Reading Authentication Logs

That is one hour of one afternoon at the video game studio, from its player sign-in server and its devices, with the failed sign-in attempts grouped by where they came from. A summary like this one is how an analyst reads tens of thousands of log lines at once. Which attack does each row show?

Row A is someone guessing at rally_queen through the sign-in page. After six wrong passwords the page locked the account, and the 41 tries that came after were refused without being checked, right or wrong. The lockout did its job, and the row is still worth a look: the player may need to know someone is after the account.

Row B is a spray. All of it came from a single address, and since it never went back to an account it had already tried, no account's lockout ever counted to two. Nine players had chosen whatever password the spray was trying. Row D is someone on the guest Wi-Fi trying the default sign-ins the cabinet's maker ships, six in under a second, far too fast for a person typing. The cabinet's separate network segment should have kept the guest Wi-Fi from reaching its maintenance page at all. The cabinet's password had been changed, so none worked.

The hardest to see is row C. It is also a spray, but spread so thin that no single address did anything unusual: each sent one attempt and never came back. What gives it away is the total, thousands of failures in an hour against different accounts, which is far more than this sign-in server sees on an ordinary afternoon.

Someone else now has the passwords to the 13 accounts from rows B and C, and the log can show that too. One of them belongs to a player who has signed in from the same home internet connection in Ohio every evening since the account was made; it signs in at 4 a.m. from an address abroad and starts trading away its rarest items. The studio locks all 13 accounts and makes their owners choose new passwords.

A group Microsoft calls Midnight Blizzard, which the U.S. and British governments have tied to Russia's foreign intelligence service, began a password spray against Microsoft in late November 2023. Microsoft later wrote that the group aimed at a small number of accounts, made few attempts so that nothing was locked out, and sent them through a huge pool of home internet addresses that ordinary people also use, so that watching for, or blocking, known bad addresses could not keep up. In a summary like the studio's, it would have looked like row C turned down further, with so few attempts that even the hourly total that gives row C away stayed low. The account it got into was an old test account with no multifactor authentication.

From there the group found an old test application with broad access to Microsoft's corporate systems and used it to read the email of a small share of Microsoft's employees, including members of its senior leadership and people on its security and legal teams. Microsoft's security team detected the intrusion on January 12, 2024, and announced it a week later. In March it said the group had also reached some of its source code. In April the Cybersecurity and Infrastructure Security Agency ordered the federal agencies whose emails with Microsoft had been stolen to review those emails and reset any passwords, keys, or tokens in them that might be compromised, because the group was using what it had read to try to break into Microsoft's customers.