Rantburg

Today's Front Page   View All of Sat 11/14/2026 View Fri 11/13/2026 View Thu 11/12/2026 View Wed 11/11/2026 View Tue 11/10/2026 View Mon 11/09/2026 View Sun 11/08/2026
2026-11-14 Cyber
Microsoft has fixed the cause of the outage in its services
Direct Translation via Google Translate. Edited
[Regnum] American IT corporation Microsoft has fixed the cause of the outage in its services and is continuing to restore them. The company's press service reported this on November 13.

"We deeply regret the disruption this incident has caused our customers and partners. We understand the trust they place in our services, and we take this responsibility extremely seriously," the corporation's press service noted on social media.

According to the company, service operations have largely been restored and stabilized.

Microsoft has ruled out any connection between the incident and cyberattacks, artificial intelligence, or AI agents. The issue arose during a previous network capacity upgrade and resurfaced after a recent change in network performance. Recovery efforts are still ongoing for some customers and regions.

Due to high demand, Microsoft restored services in stages, testing their stability at each stage. The company estimates that this approach took longer but helped ensure a sustainable recovery.

Earlier that day, a Microsoft outage was reported in more than 70 countries. Users reported the unavailability of Outlook, Teams, Copilot, and other services. The company attributed the problems to increased infrastructure load. Some social media users linked the widespread Microsoft outage to the " end of the world " predicted by scientists back in 1960.

# id) ?>
Posted by badanov 2026-11-14 00:00|| E-Mail|| Front Page|| ||Comments [131 views ]  Top

1 Talking in circles to explain it away. Not good.
Posted by 49 Pan 2026-11-14 04:44||   2026-11-14 04:44|| Front Page || Comments   Top

2 [AI]
hacking Active Directory

**Active Directory (AD) hacking** is a multi-stage penetration testing process focused on enumerating the domain, escalating privileges, and moving laterally to achieve domain control. The methodology typically progresses from **Initial Access** (obtaining the first foothold) to **Enumeration**, **Privilege Escalation**, **Lateral Movement**, and finally **Persistence**.

### 1. Initial Access and Credential Harvesting
Attackers often begin by gathering credentials without direct login, exploiting network protocols or weak configurations.
* **LLMNR/NBT-NS Poisoning**: Tools like **Responder** and **Responder.py** are used to spoof network responses, capturing NTLMv2 hashes from users who attempt to resolve non-existent hosts.
* **SMB Relay**: Using **impacket-ntlmrelayx**, captured hashes can be relayed to other services to authenticate as the victim.
* **AS-REP Roasting**: Targets accounts that do not require Kerberos pre-authentication, allowing attackers to request and crack offline authentication responses.
* **Phishing/Malware**: Spear-phishing or exploiting web vulnerabilities to install implants or steal cached credentials.

### 2. Enumeration and Mapping
Once a foothold is established, attackers map the domain structure to identify high-value targets and attack paths.
* **BloodHound**: The primary tool for visualizing AD relationships. It uses **SharpHound** to collect data and identify privilege escalation paths (e.g., GPO abuse, unconstrained delegation).
* **Impacket Toolkit**: Provides scripts like `secretsdump.py` and `ntlmrelayx.py` for remote enumeration and credential dumping.
* **PowerView/PowerShell**: Native Windows PowerShell modules (e.g., `Get-ADUser`, `Get-NetGroup`) allow for deep internal reconnaissance without external tools.

### 3. Privilege Escalation and Lateral Movement
Attackers exploit misconfigurations and weak credentials to move from a low-privileged user to Domain Admin.
* **Kerberoasting**: Requests service tickets for accounts with Service Principal Names (SPNs) and cracks the hashes offline using **Hashcat** or **Rubeus**.
* **Pass-the-Hash (PtH) / Pass-the-Ticket (PtT)**: Uses stolen NTLM hashes or Kerberos tickets (via **Mimikatz**) to authenticate to other machines without knowing the plaintext password.
* **DCSync**: With replication permissions (often gained via Domain Admin or specific ACLs), attackers use **Mimikatz** to request password hashes directly from the Domain Controller.
* **Golden Ticket**: Forges a Kerberos Ticket Granting Ticket (TGT) using the **KRBTGT** hash, granting persistent, undetectable access to the entire domain.

