Live data from Hacker News

Microsoft is a national security threat: ex-White House cyber policy director

theregister.com

151–160 of 224 posts

Re: Microsoft is a national security threat: ex-White House cyber policy director

#151

CSRB's report on the Exchange Online breach that dropped a couple weeks ago was pretty damning. Microsoft had a situation where a threat actor had access to the entirety of Exchange Online, and possibly their entire cloud. CSRB describes the entire incident as completely avoidable, and resulting from Microsoft's inadequate security culture, and it calls Microsoft out for making public statements about the breach and…

Why does government use cloud for general public? Why don't they use government cloud with high security?

Do you really believe that the "government cloud" isn't just a duplicate of the public cloud?

What incentive do cloud providers have to add extra security to the government stuff, while not also adding that extra security to the public stuff?

"Oh, yeah, we have more security over in the thing you can't use, but you can trust us with your data anyway."

Re: Microsoft is a national security threat: ex-White House cyber policy director

#152
post #143

Earlier quoted context omitted.

The problem is that not all the secrets are so easily extracted - sometimes the design/software is the secret. If you put all the design up for nuclear weapons but just kept the nuclear codes secret it's great that no one can fire ours, but people could implement the design on their own with different codes. To use a more realistic example, consider air defence missile systems use to shoot down incoming missiles and…

> sometimes the design/software is the secret Decreasingly the case, and we might be at the point I can say "poorly architected" if that's the case. A random 19 year old developer in the military with access to the secrets would be a big security hole too. That's what we should be comparing with regards to open-source vs not open-source - in either case access to weaponry would of course be heavily gated. Some of the…

You can say "poorly architected" all you want, but it's true. Military capability is frequently determined by software-implemented behaviours, not data you can plug into a generic public framework.

>19 year old developer with access would be a big security hole

It's true, they are. That's why militaries and defence companies go to great lengths to vet their staff and why even within vetted staff, sensitive material is compartmentalised to minimise the risk from any given individual. Even despite that, military secrets are still leaked on an all too regular basis.

Re: Microsoft is a national security threat: ex-White House cyber policy director

#153
post #122

It’s amazing how much leverage MSFT is extracting from Excel. It’s the tiny brick supporting their entire skyscraper.

No, Active Directory, Exchange, Word, and probably half a dozen other products also play an important role, and the integrations between them.

I’ll give you AD, but overall far fewer companies would bother with any of it if 90% of corporate thinking didn’t happen in Excel

Re: Microsoft is a national security threat: ex-White House cyber policy director

#154
post #96

Earlier quoted context omitted.

You'd be surprised at how little cloud vendors give a shit about security internally. Story time: I recently went ahead and implemented key rotation for one of our authz services, since it had none, and was reprimanded for "not implementing it like Google". Fun fact: Google's jwks.json endpoint claims to be "certs" from the path ( https://www.googleapis.com/oauth2/v3/certs ). They are not certs - there is no X.509 wr…

Are there any large companies that don't operate like feature factories? It seems to be such a common issue and the natural result of the incentive structure.

although this is a valid insight, it reduces the detail of the conversation into "yes or no" on a topic that is not a "yes or no" topic.. it is behavior and messaging among a dozen critical functions of business. Almost every business is different in their mix.. perhaps faced with similar rhetoric, law says "show me an example then we can discuss" instead of "classify all examples then apply to a situation"

Re: Microsoft is a national security threat: ex-White House cyber policy director

#155
post #126

Earlier quoted context omitted.

Partly this is due to the concentration of wealth, inaccessible to taxing. Naturally government pay would lag behind even the more mediocre H1Bs.

The US government spent $6.1 TRILLION dollars in 2023. I don't think raising taxes is the solution to the government offering a more competitive wage.

That number is meaningless without also considering US GDP (even if you write trillion in caps). The US averages about 14% government spending as a fraction of GDP, placing it at ~90/140. For the size of the US economy, spending should be significantly higher.

Re: Microsoft is a national security threat: ex-White House cyber policy director

#156
post #143

Earlier quoted context omitted.

> sometimes the design/software is the secret Decreasingly the case, and we might be at the point I can say "poorly architected" if that's the case. A random 19 year old developer in the military with access to the secrets would be a big security hole too. That's what we should be comparing with regards to open-source vs not open-source - in either case access to weaponry would of course be heavily gated. Some of the…

You can say "poorly architected" all you want, but it's true. Military capability is frequently determined by software-implemented behaviours, not data you can plug into a generic public framework. >19 year old developer with access would be a big security hole It's true, they are. That's why militaries and defence companies go to great lengths to vet their staff and why even within vetted staff, sensitive material i…

> That's why militaries and defence companies go to great lengths to vet their staff

What a joke, no they don't. They establish security internally by gating access, not trusting everyone because they've been "pre-vetted".

