Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft is a national security threat: ex-White House cyber policy director

theregister.com

Post reply on HN
Print view View original

91–100 of 224 posts

Re: Microsoft is a national security threat: ex-White House cyber policy director

#91

Post by nurple »

dh2022 wrote: post #64
cess11 wrote: post #45

Earlier quoted context omitted.

States don't care.

Believe it or not, USA government cares at least a little. USA did not institute the draft even when fighting on two fronts (Afghanistan and Iraq). USA made up for the lack in manpower with technology: Reaper drones, cluster munitions, night vision, precise artillery, overwhelming air power.

Don't you find it a bit frightening that this tech is daily giving a smaller and smaller subset of people in the world the unilateral ability to project their will onto the world? At least if they tried to draft in an unjust war, the people could withhold their physical support. This was pretty effective during the Vietnam area, but it's a bargaining chip we've lost.

As we saw with 702, we really have very little leverage left in what our gov does anymore, the threat of being voted out even carries little power, exactly because they're systematically removing humans from every loop they can for the purpose of working unilaterally even when--perhaps especially when--it's against the will of the people. The spooks themselves have literally said exactly as much in their fight against privacy.

To me, the latest 702 is more terrifying than any adversary. When we, who the government should be beholden to, cannot even know the text of the laws which apply to us, it really puts a fine point on how the those who run our government view themselves in relation to its citizenry.

"The liberties of people never were, nor ever will be, secure, when the transactions of their rulers may be concealed from them." -Patrick Henry

Re: Microsoft is a national security threat: ex-White House cyber policy director

#92

Post by acdha »

nobodyandproud wrote: post #77
qaq wrote: post #66

Earlier quoted context omitted.

Well you can't not outsource your security because gov payscale limits do not match market reality. You have to realise that a ton of people who should be directly employed by NSA etc. are actually working for their contracts for this reason.

Partly this is due to the concentration of wealth, inaccessible to taxing. Naturally government pay would lag behind even the more mediocre H1Bs.

> Partly this is due to the concentration of wealth, inaccessible to taxing.

This has nothing to do with it. Contractors cost notably more, so if the goal was economizing it’d be an obvious step to cut out the middlemen by hiring staff directly.

The problem is that there’s an entire political ideology holding that government is inherently wasteful and its adherents will oppose any attempt to track market salaries because that allows them both to say they’re saving money at the time and later to cite the struggling/failed project as proof that they were right.

Re: Microsoft is a national security threat: ex-White House cyber policy director

#93

Post by btbuildem »

While this brings to mind that scene [1] from Steve Carrel's "Space Force" show, you can't blame the scorpion for stinging you if you give him a ride on your back.

The dependency on (pretty much) a single vendor across the entire military organization is such a monumental single point of failure, I can't imagine what level of obtuse bureaucracy led them there. It seems self-inflicted at best; if it wasn't MS it would've been some other corp.

IMO the military (especially given their incredible size and access to resources) should have 100% rolled their own IT solutions from first principles, and built upon that.

1: https://www.youtube.com/watch?v=2zpCOYkdvTQ

Re: Microsoft is a national security threat: ex-White House cyber policy director

#94

Post by derf_ »

_mlbt wrote: post #5
cranberryturkey wrote: post #2

all tax payer funded software should be open source

I see this sentiment all the time, but it could never apply to the defense sector. Do you really want our nations enemies to have access to the source code of fighter jets, cruise missiles, the nuclear weapons program, or missile defense systems?

From my time working in defense contracting, quite a lot of the software was open source, built on open source components (just like everything else) or even hosted on official military GitHub repos. Code written by the (federal) government itself cannot even be copyrighted (in the US). Obviously you are not going to find the classified stuff on GitHub, but even there it was very common for the government to take all of the source code from one contractor and hand it to another one to work on. You also design your systems so that as much as possible can be unclassified, because unclassified development is much, much easier.

Re: Microsoft is a national security threat: ex-White House cyber policy director

#95

Post by acdha »

prepend wrote: post #43
skhunted wrote: post #34

Earlier quoted context omitted.

What does one have to do with the other? It’s possible to have more than one threat.

Security is frequently only as strong as the weakest link. If you’re an adversary, would you spend more time on an org’a poor security practices (pentagon failing audits) or a more difficult software vendor?

The audits in question are financial. There’s no doubt some overlap with security – e.g. failing to replace out of date software due to financial constraints exposes them to risk – but it’s not a simple relationship.

