Microsoft, Do Better
It’s high time for Microsoft to have a rebirth — the death spiral of its attitude to security needs to change. In this article I’ll look at the last few years of security blunders, Microsoft’s lackluster responses to these, the inherent conflict in being a purveyor of both the platforms and the security tools on top of those platforms, the curse of legacy software, and give a list of actions that should be taken (IMHO).
Acknowledgement
I learned a long time ago to start with the good first, acknowledging strengths before pointing out weaknesses, so here goes.
Microsoft makes some amazing platforms. My SMB clients would not be as effective as they are in running their businesses (one financial services firm, one engineering consultancy and two educational institutions) if they weren’t running on Microsoft 365. And for their security needs (one on M365 Business Premium, the others on M365 E5 or A5), Defender for Endpoint, Defender for Identity, Defender for Office on the XDR side, combined with Microsoft Sentinel and Defender for Cloud Apps is a fantastic, integrated solution that make it possible for me to run a one-man SOC for for them. I literally could not provide these SMBs with the same level of protection without a lot of manual integration of disparate security tools.
Also, Microsoft’s work in Ukraine since Russia’s illegal invasion has been nothing short of outstanding. Amazing, dedicated cyber warriors fighting to defend democracy against war criminals for very little recognition — add to that the level of Microsoft’s financial support with cloud services and so on. (Also, shout out to Swedish (where I was born) company Yubico donating 20,000+ Yubi keys to Ukraine through Hideez).
And I follow many excellent security researchers that work at Microsoft, and they share their great work so anything that follows is not a slight on the 8,500 cybersecurity professionals in the trenches.
But there’s a problem at Microsoft in regard to security and it needs serious attention by the leadership, something that seems not to have been happening over the last few years.
The World’s Biggest Elephant in the Room
On Jan. 15, 2002, Bill Gates wrote a memo to everyone at Microsoft — of Trustworthy computing fame. And Microsoft did shift then in a big way, and some years ago I would have described Microsoft as a leader in how to do security right, but it seems to me that over the last few years it’s lost its way.
Here are some examples of security situations where Microsoft’s response wasn’t up to snuff.
ChaosDB — August 2021
CosmosDB is Azure’s NoSQL database that provides several different APIs to the same data, and automatic deployment to different regions and synchronization between different copies at five different consistency models to match your application’s needs. It also had a flaw in that you could use its Jupyter notebooks feature to steal primary keys from other customers’ Cosmos DB databases and thus access (or alter) the data stored there, discovered by Wiz. Microsoft fixed this one within 48 hours of being notified, but how was this not found by internal testing prior to the notebook feature being rolled out?
OMIGOD — September 2021
Linux VMs in Azure deployed on Infrastructure-as-a-Service (IaaS) with certain management services enabled had Microsoft’s Open Management Infrastructure (OMI, the equivalent to WMI on Windows), agent silently installed on their virtual machines (VMs). Four separate flaws were found by Wiz that would allow an attacker to become root on the VM. One flaw, with a CVSS score of 9.8 of 10, simply required sending a single packet with the authentication header removed.
Microsoft patched the flaws in August 2021, and the vulnerabilities were disclosed mid-September, but many organizations didn’t even know that they had to update the agent they didn’t know was installed.
Here’s the official article, but Microsoft was cagey in their response to this one, and should definitely have been more transparent about the agent being silently installed. Also, these flaws should have been found by their internal red team, particularly the one that was super easy to exploit.
Sunburst / Solarwinds — December 2020
There has been many a keyboard worn out by pundits writing about this supply chain attack by the Russians against SolarWinds Orion network monitoring tool that initially compromised 18,000 different companies worldwide. The attackers then carefully chose specific organizations to further compromise, using Microsoft 365 and vulnerable Active Directory Federation Services (AD FS) deployments, specifically ones where their root keys were not stored in Hardware Security Module (HSMs). For this article there are two takeaways: first that Microsoft strongly recommends storing sensitive keys in HSMs (see below), and second, many U.S. government organizations had trouble identifying if their Microsoft 365 tenants had been compromised, because they weren’t using the highest (most expensive) tier of licensing and thus didn’t have access to “premium logging” (also see below).
Exchange Server — Ongoing
I’m not going to break down each individual flaw found in Exchange Server on-premises over the last few years; suffice to say that there have been many, and often they have resulted in large scale compromise of the victims. Notable ones are ProxyLogon, ProxyShell and ProxyNotShell. However, none of these flaws have been exploited in Exchange Online as part of Microsoft 365.
If Microsoft wasn’t running Exchange Online, and Exchange Server was still their flagship email and collaboration platform, it’s hard to imagine that they wouldn’t assign more resources to fixing these flaws before the bad guys find them. As it is, it seems like it’s a supported product, but only by a few guys in a back office, and that’s not sufficient against today’s determined attackers.
Unauthorized Access to Cross-Tenant Applications in Microsoft Power Platform — July 2023
This one doesn’t have a catchy name, but in essence the Microsoft Power Platform (Power Apps, Power Automation) can use custom connectors that uses Azure function hosts to connect to various data sources. Those hosts are managed by Microsoft, but the API endpoint is unauthenticated, meaning that if you knew the hostname you could interact with it.
Microsoft was notified on March 30, 2023, and initially released a patch on the Aug. 3, which only fixed the issue for newly deployed applications. The company was originally going to wait until Sept. 28, 2023, to release the patch for all customers, but after Tenable‘s limited advisory, they released the patch for all customers.
Understandably Amit Yoran, CEO of Tenable, was very disappointed in Microsoft’s response and wrote about it in a LinkedIn post.
What was lacking in the response here was transparency. Cloud customers (including at least one bank) didn’t know that their sensitive data was at risk and didn’t have information to take mitigation actions. Also, only patching for new applications (initially) wasn’t sufficient.