Re: Microsoft is a national security threat: ex-White House cyber policy director

#157

CSRB's report on the Exchange Online breach that dropped a couple weeks ago was pretty damning. Microsoft had a situation where a threat actor had access to the entirety of Exchange Online, and possibly their entire cloud. CSRB describes the entire incident as completely avoidable, and resulting from Microsoft's inadequate security culture, and it calls Microsoft out for making public statements about the breach and…

> Microsoft didn't even bother with key rotations anymore after 2021 because one time they fucked it up and it caused an outage, so they decided to just not do that anymore. Key rotation is almost like restoring from backups. It's an absolutely necessary capability and practice.

Not necessarily. Scheduled key rotation has a lot of conceptual problems:

1. As MS found, revoking old keys is very risky because doing so creates outages. But if you don't do it then changing keys is useless. This isn't a problem specific to Microsoft. Lots of companies have learned this lesson the hard way.

2. It assumes that attackers don't just use stolen keys immediately (e.g. to issue more keys, change passwords, create new accounts etc). In practice they usually do.

3. It assumes that if you change the keys the attackers can't just immediately re-steal the new keys.

So it's only really a useful practice in one very specific scenario: you do something that boots undetected attackers out of your network without realising that's what it did, and the attackers need ongoing access that only that key can provide, and they can't use that key to elevate permissions in a more permanent way like by creating a new account on the system or stealing a user password. Pretty specific scenario.

Unfortunately, key rotation also comes with big downsides. Any software that works with keys has to be built to tolerate a change silently, because now it's a regular occurrence instead of a rare one (where maybe a bit of disruption can be absorbed). That creates complexity and therefore bugs. And because it's a repetitive piece of fiddly and complex work that can break your entire service if you get it wrong it inevitably gets automated, and that in turn means that you end up with a large collection of highly privileged subsystems that have the power to silently change keys in ways admins won't notice because they are expecting it: exactly the sort of thing attackers will immediately focus on.

Overall it's not an obviously winning move. Opportunity cost matters too. Whilst you're setting up all the infrastructure to do this, ironing out the bugs, cleaning up after the outages etc, your competitors might be investing in other kinds of security best practices that are more effective. It's especially useless here because MS don't know how the key was stolen to begin with, so there's no reason to think that if they changed it that would have had any effect. Most likely it could have just been immediately restolen and all the effort would have been theatre.

Re: Microsoft is a national security threat: ex-White House cyber policy director

#158
post #40

Earlier quoted context omitted.

You’re implicitly assuming they’d be better off with more control; I’m not sure that’s true.

It would definitely be possible for government to be good at things ... in the olden days of tech development, very good people were employed and empowered at government positions with technology roles. I'm thinking back to later 90s when I filled out my financial student aid application. That was an _extremly_ complicated web product for the time, built entirely by the government, and it completely worked and was ea…

Agreed. The US government is actually the most technologically accomplished organization in human history. Examples: Everything NASA has done and does, nuclear weapons, nuclear-powered aircraft carriers, the Internet, the NSA's capabilities, etc.

Re: Microsoft is a national security threat: ex-White House cyber policy director

#159
post #127

Earlier quoted context omitted.

> This has nothing to do with it. Contractors cost notably more, so if the goal was economizing it’d be an obvious step to cut out the middlemen by hiring staff directly. It certainly has something to do with it. The market rates for engineers was distorted because FAANG had a lot of money to throw around, so therefore hiring staff at government pay rates is quite difficult and is subject to the General Schedule ( ht…

Yes, the GS scale is a problem. My point was that it’s not a problem because we’re trying to save money – if that were the case, someone would notice that raising the cap to allow a $300k civil service job is cheaper than allowing the same job to be performed by a $500k contractor who takes home less and is replaced more frequently. Politics enters the picture because the pay cap is derived from the salaries for poli…

Yes, but “saving money” is your point and strawman; I never said anything about saving money, nor did I imply it.

GS in general cannot grow when the market pay was distorted by both lack of tax funds; and when those driving market pay has a disproportionate amount of wealth to corner the labor market, in order to prevent the hiring of engineers by other industries.

Re: Microsoft is a national security threat: ex-White House cyber policy director

#160

I call bullshit. Someone, somewhere long ago deep inside of the bowels of the NSA decided to deprioritize actual security, and the use of the capability security model. They knowingly did this, because actually secure computing (which they already had at the time[1,2,3]) represented a threat to the NSA , or so they thought at the time. The trade-offs seemed acceptable, because there were systemic approaches at the ti…

You should probably try building a pure capability based operating system and making it usable, before blithely saying the entire industry got security wrong. Capabilities aren't magic. UNIX has had many forms of capability for a long time, NeXT/macOS/iOS uses them extensively as well, and there are still vulnerabilities regardless.

Also, capabilities are irrelevant to the types of hack being discussed on this thread where the vectors are forgotten admin accounts, non-patched software, etc.

Post reply on HN