Re: Microsoft is a national security threat: ex-White House cyber policy director

#96

Post by krooj »

quantified wrote: post #75
helpfulclippy wrote: post #62

CSRB's report on the Exchange Online breach that dropped a couple weeks ago was pretty damning. Microsoft had a situation where a threat actor had access to the entirety of Exchange Online, and possibly their entire cloud. CSRB describes the entire incident as completely avoidable, and resulting from Microsoft's inadequate security culture, and it calls Microsoft out for making public statements about the breach and…

> Microsoft didn't even bother with key rotations anymore after 2021 because one time they fucked it up and it caused an outage, so they decided to just not do that anymore. Key rotation is almost like restoring from backups. It's an absolutely necessary capability and practice.

You'd be surprised at how little cloud vendors give a shit about security internally. Story time: I recently went ahead and implemented key rotation for one of our authz services, since it had none, and was reprimanded for "not implementing it like Google". Fun fact: Google's jwks.json endpoint claims to be "certs" from the path (https://www.googleapis.com/oauth2/v3/certs). They are not certs - there is no X.509 wrapper, no stated expiration, no trust hierarchy. Clients are effectively blind when performing token validation with this endpoint, and it's really shitty.

Other nonsense I've seen: leaking internally signed tokens for external use (front-channel), JWTs being validated without a kid claim in the header - so there's some sketchy coupling going on, skipping audience validation, etc...

Not much surprises me anymore when it comes to this kinda stuff - internally, I suspect most cloud providers operate like "feature factories" and security is treated as a CYA/least-concern thing. Try pushing for proper authz infrastructure inside your company and see what kinda support you'll get.

Re: Microsoft is a national security threat: ex-White House cyber policy director

#97

Post by InSteady »

kbenson wrote: post #68
tiffanyh wrote: post #55

Earlier quoted context omitted.

> The US government is 10% of Microsoft's annual revenue just on security services How are you able to conclude that?

I assume it's the $20 billion in security services statement compared against their ~$200 billion yearly revenue. I'm not sure those security services are all for the U.S. govt though.

My assumption is that the revenue figure is not exclusively the US government spending. Otherwise what percentage of their yearly revenue is security services to all the other countries as well as businesses in the world? The US government is of course a large customer, but a considerable part of the world runs on windows and other Microsoft products.

Re: Microsoft is a national security threat: ex-White House cyber policy director

#98

Post by wumeow »

Avamander wrote: post #65
wumeow wrote: post #59

Earlier quoted context omitted.

I don’t understand your comment. Microsofts failures are a threat precisely because it is so used, especially by the US govt. And they may spend a lot on security, but their recent failures have been pretty amateurish. A recent breach they had was due to an old, non-2fa service account with a weak password and privileged access. See also the CISA report about last years breach.

And if it were ten open-source projects then they'd have to defend themselves against nation-state attackers. They're not ready for it. The researchers that demonstrated an attack on Linux got vilified instead of the maintainers that had misplaced their trust. *Researchers* not a truly sophisticated and a well-funded threat actor. Do you see the issue? Do you really think the alternatives are more diligent with their…

> And if it were ten open-source projects […]

The alternative wouldn’t be to use a smattering of open-source stuff, it would be to go with a different cloud provider like AWS or Google.

> Do you really think the alternatives are more diligent […]

That’s what the CISA report suggested.

I’m not shitting on MS, I just don’t want foreign adversaries to be able to pick apart our IT systems like vultures.

Re: Microsoft is a national security threat: ex-White House cyber policy director

#99

Post by faeriechangling »

Even if you pretended Microsoft didn't exist, I don't really see how any similar alternative actually presents a secure alternative. There's a mess of vulnerabilities and complexity at every layer of any modern computing stack you can think of.

If you ACTUALLY want security, you're going to be dealing with computers which are 100x slower than what we're used to with a tiny fraction of the features. For the most part I'm not convinced people actually want secure computer systems, they want computer systems which are productive and they'll just cope with the regular security breaches.

Re: Microsoft is a national security threat: ex-White House cyber policy director

#100

Post by ProjectArcturis »

acdha wrote: post #92
nobodyandproud wrote: post #77

Earlier quoted context omitted.

Partly this is due to the concentration of wealth, inaccessible to taxing. Naturally government pay would lag behind even the more mediocre H1Bs.

> Partly this is due to the concentration of wealth, inaccessible to taxing. This has nothing to do with it. Contractors cost notably more, so if the goal was economizing it’d be an obvious step to cut out the middlemen by hiring staff directly. The problem is that there’s an entire political ideology holding that government is inherently wasteful and its adherents will oppose any attempt to track market salaries bec…

Yup. When a VC-backed company goes bankrupt, no one bats an eye. When Solyndra's loans go bad, even though it was a tiny fraction of the government's green energy portfolio, you get headlines and congressional hearings.
Post reply on HN