Navigating the Storm: Lessons from the Midnight Blizzard Attack on Microsoft

The tech community was stunned when the Midnight Blizzard cyberattack, attributed to the Russian Foreign Intelligence Service (SVR), unfolded at Microsoft.??

What began as a security oversight—a dormant test account left unprotected—quickly escalated into an elaborate scheme, compromising sensitive data from the emails of Microsoft's top executives. This event reminds us that no organization is immune to cyber-attacks despite its technological prowess or security awareness. The incident also demonstrates that overlooked aspects of IT infrastructure can become gateways for bad actors to do considerable damage.?

Breaking Down the Midnight Blizzard Strategy?

Much like the strategies seen in the 2020 SolarWinds incident, the Midnight Blizzard operation used a sophisticated approach to breach Microsoft.?

The hackers began with a password spray attack on a forgotten test account that didn't have multi-factor authentication (MFA) protection. Using residential proxy networks, they hid their activity and throttled login attempts, dodging both detection and the usual security measures that would typically lock them out of the account.??

Once inside, the attackers exploited an old OAuth application with privileged access to Microsoft's systems. From there, the attackers created new OAuth applications to extend access to other email accounts.?

How the Attack Worked?

This attack highlights the vulnerabilities that SaaS sprawl creates. SaaS sprawl happens when employees add new SaaS (Software as a Service) applications without following corporate policies, bypassing the appropriate vendor security reviews. Unmanaged SaaS creates weak spots in a company’s attack surface. As more SaaS apps are added, keeping track of all user accounts gets even harder, expanding the security gaps.?

Additionally, the attackers slipped past the usual security checks and stayed off the radar by using residential proxies, which made their activity look normal and blend in with the legitimate traffic. Once they had their foot in the door, they went after OAuth applications, which allowed them to access other apps without a password. They then created additional OAuth apps with elevated permissions to infiltrate Microsoft’s network deeper.??

Isolating the Missteps?

The core issue in this incident wasn't a glitch in the software that let the attackers in; it was a weakness in enforcing SaaS security policies. Specifically:??

• An inability to contain SaaS sprawl; an exposed user account that got lost in the shuffle as more and more applications were used.??
• Missed Multi-Factor Authentication (MFA) where it was needed.??
• Insufficient management of privileged OAuth scopes.???

The breach unfolded not with brute force but through careful navigation of these security oversights, much like water finding its way through the smallest cracks in a dam. The Microsoft incident illustrates the importance of a solid plan for managing app inventory, access, and usage.?

Preventing a Similar Attack in Your Organization?

The Midnight Blizzard attack serves as a caution and prompts a deeper reflection on the vulnerabilities inherent in your SaaS growth and security policy lapses. Both leave companies vulnerable if not managed.?

Identifying SaaS Sprawl?

Identifying SaaS sprawl means taking a hard look at your SaaS inventory. Not just the number of applications in use but also understanding their purpose, the data they access, and who in your organization is using them. Start with an audit, categorize each application, and regularly review them to ensure they are still necessary and secure. A SaaS identity risk management platform, like Grip Security, streamlines the process and allows you to monitor changes without another manual audit.?

Strengthening Defenses with MFA?

By requiring multiple proofs of identity, MFA creates a multi-layered defense system that drastically diminishes the likelihood of unauthorized entry, even when passwords fall into the wrong hands. MFA also serves as a frontline defense against exploiting weak or stolen passwords. However, implementing MFA everywhere is challenging. Why??

The democratization of tech and the rise of business-led IT. As companies increasingly adopt business-led IT approaches, specific risks, like SaaS sprawl and Shadow IT, become more pronounced. This shift, where various business units independently select, acquire, and manage applications, naturally leads to decreased visibility for the IT department. Gartner predicts that by 2027, 75% of employees will acquire, modify, or create technology outside of IT’s visibility.???

With most applications expected to be business-led, implementing MFA universally will be even more challenging. The lack of IT oversight means that without deliberate action, most apps will be outside the purview of those safeguarding the organization's digital assets.?

Most SaaS apps are unfederated. The increase of business-led IT coupled with the work (and expense) of setting up MFA is overwhelming to most security teams, who are already backlogged from existing MFA and SSO enrollment. As a result, most SaaS apps remain unfederated. The remedy is identifying and prioritizing which apps are critical for MFA.?

Managing OAuth Scopes?

A significant aspect of the Midnight Blizzard attack was the lack of management over OAuth scopes with extensive permissions.?

Managing OAuth scopes involves setting strict permissions for each application and continuously monitoring them to prevent overreach. Establishing a protocol for regularly reviewing and auditing these permissions ensures that they remain in line with user roles and that any abnormal behavior is quickly detected and addressed.??

Following Microsoft's recommendations, organizations are encouraged to conduct thorough reviews of OAuth privilege settings across all their digital identities, including user accounts, applications, and tools. Audits should pay special attention to any identity with extensive permissions, focusing particularly on those that might no longer be active or have privileges that exceed what's needed for their function. Microsoft also stresses the importance of context in these reviews, advocating for a closer look at any permissions tied to unknown or inactive identities, or those that aren't necessary, to minimize security risks.?

Conclusion?

The Midnight Blizzard attack highlights the dangers of unmanaged SaaS and unattended OAuth scopes and reminds us of the perils when they are allowed to sprawl out of control. SaaS adoption will continue to accelerate and decentralize. Establishing your SaaS policies, prioritizing which apps need MFA, and regularly reviewing OAuth scopes will help to reduce your vulnerabilities—and Grip Security is here to support you in your efforts. ??

The Grip platform is designed to uncover every SaaS and cloud tenant across your digital estate, shining a light on shadow SaaS applications and ensuring they're cataloged, evaluated for risk, and secured accordingly. Additionally, Grip maps your SaaS landscape to identify where MFA is missing, allowing you to enforce this essential safeguard. Grip also has a proactive strategy for managing OAuth scopes, providing detailed insights into the access levels and permissions of OAuth applications, and an unparalleled offboarding workflow. If you’d like to see how Grip can help secure your SaaS environment, we invite you to book a no-obligation demo now.?

#SaaS #riskmanagement #cyberrisk #breach #identityrisk