The SolarWinds attack was carried out via a compromise of the software vendor of the same name
Possibly SolarWinds, the company, might have been compromised by an ADFS vulnerability. Regardless I'm not sure why fixing an ADFS vulnerability would have endangered a contract negotiation. Its not exactly a secret that software has flaws and MS patches major ones every month
Lets look at the flaw itself which is mainly explained via frustrating slideshow: if you make a copy of the private key from a SAML server you can forge access tokens. Like yeah, duh. That's how SAML works and this isn't unique to MS. The only way to get that key is via obtaining highly privileged access to the authentication service which would be very bad on any platform. Or finding the key laying around if an admin is very sloppy. Neither is directly a flaw of the technology.
This is what makes a SAML attack unique. Typically, hackers leave what cybersecurity specialists call a “noisy” digital trail. Network administrators monitoring the so-called “audit logs” might see unknown or foreign IP addresses attempting to gain access to their cloud services. But SAML attacks are much harder to detect. The forged token is the equivalent of a robber using a copied master key. There was little trail to track, just the activities of what appear to be legitimate users.
Thats, uh, not how the internet works. A forged token can elevate your access but it doesn't hide your IP. There are other ways to do that of course. (and WTH is with the scare quotes?)
Later it goes on to talking about how smartcard SSO was part of the problem but dont explain how that anything to do whatsoever with a compromised SAML key
Further the link to a CyberArk article that's hilariously bad
https://www.cyberark.com/resources/...technique-forges-authentication-to-cloud-apps
Golden ticket is not treated as a vulnerability because an attacker has to have domain admin access in order to perform it. That’s why it’s not being addressed by the appropriate vendors. The fact of the matter is, attackers are still able to gain this type of access (domain admin), and they are still using golden tickets to maintain stealthily persistent for even years in their target’s domain.
No shit. If your root admins get popped and you do a bad job of cleaning up everything they could have compromised, you are still vulnerable. This has been true since the first physical lock and key were invented.
Either the author of the article badly mangled the description of the flaw or they got played. Either way its a bad look for them