[rdtsc]

> that eventually in the right succession result in catastrophic failure.

With a caveat that when it comes to security the eventual succession doesn't come as a random process but will be actively targeted and exploited. The attackers are not random processes flipping coins, rather they can flip a coin that often lands on "heads", in their favor.

The post-mortem results are presented as if events happened as a random set of unfortunate circumstances: the attacker just happened to work for Microsoft, there just happened to be a race condition, and then a crash randomly happened, and then the attacker just happened to find the crash dump somewhere. We should consider even starting with the initial "race condition" bug, that it might have been inserted deliberately. The crash could have been triggered deliberately. An attacker may have been expecting the crash dump to appear in a particular place to grab it. The attacker may have had accomplices.

[cathalc]

>The post-mortem results are presented as if events happened as a random set of unfortunate circumstances:

Public RCAs are nothing more than carefully curated PR stunts to calm customers. You can be sure the internal RCA is a lot more damning.

[ddalex]

The other frightening possibility is that the attack surface targeted by persistent threat actors is so large that a breach becomes certain (the law of large numbers): when you have so many accounts owned that one of them will have the right access rights; when you have so many dumps one of them will have the key; etc ...

[hulitu]

> the attack surface targeted by persistent threat actors is so large that a breach becomes certain

I thought a good security rule was to reduce the attack surface. But ok, we are talking about ... Microsoft. /s

[MichaelZuo]

This is why for certain things the minimum requirement should not be 99% certain or 99.9% certain, but 99.9999% certain.

[rawling]

> The post-mortem results are presented as if events happened as a random set of unfortunate circumstances: the attacker just happened to work for Microsoft

Does it say that?

> the Storm-0558 actor was able to successfully compromise a Microsoft engineer’s corporate account

[rdtsc]

Ah you’re right thanks for the correction.