Everything authenticated by Microsoft is tainted

Re:Everything authenticated by Microsoft is tainted by ggeorgovassilis on Friday September 29, 2023 @07:56AM (#37702484)

This story has been widely under-reported and the impact is potentially huge. My beef with MS is this: the keys were leaked in 2021 and were still signing authentication tokens in 2023, but there's not a single Azure service that allows me to enter credentials with a 2 years duration. It's a classic case of "do as I say, not as I do".

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by ahoka on Friday September 29, 2023 @08:16AM (#37702714)

This. They don’t even use a HSM if I understood correctly and using one is not part of the mitigation plan. Not OK.

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by lazide on Friday September 29, 2023 @08:40AM (#37703119)

HSM’s are super inconvenient obviously, and as Mr. Robot showed not perfect. So why bother? /s

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by jnsaff2 on Friday September 29, 2023 @09:00AM (#37703472)

Apparently they might also be backdoored by the NSA: https://news.ycombinator.com/item?id=37571014

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by lazide on Friday September 29, 2023 @09:02AM (#37703503)

Still probably better than having the private key part of a random core dump from a random developer. :s

That’s just embarrassing.

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by jnsaff2 on Friday September 29, 2023 @09:09AM (#37703635)

No doubt. My expectations to MS engineering are really low so I'm unfortunately not shocked.

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by grotorea on Friday September 29, 2023 @11:08AM (#37705382)

Frankly is this important? If the NSA is a threat to you do you have any business trusting MS?

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by lazide on Saturday September 30, 2023 @10:07AM (#37715567)

No one has any business trusting Microsoft, apparently?

I’m under no delusions that an intelligence agency with ‘home team advantage’ wouldn’t already have the keys to the kingdom. If they are in the apparent habit of leaving the keys sitting around in random Cafes, the odds that other non-home team intelligence agencies have a copy increases dramatically too. Or even random miscreants.

As to if that matters? Eh.

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by reilly3000 on Friday September 29, 2023 @12:45PM (#37706783)

They sure sell HSM on Azure.

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by yrro on Friday September 29, 2023 @08:26AM (#37702861)

Imagine what the CA/Browser Forum would do if they discovered that a PKIX CA had lost control of its signing keys, didn't revoke them and in fact carried on using them for 2 years without telling anyone...

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by inetknght on Friday September 29, 2023 @08:47AM (#37703227)

Have you checked if you have a Microsoft CA installed to your system?

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by yrro on Friday September 29, 2023 @09:15AM (#37703725)

More seriously, on my Debian stable system:

    $ dpkg -l ca-certificates
    Desired=Unknown/Install/Remove/Purge/Hold
    | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
    |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
    ||/ Name            Version      Architecture Description
    +++-===============-============-============-=================================
    ii  ca-certificates 20230311     all          Common CA certificates
    
    $ trust list | grep Microsoft
        label: Microsoft ECC Root Certificate Authority 2017
        label: Microsoft RSA Root Certificate Authority 2017

On RHEL 9:

    $ rpm -q ca-certificates
    ca-certificates-2023.2.60_v7.0.306-90.1.el9_2.noarch
    
    $ trust list | grep Microsoft
        label: Microsoft ECC Product Root Certificate Authority 2018
        label: Microsoft ECC Root Certificate Authority 2017
        label: Microsoft ECC TS Root Certificate Authority 2018
        label: Microsoft Identity Verification Root Certificate Authority 2020
        label: Microsoft RSA Root Certificate Authority 2017
        label: Microsoft Root Authority
        label: Microsoft Root Certificate Authority
        label: Microsoft Root Certificate Authority 2010
        label: Microsoft Root Certificate Authority 2011
        label: Symantec Enterprise Mobile Root for Microsoft

Interesting that RHEL has many more certificates, when both packages take whatever's bundled into NSS.

According to 'rpm -q --changelog ca-certificates' RHEL take their certs from "CKBI 2.60_v7.0.306 from NSS 3.91" and according to /usr/share/doc/ca-certificates/changelog.Debian.gz, Debian take theirs from "Mozilla certificate authority bundle" 2.60.

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by inetknght on Friday September 29, 2023 @12:17PM (#37706386)

And so, to back to your question:

> Imagine what the CA/Browser Forum would do if they discovered that a PKIX CA had lost control of its signing keys, didn't revoke them and in fact carried on using them for 2 years without telling anyone...

Are these certificates affected? Or perhaps the CA/Browser Forum aren't aware of the scope.

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by yrro on Friday September 29, 2023 @01:04PM (#37707100)

I sure hope not. But I suppose only Microsoft are able to confirm whether their PKIX CA private keys are or are not affected by their various security incidents, including the Azure token leak mentioned by ggeorgovassilis.

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by seabass-labrax on Friday September 29, 2023 @06:43PM (#37710963)

Are you aware of what applications and services are verified by these keys? I am thinking it might be worth removing these specific root certificates if they are used only for a select number of purposes, considering that the vast majority of 'normal' websites use other CAs like DigiCert or Let's Encrypt.

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by yrro on Saturday September 30, 2023 @09:58AM (#37715495)

Among other things, Azure services use certificates issued by those issuers.

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by yrro on Friday September 29, 2023 @08:51AM (#37703289)

I simply assume Microsoft have already compromised my systems already. :)

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by vladvasiliu on Friday September 29, 2023 @08:29AM (#37702923)

You can still create "app registration secrets" that last for up to two years. Until recently, you could create essentially unlimited-duration secrets.

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by bluemax on Friday September 29, 2023 @10:18AM (#37704639)

It's only a limitation in the UI. Using powershell you can still create client secrets that are valid for hundreds of years.

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by Muromec on Friday September 29, 2023 @08:23AM (#37702792)

The worst part of the story to me is —- those were not even the right keys, those were something issued to a client and scoped, but scoping check was broken. It’s unbelievably bad all around

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by ShadowRegent on Friday September 29, 2023 @08:27AM (#37702894)

Close, but not quite. The keys were for consumer Microsoft accounts, but accepted for organization accounts as well.

[ Parent | on HN ]

Re:Everything authenticated by Microsoft is tainted by styx31 on Friday September 29, 2023 @08:40AM (#37703120)

Only if your app was registered to accept both mixed organization and MSA account, which is not a default option.

[ Parent | on HN ]