MICROSOFT EMAIL HACK SHOWS THE LURKING DANGER OF CUSTOMER SUPPORT

ON FRIDAY NIGHT, Microsoft sent notification emails to an unknown number of its man or woman email users—across Outlook, MSN, and Hotmail—warning them about a facts breach. Between January 1 and March 28 of this 12 months, hackers used a fixed of stolen credentials for a Microsoft customer service platform to access account facts like email addresses in messages, message difficulty lines, and folder names private debts. By Sunday, it mentioned that the problem changed into, honestly, plenty worse.

After tech information web page Motherboard confirmed Microsoft proof from a supply that the scope of the incident was more enormous sizeable, the organization revised its preliminary announcement, pronouncing instead that for about 6 percent of customers who acquired a notification, hackers can also get right of entry to the textual content in their messages and any attachments. Microsoft had previously denied to TechCrunch that complete email messages were affected.

It might also appear abnormal that an available set of customer support credentials might be the keys to this sort of big kingdom. But within the security community, purchaser and internal support mechanisms are increasingly seen as a capability source of publicity. On the only hand, support marketers want sufficient account or tool get right of entry to if you’re going to, in reality, assist human beings. But as the Microsoft incident indicates, too much get right of access to within the wrong hands can cascade into a risky situation.

“We addressed this scheme, which affected a restrained subset of consumer bills, by disabling the compromised credentials and blocking the perpetrators’ access,” a Microsoft spokesperson advised WIRED. The business enterprise says that “out of an abundance of warning,” it has elevated danger monitoring for money owed impacted via the breach. Microsoft could not remark to WIRED on the scale of the attack or offer the whole variety of impacted funds owed.

Without extra statistics from Microsoft, it’s hard to characterize the purpose of the attack. Email money owed may be precious to criminals; people frequently use them to installation other debts, which means attackers can use the email account itself to reset passwords and compromise multiple services. Motherboard mentioned that the attackers did, in truth, use their get admission to break into iCloud money owed to disable iPhone activation locks. But with almost three months of getting right of entry at their disposal, it’s miles nevertheless uncertain whether or not the attackers have been targeted on small-scale, focused intrusions or sweeping fraud.

“We have diagnosed that a Microsoft guide agent’s credentials have been compromised, permitting people out of doors Microsoft to get right of entry to facts inside your Microsoft email account,” Microsoft stated in a announcement, indicating that the attack became now not the result of an insider threat. But that raises even additional questions.

“Sometimes a trouble is virtually difficult to diagnose over the telephone just by using explaining so that you want an excessive-privilege consumer a good way to leap into the account,” says Jeremiah Grossman. He labored as a statistics security officer at Yahoo for two years inside the early 2000s and is now CEO of the corporate stock protection firm Bit Discovery. “But that customer service representative device must now not be remotely reachable over the internet; it ought to be an internal-only gadget. So how precisely did the adversary even hook up with [the Microsoft portal], let alone log in?”

Grossman also notes that Microsoft must have required customer support bills with massive get entry to apply two-factor or multifactor authentication, which can have helped save you this issue within the first vicinity. Unfortunately, Microsoft appears no longer to be the exception.

“We do quite a few consulting engagements in which we pass as much as any machine at an employer, call up the assist desk, and then can clutch the aid engineers’ credentials when they connect with the gadget and use them to access other servers—just like the CEO’s server,” says Dave Aitel, chief protection technology officer on the cozy infrastructure company Cyxtera. “In preferred, ‘assist’ is a huge protection hollow waiting to occur.”

The key to retaining a customer service gadget, Grossman says, is to create controls on how many people have a privileged account get right of entry to and to carefully document all times wherein a consumer’s account is accessed for auditing. Engineering teams already use systems like that for conditions in which credentials want to be guarded closely, like debugging or enjoyable law enforcement data requests.

If you acquired a notification email from Microsoft, you definitely should change your email account password and permit -thing authentication if it isn’t always on. But it is tough for users to guard themselves while at the mercy of customer service protection they cannot manage. The least Microsoft ought to do is provide a clear picture of what occurred—and why.