Microsoft Azure faced the largest data breach in its history with many mid-level and senior executives' accounts breached.
For the first time in the history of Microsoft, a cyberattack has left hundreds of executive accounts compromised and caused a major user data leak as Microsoft Azure was attacked.
According to Proofpoint, the hackers use the malicious techniques that were discovered in November 2023. It includes credential theft through phishing methods and cloud account takeover (CTO) which helped the hackers gain access to both Microsoft365 applications as well as OfficeHome.
The reason why so many people fell for this attack was because it was carried out through malicious links embedded in documents. These links led to phishing websites but the anchor text of these links was “View Document”. Naturally, no one was suspicious of a text like that.
On one hand, I know we shouldn't blame people for falling for this stuff. People are often not educated well enough on the dangers and it's not reasonable to expect it. We should build things to be systematically secure even in the face of people falling for phishing.
On the other hand it's difficult not to be frustrated with this kind of thing... People really should know better than clicking random links and typing their password.
Azure products ask you for your identity and signin a lot. Honestly, I'm asked to log in again at least once every 24 hours. That's assuming I don't traverse some sort of service wall where I'm now in a different system after clicking a link.
I do cloud engineering for a living, and I would probably fall for at least some phishing things around Azure, specifically because azure identity management is so obtuse and constantly asking for things.
It's absolutely on the system that Microsoft designed , and the practices they encourage, and the mitagations that apparently don't exist.
MS products in general are a Rube Goldberg machine of domain redirects and authentication requests so you could easily(...?) slip another sneaky phishing site in the middle of the 14th ball drop and 18th cup-on-a-string-swinging-over-a-gap and I'd be one to fall for it. I use 1Pass and it's pretty much constantly popping up in MS website dialogue boxes demanding another password sacrifice before it will let me access some MS service that I was just on five minutes ago.
The amount of times I have had to do an MFA challenge for non-elevated access stuff while on company owned hardware connected to the company owned network is absurd.
Azure products ask you for your identity and signin a lot. Honestly, I'm asked to log in again at least once every 24 hours
I'm security minded and I absolutely hate using Microsoft because of this very reason.
I have a Microsoft account because stupid ass Windows needs it, I wanted PC GamePass and I was sick of constantly doing workarounds for the past 15 years. And what do I get for it? I need to log in for so many things. Accidentally open up Microsoft word? Login. Open game pass? Login. Play a game? Login. Game suddenly crashes? Oh because it failed to authenticate and I had to login into game pass again.
I would absolutely fall for this if I had to use microsoft products at work because of logging fatigue.
The text discusses a series of cybersecurity breaches affecting Microsoft, involving sensitive data theft from US government officials and organizations, attributed to Chinese hackers. Microsoft's delayed response to discovered security flaws, including a 90-day wait for a partial fix, is criticized. Senator Ron Wyden has called for Microsoft's accountability. The breaches underscore the growing issue of security vulnerabilities in tech companies, leading to expectations that the US government will require companies to promptly disclose security incidents within a strict timeframe.
every day i lose my mind a little more at how much trust hundreds of thousands of companies across the world place in third parties like microsoft to handle literally all of their sensitive data, as if that could be a good idea in any universe
Not just companies. Governments. I know of entire governmental departments that run exclusively off of a M$ environment. People who deal with capital C Confidential information are backing it up into OneDrive. It's lunacy.
What's sad is that my former university uses Microsoft products for literally everything and they think Duo is going to keep my uni email secure. Until they encrypt that bitch and enhance their security that email is as good as dead
This piece reads like it was generated by an LLM from prompts supplied by a twelve year old who knows nothing about cybersecurity.
I was really looking forward to reading the article from the headline