### 4. Persistence and Exfiltration
To maintain access and steal data, attackers target the Domain Controller (DC).
* **NTDS.dit Extraction**: Attackers copy the AD database (`ntds.dit`) and the SYSTEM hive using **Volume Shadow Copy** or **ntdsutil.exe** to extract all user hashes offline.
* **AD CS Abuse**: Misconfigured Certificate Services (e.g., **ESC1**, **ESC8**) allow attackers to forge authentication certificates, potentially escalating to Domain Admin.
* **Golden Certificate/SAML**: Steals CA keys or AD FS token-signing keys to impersonate users in cloud environments (Azure AD/M365).

### Common Tools
* **Mimikatz**: For dumping LSASS memory, passing hashes, and DCSync.
* **BloodHound**: For attack path analysis.
* **Impacket**: For SMB, LDAP, and Kerberos protocol interactions.
* **Rubeus**: For Kerberos ticket manipulation and Kerberoasting.
* **CrackMapExec (CME)**: For rapid lateral movement and credential testing.

### Learning Resources
* **Hack The Box (HTB)**: Offers dedicated AD paths and machines (e.g., "Active Directory 101").
* **TryHackMe**: Features modules like "Compromising Active Directory."
* **GOAD**: A GitHub project providing a vulnerable AD lab environment for practice.
* **TCM Security**: Offers live training and courses on defending and attacking AD.
Posted by Skidmark 2026-11-14 05:13||   2026-11-14 05:13|| Front Page || Comments   Top

3 
WOW ! MS states it addressed 1,235+ Security issues and flaws, all in a few hours?

Sure sounds like a lame explanation.
Which likely has a lot of users wondering what the real issue(s) were, and how long MS sat on them?

Or is MS hiring the CCP and India to do their coding ?

Posted by NN2N1 2026-11-14 05:33||   2026-11-14 05:33|| Front Page || Comments   Top

4 In other Microsoft news…. Windows 95 now works.
Posted by Airandee 2026-11-14 05:57||   2026-11-14 05:57|| Front Page || Comments   Top

5 Microsoft says service is returning to normal, AI not to blame for ‘historic’ outage

Noting Microsoft’s alert system appeared not to work, Moussouris said: “Something really bad must have happened that the cascade was not only as long lasting, but they couldn’t recover.”

The disruption came during a challenging time for the tech giant.

It recently offered buyouts to over a quarter of its workforce — 60,000 employees — as it looked to cut costs and restructure its staff to meet the AI moment.

Last year, the company laid off 9,000 employees.

Industry experts and users on social media were quick to conjecture that Microsoft’s cost-cutting measures brought on the outage, though they offered no evidence.

The tech giant has been doubling down on building AI infrastructure and securing partnerships with OpenAI and Anthropic.


Suggesting AD was poisoned by a insider.
Posted by Skidmark 2026-11-14 06:14||   2026-11-14 06:14|| Front Page || Comments   Top

6 The fix is more India.
Posted by mossomo 2026-11-14 10:44||   2026-11-14 10:44|| Front Page || Comments   Top

7 It's a feature not a bug.
Posted by Procopius2k 2026-11-14 11:14||   2026-11-14 11:14|| Front Page || Comments   Top

15:08 Remoteman
15:00 Frank G
14:57 Besoeker
14:46 DooDahMan
14:28 Abu Uluque
14:18 Abu Uluque
13:26 Abu Uluque
13:21 Frank G
13:17 Rambler
13:15 Abu Uluque
13:12 Grom the Reflective
13:01 Abu Uluque
13:01 trailing wife
12:48 Frank G
12:42 Chantry
12:40 Abu Uluque
11:44 Grom the Reflective
11:43 trailing wife
11:36 trailing wife
11:14 Procopius2k
11:12 Grom the Reflective
11:05 Grom the Reflective
10:59 mossomo
10:57 Chantry
Merry-Go-Blog










Paypal:
Google
Search WWW Search rantburg.com