When Microsoft’s network was compromised, it all traced back to an old ‘legacy test account’ that, surprisingly, had too much power and too little security. This account, which should have been outdated, needed to be either shut down or removed from its admin role. Without multi-factor authentication (MFA), it was like leaving a car unlocked with the keys inside — a clear security risk.
Why It’s Serious
The principle of least privilege is fundamental in network security, meaning that accounts, especially those for testing, should only have the minimum access needed for their specific tasks. The legacy test account still had admin rights, which are usually kept for key accounts that manage widespread network changes.
Note: Concerned about unchecked administrative privileges in your network? A Cyber Risk Audit is your first line of defence. Our team specialises in identifying and mitigating risks associated with excessive access rights.
How the Breach Occurred
The group known as Midnight Blizzard gained access to this over-privileged test account through a technique known as ‘password spraying’. This is a method where common passwords are tried against multiple accounts until one works. The absence of multi-factor authentication (MFA) and the legacy status of the account both contributed to the success of this breach.
The Hackers’ Strategy
Once in the network, the attackers misused the OAuth protocol, meant for app authorization, to create dangerous applications. These apps were then given permission to access every email within the Office 365 environment. This strategy was part of a pattern of behaviour for Midnight Blizzard, marked by their low-and-slow approach that mirrors their methods in the SolarWinds breach.
The Broader Impact
The security breach at Microsoft didn’t just stop there. It also hit Hewlett-Packard Enterprises, a major player in the tech industry. Microsoft is now reaching out to other companies that might be affected, showing just how big the impact of this security slip-up is.
In the aftermath, Microsoft has been less than forthcoming about why the legacy test account was never secured or decommissioned. The lapse raises questions about the company’s adherence to its own security policies and its learning curve from past security events.
Need Help with Security?
Feel free to Contact Us anytime. We’re here 24/7 to assist businesses in safeguarding against cyber-attacks. Whether it’s arranging a Cyber Risk Audit or a service tailored to your specific needs, our team will make sure you’re protected.
