Minidev News

In a recent incident, a key leak within Microsoft’s internal systems led to a thorough review and reinforcement of security protocols. This report highlights the details of the incident, the actions taken by the cybersecurity team, and the measures implemented to prevent similar issues in the future.

The Key Leak Incident

In April of 2021, a system crash in the consumer signing department led to a snapshot being taken of the crashed process – commonly referred to as a ‘crash dump’. By design, crash dumps are programmed to redact sensitive information, discluding the signing key. However, at this instance, due to an identified race condition, the key was found within the crash dump.

Data Transfer

The oversight of key presence in the crash dump was not initially detected due to a flaw in our system, and the crash dump was transferred from an isolated production network to an internet connected corporate network for debugging purposes in line with standard protocols. Similarly, our credential scanning methods also missed this presence.

In light of these findings, modifications have been introduced to enhance detection, prevention and response to key material erroneously included in crash dumps.

Account Compromise

Following this chain of events, a Microsoft engineer’s corporate account was compromised by the threat actor codenamed ‘Storm-0558’. This account was inadvertently given access to the debugging environment, which wrongly contained the key in the crash dump.

The compromise coupled with access to the key in the environment provided a probable route for the malicious actor to exfiltrate the key. Unfortunately, due to existing log retention policies, there is no specific evidence of this exfiltration.

Intersecting Domains: Consumer Key and Enterprise Mail

The unchecked presence of the signing key was further exacerbated when the mail system accepted a request for accessing enterprise emails using a security token signed with the consumer key.

The issue here was two-fold, with Microsoft providing an API to validate signatures without automatically performing scope validation, coupled with developers failing to add required issuer/scope validation on their part.

The issue has since been rectified with automation of key scope validation, updated libraries and clarified documentation.

Learning and Improving

The events that played out were an unfortunate failure of multiple checks and balances. However, in response to the incident, multiple corrective actions have been taken.

Incident Rectifying Measures

• The race condition that allowed the signing key into crash dumps has been identified and resolved.
• There has been an improvement in prevention, detection, and response to key material erroneously being included in crash dumps.
• Credential scanning methods have been enhanced for better detection of key presence in debugging environments.
• For added security, libraries have been enhanced to automate key scope validation in authentication libraries.

In conclusion, while the incident was regrettable, it has led to significant improvements in our security protocols and safeguards.

At Microsoft, we’re committed to maintaining a secure environment for all our operations, and we will continuously review and upgrade our infrastructure to prevent such incidents in the future.

For more details on the incident and corrective actions taken, please visit: Microsoft Storm-0558 Incident Review

Tags: #Microsoft #Cybersecurity #KeyLeakIncident #IncidentResponse

[Reference Link](https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/)

Protractor is a robust, end-to-end test framework designed specifically for Angular and AngularJS applications. As with any tool, it is important to understand its features, how to set it up, and how to navigate its life cycle.

The Anatomy of Protractor

Protractor stands atop the WebDriverJS, leveraging its native events and browser-specific drivers to interact with your application just like a user would. This creates a realistic testing environment and gives developers the ability to understand how their applications will be used in a real-world context.

Angular-Specific Features

Being tailored for Angular apps, Protractor supports Angular-specific locator strategies. This means you can test Angular-specific elements without going through any setup hassles.

Eliminating the Need for Manual Waiting

Waiting around for tests to complete and pages to load is a thing of the past with Protractor. When your webpage is done with pending tasks, Protractor efficiently steps up to automatically execute the next step in your test suite. No more wasted time coordinating your test and webpage syncing!

Getting started with Protractor

Setting up Protractor is straightforward using npm for global installation:

npm install -g protractor
protractor --version
webdriver-manager update 

Once installed, you can start up a server with:

webdriver-manager start

Then navigate to http://localhost:4444/wd/hub in your web browser.

Writing Your First Test

Protractor uses a spec file and a configuration file to run.

