Re MS 365 breach, a non-exhaustive list of questions for CISA’s review board:
- Why was a long expired certificate allowed to be trusted, and why was this bit removed from the MSRC blog?
- The code library for checking token validity has been amended to fix the vulnerability in future. Developers are blamed for not following the documentation.. but why was the library shipped like that? Secure by design, and all - it was a solvable problem.
- Consumer Outlook.com can access government email due to crossing the streams. Does this not seem like something which needs revisiting, in terms of secure by design?
- The MS engineer breach leading to presumed certificate theft has no logs. Given MS engineers get automated crash dumps from Azure DevOps and that contains things like MS Defender for Endpoint telemetry and such, is there an evidence trail of what else was accessed?
@f7d0478e I feel like a long-expired certificate myself
Oddbean new post about login | logout