Solar Winds, Office 365 & Shipbuilding…

Early ships had a single continuous and connected hull. Easier to build, but easy to sink as a breach of the hull filled all of it with water. Multiple watertight hull compartments made ships safer, and a vessel could be made virtually unsinkable if it were divided into enough small compartments.  What’s that got to do with Solar WInds and Office 365?

Sponsorships Available

Sponsorships Available

Sponsorships Available

Microsoft released a fascinating tech note on the impact of the Solar Winds breach titled “Using Microsoft 365 Defender to protect against Solorigate.”   According to that tech note, the hacker fans out from a single compromised Windows device in an organization as follows:

1. Using the compromised SolarWinds DLL to activate a backdoor that enables attackers to remotely control and operate on a device
2. Using the backdoor access to steal credentials, escalate privileges, and move laterally to gain the ability to create valid SAML tokens using any of two methods:
   1. Stealing the SAML signing certificate (Path 1)
   2. Adding to or modifying existing federation trust (Path 2)
3. Using attacker-created SAML tokens to access cloud resources and perform actions leading to the exfiltration of emails and persistence in the cloud

Item 3 above grants the hacker access to Office 365, Azure AD, MCAS and beyond.  In short, if the organization is a “Microsoft shop,” it is guaranteed to be breached end-to-end. 

Enterprises that favor Microsoft security infrastructure are essentially ships with a single connected hull.  A hole in one place ensures the ship sinks.  In contrast, enterprises that use independent IdP, CASB, Malware protection etc, have hull compartments to ensure that a leak in one compartment does not sink the ship, so to speak.

Learn more about best practices for protecting against Ransomware and Malware in the distributed enterprise.