1

As MSDN subscribers all members of our development team need to have a Microsoft account. Since September 2016 these Microsoft accounts get disabled, temporarily or permanently, with no explanation from Microsoft. For some of us the accounts were enabled back after confirming our identity using our mobile phones. For these accounts, the activity page shows multiple successful logins from a location in Amsterdam. The first time it happened to me I've quickly generated a really long password using KeePass and, for a while, the "Amsterdam logins" went away. Yesterday I've seen again one of these logins and one of my coworkers had again to prove his identity to get back access to his Microsoft account. Are these "unusual activity" real logins or is there an error in the Microsoft systems? Can somebody crack a KeePass generated password with 245 bits (64 chars long)? Where should we start investigating this situation which is greatly affecting our productivity? [EDIT] I've managed to match one of the IP addresses to the owner. See WhoIs information below: WhoIs IP 40.68.25.96

NetRange: 40.64.0.0 - 40.71.255.255 CIDR: 40.64.0.0/13 NetName: MSFT NetHandle: NET-40-64-0-0-1 Parent: NET40 (NET-40-0-0-0-0) NetType: Direct Assignment OriginAS:
Organization: Microsoft Corporation (MSFT) RegDate: 2015-02-23 Updated: 2015-05-27 Ref: https://whois.arin.net/rest/net/NET-40-64-0-0-1

OrgName: Microsoft Corporation OrgId: MSFT Address: One Microsoft Way City: Redmond StateProv: WA PostalCode: 98052 Country: US RegDate: 1998-07-09 Updated: 2017-01-28 Comment: To report suspected security issues specific to traffic emanating from Microsoft online services, including the distribution of malicious content or other illicit or illegal material through a Microsoft online service, please submit reports to: Comment: * https://cert.microsoft.com.
Comment:
Comment: For SPAM and other abuse issues, such as Microsoft Accounts, please contact: Comment: * [email protected].
Comment:
Comment: To report security vulnerabilities in Microsoft products and services, please contact: Comment: * [email protected].
Comment:
Comment: For legal and law enforcement-related requests, please contact: Comment: * [email protected] Comment:
Comment: For routing, peering or DNS issues, please Comment: contact: Comment: * [email protected] Ref: https://whois.arin.net/rest/org/MSFT

OrgAbuseHandle: MAC74-ARIN OrgAbuseName: Microsoft Abuse Contact OrgAbusePhone: +1-425-882-8080 OrgAbuseEmail: [email protected] OrgAbuseRef: https://whois.arin.net/rest/poc/MAC74-ARIN

OrgTechHandle: MRPD-ARIN OrgTechName: Microsoft Routing, Peering, and DNS OrgTechPhone: +1-425-882-8080 OrgTechEmail: [email protected] OrgTechRef: https://whois.arin.net/rest/poc/MRPD-ARIN

Now, what do I understand from that: is Microsoft having a communication issue between its departments or is Microsoft having a security issue and somebody is abusing their network or is somebody using Azure to crack Microsoft accounts?

[EDIT] I've changed again the password on my account and enabled two-factor authentication. I haven't seen unusual activity for the last 5 days. Maybe this will help other people as well.

Improve this question
1
  • To all who have answered, thank you, I've upvoted your answers for now. Please bear with me for a day or two until we verify all your suggestions and then I'll mark one of the answer as the accepted one.
    – Dan
    Commented Feb 1, 2017 at 11:21

2 Answers 2

Reset to default
2

Most likely the attacker is not cracking the password itself, but probably getting it through other vectors. Some recommendations:

  • Check if the "password recovery" email was not changed
  • Check if the "Security Questions" were not changed
  • Check your profile and security settings, see if you see something changed
  • Run a full anti-virus scan to ensure you don't have malware on your laptop
  • Perform network checks (such as running netstat on your laptop or check firewall logs) to see if someone is exfiltrating data from your laptop
  • Enable two-factor authentication on your Microsoft account, that will most likely stop the attack.
Improve this answer
1

Do the users in question use Skype? Or have they ever used Skype in the past? There is a nice little back door into Microsoft accounts where you can login with you Skype ID and password. Which bypasses any 2FA or other security measures on your account.

https://www.reddit.com/r/sysadmin/comments/5jg8y6/fyi_criminals_are_still_attempting_to_use/?st=IYLTKBZ4&sh=2da3aec8

http://www.theverge.com/2016/11/8/13561024/microsoft-skype-baidu-linkedin-hack

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .