Patrick GerkenApr 23
þēodrīċ, norþes ecghlāford
Look at this fantastic piece of advice from Microsoft! https://learn.microsoft.com/en-au/answers/questions/2007466/are-costs-incurred-when-attempting-to-scan-passwor
Apr 22 at 9:32amWeb
Show threadJariApr 22
@theodric I reported the answer :P But pretty sure nothing will happen
Show threadKasTasApr 22

@theodric

> "Sumarigo-MSFT 47,511 Reputation points • Microsoft Employee • Moderator"

o_0

Show threadHans-MartinApr 23
@KasTasMykolas @theodric well it's par for the course on Microsoft answers.
Show threadKR3ST3N 🌻Apr 22

@theodric @phloggen Fantastic advice. I also noted that files larger than 2GB are exempt from scanning?!?

Thanks. I’ll just add 2GB of randomness before my payload, then…

Checkmark security (or compliance for some) at its best. 👍

Show threadHannekeApr 23
@kr3st3n @theodric @phloggen yeah but it also says “Ensure that the size of the password-protected zip files does not exceed the 2 GB limit to avoid unnecessary consumption of the scanning quota.”??
Show threadHazelnootApr 23
@kr3st3n @theodric @phloggen this is an actual technique that works against many commercial AV and EDR solutions
Show threadHazelnootApr 23
@kr3st3n @theodric @phloggen a related one is to generate a bunch of very large benign archives to flood the scan queue before it picks up your payload, giving it time to execute before the system flags it.
Show threadembixApr 23
@theodric This basically translates to "Please make sure your password is part of our rainbow table", right?
Show threadZuri (he/him) ❌️👑 | 🕐 CETApr 27
@brezelradar @theodric I hope, Microsoft has its own variant of https://haveibeenpwned.com for this use case
Have I Been Pwned: Check if your email address has been exposed in a data breach

Have I Been Pwned allows you to check whether your email address has been exposed in a data breach.

Have I Been Pwned
Show threadZikkoApr 23
@theodric Uhhhh, what the fuck?
Show threadAlexander JanßenApr 23
@theodric I'm too sober for this shit
Show threadTeflonTrout  he/himApr 23

@theodric

That is not very correct horse battery staple of them at all

Show threadHeals  (moved)Apr 23

@theodric it’s only Azure Blob storage! No one would store sensitive data in the cloud! Right!… Right?! /s

/cc @aeva

Show threadKévin ⏚Apr 23

« Additionally, Microsoft has methods for scanning the contents of password-protected zip files, such as extracting possible passwords from the bodies of an email or the name of the file itself »

Isn’t that technically a cybercrime in most countries 🤔

Show thread6Apr 23
@kc the fines are just the price of doing business ;p
Show threadKévin ⏚Apr 23
If you pay them 😉
Show threadKévin ⏚Apr 23
I can’t remember where I found the story a while back but basically the gist of it is most of these companies just don’t pay or they fuck around so long the regulators drop the amounts substantially. When you have the amount of money (and lawyers) of all the nations on earth, what is one or a collection of countries going to do about it
Show threadSam StephensApr 23
@theodric satire is truly over
Show threadKaterina MarchánApr 23
@theodric this reads like an LLM response, so is probably just that
Show threadLucky ✨Apr 23
@theodric holy fuck?
Show threadLeo Ré JorgeApr 23
@theodric This has to be an LLM response... even leaving alone this horrible security advice, the whole response is trying to do the exact opposite of what the OP asked!
Show threadEve VentuallyApr 23
@LeoRJorge @theodric Offering irrelevant / off topic advice is pretty normal for humans where complicated or obscure questions are in play (source: reading lots of StackOverflow and forum responses written before the advent of stochastic parrots). That said, I do agree this is likely slop since the point about the passwords would have to be hallucinated.
Show threadLeo Ré JorgeApr 23
@EveHasWords @theodric Yeah, maybe I was giving too much merit to the Microsoft employee who posted the reply...
Show threadBurak GürsoyApr 23
@theodric p4ssw0rd1
Show threadAuthor-ized L.J.Apr 23
@theodric “Microsoft has methods for scanning the contents of password-protected zip files, such as extracting possible passwords from the bodies of an email or the name of the file itself[.]” Cool and normal stuff, your storage provider telling you that they are essentially cracking your data.
Show threadHugh Young-BishApr 23
@theodric
Does it suggest "password" or "ABC123"?
Show threadRob RicciApr 23
@hugh @theodric It's worse, if you were to follow the advice above it in the article, you would either include the password in the text of the email or use the filename as the password
Show threadrmikkeApr 23
@theodric
Show threadFrost, ᛁᛊᛟᛚᚠᚱ 🐺❄️Apr 23
@theodric what the..what??
Show threadMarijke LuttekesApr 23
@theodric In an unrelated statement, a Microsoft employee also recommended the use of generic locks that are easy to pick, lest you’ll never be locked out of your house again.
Show threadsauc3Apr 24

@theodric

Classic Microslop

Show threadEpic NullApr 24
@theodric I am concerned that Defender is trying to decrypt files at all...
Show threadJoe Cooper 🇺🇦 🍉Apr 24
@theodric relatedly, if everybody uses the same password the odds of someone guessing a password goes way down, right? Like, if there are 50 people in an organization and they each have their own password, an attacker is 50 times more likely to guess a password. That's just basic math.
Show threadMatt PalmerApr 24
@swelljoe your logic is impeccable.
Show threadaura, disgraced hereticApr 24
@theodric ah, passwords as social convention
Show threadXenia0040Apr 25
@theodric google is evil but they're good at what they do. Microsoft is just evil
Show threadsu_liamApr 25
@theodric I’m sure this response was perfectly appropriate…
Show threadHippo 🍉Apr 25
@theodric you made me open up a Microsoft website 🤯
Show threadArne BöttgerApr 25
@theodric It’s about history. First there were DOC and XLS files with macros exploiting auto-opening. Th en these file types were blocked, forcing people to put them in a ZIP envelope. Then blocking of unprotected ZIP files forcing user interaction to extract them. Followed by the hindsight that you still might want to scan them.
Just disable auto-opening from mail apps and educate users instead of adding more and more yellow tape.
Show threadEscape planApr 25
@theodric
Insecurity as a feature