Here’s a simple test as an example that navigates to the AngularJS website todo list and adds a new todo item:

/* todo-spec.js */
describe('angularjs homepage todo list', function() {
    it('should add a todo', function() {
        browser.get('https://angularjs.org');
        element(by.model('todoList.todoText')).sendKeys('write first protractor test');
        element(by.css('[value="add"]')).click();

        var todoList = element.all(by.repeater('todo in todoList.todos'));
        expect(todoList.count()).toEqual(3);
        expect(todoList.get(2).getText()).toEqual('write first protractor test');

        /* You wrote your first test, cross it off the list */
        todoList.get(2).element(by.css('input')).click();
        var completedAmount = element.all(by.css('.done-true'));
        expect(completedAmount.count()).toEqual(2);
    });
});

Your configuration file (conf.js) looks like this:

/* conf.js */
exports.config = {
    seleniumAddress: 'http://localhost:4444/wd/hub',
    specs: ['todo-spec.js']
};

To run the test, use protractor conf.js in your terminal.

Protractor’s Future

It’s worth noting that Protractor is deprecated and reached its end-of-life in August 2023. Remaining conversant with its lifecycle is fundamental to understanding how it will evolve and what it means for those using it around this transition period.

For more updates, regularly visit your resources and stay informed!

#Protractor #AngularJS #EndToEndTesting #WebDriverJS

[Reference Link](https://www.protractortest.org/)

Throughout my journey learning Cypress automation testing, I encountered different kinds of challenges. These stumbling blocks were not just about the complexities of learning new tools, but also about understanding intricate details about how programs work and how we can ensure they are functioning appropriately.

Challenge 1: Getting Familiar with the Tools

One of the initial hurdles I faced when navigating this landscape were the diverse tools that Cypress Automation testing demanded. The more I delved in, the deeper my understanding grew and I was faced with the reality that to excel in Cypress testing, one had to wield tools like JavaScript and TypeScript effectively.

Challenge 2: Mastering Different Sorts of Code

Learning to understand the written code was a challenge of its own. The use of concepts like “promises” and “async/await” might seem perplexing at first glance, but it’s essential in ensuring that the different modules of your test scripts function harmoniously.

Challenge 3: Understanding API Testing

API testing proved to be another hurdle along the way. APIs are the mediums through which different computer programs communicate. The challenging aspect lied not just in understanding the workings of APIs but also in ensuring that the requests sent and the responses received through APIs were correct.

Challenge 4: Emulating Human Behavior

Another interesting and essential aspect of the journey was making the test scripts behave like a human user. The actions performed by the scripts needed to mirror the actions of a user for a more realistic and authentic testing experience.

Challenge 5: Dealing with Inconsistent Tests

One significant problem I faced was the inconsistency of the test scripts. Tests sometimes didn’t function as expected, leading to an intense process of identifiying the faults and brainstorming ways to rectify them. Moreover, developing an understanding of how Cypress retries tests upon failure was another skill to master.

Challenge 6: Integrating with CI/CD Systems

Lastly, integrating tests with Continuous Integration/Continuous Deployment (CI/CD) proved to be both riveting and challenging. Working with CI/CD ensures that the tests are updated automatically with the changes to the code, thereby saving time and maintaining relevance of the tests.

In the End, You’re Ready for Success

Looking back, I realized that mastering Cypress automation testing needs more than just understanding how to write code. It’s a confluence of various skills that come together, and it’s this intricate mesh of different abilities that define an expert in Cypress testing.

Keep Going, Enjoy the Journey

My advice to those who wish to embark on this journey is to not fear challenges. Every obstacle is an opportunity to learn something new. The process of learning Cypress is about understanding the code and also morphing into a versatile problem-solver in the field of automation testing.

Leave your thoughts, experiences, and challenges
I would love to hear about your experiences and challenges in automation testing. Please share your insights in the comments, let’s all engage in an enlightening conversation and grow collectively in this realm of automation testing.

Tags: #CypressAutomation, #CypressTesting, #APITesting, #CICD
Reference Link