Get the latest tech news
In major gaffe, hacked Microsoft test account was assigned admin privileges — How does a legacy test account grant access to read every Office 365 account?
How does a legacy test account grant access to read every Office 365 account?
OOPS — The hackers who recently broke into Microsoft’s network and monitored top executives’ email for two months did so by gaining access to an aging test account with administrative privileges, a major gaffe on the company's part, a researcher said. Russia-state hackers, Microsoft said, used a technique known as password spraying to exploit a weak credential for logging into a “legacy non-production test tenant account” that wasn’t protected by multifactor authentication. Threat actors like Midnight Blizzard compromise user accounts to create, modify, and grant high permissions to OAuth applications that they can misuse to hide malicious activity.
Or read this on r/technology
