Microsoft's Active Directory ("AD") and "Entra" Are National Security Threats
Even the US government concluded Microsoft could not be trusted for security; it issued a formal report about it in April 2024 (China 'broke into' all the important servers and by extension sensitive secrets the Americans had entrusted Microsoft to protect)
Yesterday we said China was dumping Microsoft Windows (or Windows and - by extension - much of the Microsoft stack), "Citing National Security Concerns" and showing rapid signs of rapid action.
They rightly recognise Microsoft as a national security threat, so this is not about money!
An associate has since then alerted us that "Berlin cuts two state ministries off government network after security breach" (by Recorded Future, historically connected to the CIA; it spied on IRC networks, too, now it's part of Mastercard, an instrument of economic warfare and espionage, as Cablegate showed).
The associate has asked, "what kind of gag clause is in their support contract," and especially if it's Active Directory ("AD") or "Entra" in Azure (c.f. University of Michigan's 2023 breach; we put many links about this in our Daily Links this morning).
Adding weight to what this associate said, SQ Magazine reports an Azure breach impacting McDonald's, Vodafone, TCS, and lesser known firms. To quote:
A threat actor known as TheHatman is selling internal employee directories allegedly exfiltrated from the Azure and Entra tenants of McDonald’s, Vodafone, and seven other Fortune 500 companies, cybersecurity firm Hudson Rock reported this week. The McDonald’s dataset alone totals more than 1.7 million records.
"Microsoft has more lock-in now than ever before," we're told. "One of the worst vehicles for that is the security hole known as Active Directory. It puts Microsoft at the core of the LAN and works almost well enough with non-Microsoft systems that managers push it instead of trying to fight Bill [Epsteingate] over OpenLDAP + Kerberos support and integration."
Microsoft seems to have 'rebranded' AD as "Entra" (for "the cloud", "Clown Computing") around the time AD was getting a ton of bad publicity for routinely and trivial security breaches.
You can trust Microsoft with security as much as you can trust the men below with your 10-year-old daughter. █
