy servers and software, hire an IT person at high 5 figures and take it out of the CEO's pay.
Honestly you have to be insane to trust all your businesses secrets to a freaking cloud service.
Do not look at laser with remaining good eye.
This a collaboration feature!
MS reiterates the private data they're stealing from Win 10 machines is perfectly safe and professionally stored on secure servers.
I am hearing a lot of snark here about a problem that was fixed about seven hours after it was properly and privately disclosed early in January --- and not much said about it publicly until the last week of April.
They want the public to share all their data but share "theirs" oh fuck.
Microsoft. Global Mother Fucking Spyware. EOS