Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

csoonline.com

Post reply on HN
Print view View original

21–30 of 404 posts

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#21

Post by synapsomorphy »

Sharepoint is one of the worst, most bug-ridden softwares I've worked with.

It has a bug with Solidworks (3D design suite) that sporadically makes files completely un-openable unless you go in and change some metadata. They are aware of this, doesn't seem to be any limitation preventing them from fixing it, and it has sat unfixed for years.

Microsoft's cloud storage as a whole is an insane tangle where you never know where you'll find something you're looking for or whether it will work. Some things work only in browser, some only in the app, zero enumeration of these things anywhere.

Completely unsurprised and I'm sure there are many more vulnerabilities ripe for the picking.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#22

Post by boringg »

jayd16 wrote: post #12
reenorap wrote: post #5

There needs to be a law that all nuclear and nuclear-adjacent facilities have no connection to the Internet. The fact it's allowed is unbelievable.

You mean its a bad idea to slap a Starlink dish in the same building as the nuclear football?

Which breach was that again?

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#23

Post by dimitrios1 »

azalemeth wrote: post #9
reenorap wrote: post #5

There needs to be a law that all nuclear and nuclear-adjacent facilities have no connection to the Internet. The fact it's allowed is unbelievable.

While we're at it "and not use Microsoft products". Literally every time a story like this surfaces...

That's more of a form of survivorship bias. Microsoft continued to maintain its lockdown on government IT and infrastructure through the decades, over the alternatives.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#24

Post by rtldg »

ferguess_k wrote: post #14
reenorap wrote: post #5

There needs to be a law that all nuclear and nuclear-adjacent facilities have no connection to the Internet. The fact it's allowed is unbelievable.

I heard that once you put up a website on the public internet, it would immediately gets attacked by all kinds of scanners or other worse things. Not sure if it's true as I'm not a web guy.

All IPv4 addresses, domains (maybe more so for recently-registered ones), and subdomains from Certificate Transparency Logs (for HTTPS certs) are all constantly checked and poked.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#26

Post by hypeatei »

reenorap wrote: post #5

There needs to be a law that all nuclear and nuclear-adjacent facilities have no connection to the Internet. The fact it's allowed is unbelievable.

> needs to be a law that all nuclear and nuclear-adjacent facilities have no connection to the Internet

You want to make everything about a nuclear facility bespoke and subject to air-gapped drift? What about the guard booth that verifies peoples access, the receptionist who schedules meetings, and the janitor who wants to watch YouTube on his break? It seems unrealistic to lump everything that goes on at a nuclear facility under this umbrella.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#28

Post by tgv »

ta1243 wrote: post #18
SoftTalker wrote: post #16

Earlier quoted context omitted.

Every public IPv4 address is port scanned multiple times a day.

Which really isn't a problem, unless you're being scanned so much your bandwidth is being overwhelmed. Certainly not the case for me, despite having port 80 and 443 open

I have a server that has a slow (5s) response to unknown pages, returns it as 200, and makes the next failing request even slower (for unauthenticated users). That seems to keep the number of requests limited. Perhaps I should just drop the connection after a certain number of requests.

BTW, quite a few of these port scanners are companies that offer to scan your ports for vulnerabilities. Temu pen testing, so to speak.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#29

Post by bArray »

synapsomorphy wrote: post #21

Sharepoint is one of the worst, most bug-ridden softwares I've worked with. It has a bug with Solidworks (3D design suite) that sporadically makes files completely un-openable unless you go in and change some metadata. They are aware of this, doesn't seem to be any limitation preventing them from fixing it, and it has sat unfixed for years. Microsoft's cloud storage as a whole is an insane tangle where you never know…

Microsoft Word online deletes text in Firefox Linux (maybe others too) for at least two years now [1]. The one thing you want a text editor to do is be able to write text into a document, and somehow this bug goes unfixed. You would think it would be priority #1 for paying customers of Business Office 365 - and yet nothing.

It ended up being easier just to switch to paid Overleaf and teach our non-tech members how to write LaTeX and/or use the built-in editor. The documents are beautiful, Overleaf doesn't miss a beat and we are very happy with their solution.

Microsoft should be ashamed - I don't know how anybody would ever consider using them for any serious production work.

[1] https://learn.microsoft.com/en-us/answers/questions/5216132/...

Post reply on HN