Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

csoonline.com

Post reply on HN
Print view View original

101–110 of 404 posts

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#101

Post by elevation »

stackskipton wrote: post #75

As usual with all these types of posts, people go "HA HA, MICRO$OFT SUCKS" without understanding business practices that keep them afloat. Don't use Exchange? Cool, what should we use instead? Does it support 15 people all the way up to 150000 people? I used to run Exchange cluster for 70k people, is there other mail software out there complete with non-shared disk redundancy? Where the users connect to single endpoi…

How many organizations on the planet require their Exchange server to support 150k users? I doubt most manufacturing plants fall into this category.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#102

Post by crmd »

elygre wrote: post #76
aidos wrote: post #43

Earlier quoted context omitted.

We sync content to MS hosted Sharepoint using rsync. When the file arrives, they change the internal metadata inside the file, which changes the checksum, which causes rsync to think the content is different and needs syncing again. Edit to say: this is for MS files like Excel docs

Is that a supported method?

Supported by who? Microsoft?

If a file server breaks basic Unix tools it should be unplugged and put in the garbage.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#103

Post by dudeinjapan »

stackskipton wrote: post #75

As usual with all these types of posts, people go "HA HA, MICRO$OFT SUCKS" without understanding business practices that keep them afloat. Don't use Exchange? Cool, what should we use instead? Does it support 15 people all the way up to 150000 people? I used to run Exchange cluster for 70k people, is there other mail software out there complete with non-shared disk redundancy? Where the users connect to single endpoi…

Sharepoint is enterprisey and all but how about "less software/surface area is more" when it comes to nuclear silos?

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#104

Post by stackskipton »

elevation wrote: post #101
stackskipton wrote: post #75

As usual with all these types of posts, people go "HA HA, MICRO$OFT SUCKS" without understanding business practices that keep them afloat. Don't use Exchange? Cool, what should we use instead? Does it support 15 people all the way up to 150000 people? I used to run Exchange cluster for 70k people, is there other mail software out there complete with non-shared disk redundancy? Where the users connect to single endpoi…

How many organizations on the planet require their Exchange server to support 150k users? I doubt most manufacturing plants fall into this category.

They don't but whole point is massive Enterprises use the software, people get accustomed to it and want it in their smaller business. So, Microsoft Small Business Server is developed until O365 came along.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#105

Post by elevation »

necovek wrote: post #95
stackskipton wrote: post #75

As usual with all these types of posts, people go "HA HA, MICRO$OFT SUCKS" without understanding business practices that keep them afloat. Don't use Exchange? Cool, what should we use instead? Does it support 15 people all the way up to 150000 people? I used to run Exchange cluster for 70k people, is there other mail software out there complete with non-shared disk redundancy? Where the users connect to single endpoi…

I see you build a case for traditional MS product in Exchange, yet this issue is about Sharepoint. Just like with Windows, Microsoft has built a moat with Exchange, but the question is why do all the companies buy into their full ecosystem, especially for anything relating to web technologies (you even bring up Exchange Web Services), because this they do really badly, and Sharepoint seems to be the worst. However, I…

Not sure the total number, but a university near me serves 50K active students and hundreds of thousands of alums with Postfix/Dovecot.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#106

Post by alexpotato »

So I once brought down an alerting system using Excel

(btw, this story is more about unintended consequences instead of MSFT)

- I own an alerting system

- For log based alerts, it looks for a keyword e.g. "alert_log"

- I make a spreadsheet to track data about alerts and call one of the sheets "alert_log"

- Alert system starts going crazy: using tons of CPU, number of alerts processed goes through the roof but not a lot of alerts generated

- Turns out that I was using the cloud version of Excel so any text entered transited the firewall

- Firewall logs store the text "alert_log"

- Alert system thinks it's an alert BUT it's not a real alert so triggers an alert processing alert

- That second alert contains the text from the firewall log and so cycle begins

In other words, systems can operate in weird ways and then cause things to happen you didn't anticipate. It's why things like audits, red teaming and defense in depth all matter.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#107

Post by Veserv »

fintler wrote: post #69
Veserv wrote: post #54

Earlier quoted context omitted.

Ah yes, " likely air-gapped", what a high-confidence statement. Any competently designed air-gap must be precisely auditable and demonstrably, positively air-gapped. The only world where "likely" is a reasonable word is in reference to possible physical taps or a precise enumeration of physical access points that went unaudited, but have reliably followed safe access control/configuration procedures. Anything else is…

They have multiple networks. One of them is definitely airgapped (red for RD). The medium security one is protected by annoyingly strict network ACLs (yellow for ITAR). Then there's a low security one for stuff like sharepoint (green). This article is full of nonsense and speculation.

The standard you linked literally talks about: "High Impact BES Cyber Systems with External Routable Connectivity" and "Remote Access Management" for "High Impact BES Cyber Systems". That explicitly indicates non-airgapped critical systems. Furthermore, the proscribed auditing specifically spells out "network diagrams or architecture documents" as good evidence. Obviously, that is a high level document, but I see nothing to indicate robustness against state-level actors which are a expected threat.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#109

Post by apstls »

0_____0 wrote: post #27
reenorap wrote: post #5

There needs to be a law that all nuclear and nuclear-adjacent facilities have no connection to the Internet. The fact it's allowed is unbelievable.

Being airgapped didn't help Iran avoid Stuxnet.

There is likely a small number of people who could collectively list out the events it _did_ help Iran avoid.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#110

Post by unethical_ban »

alexpotato wrote: post #106

So I once brought down an alerting system using Excel (btw, this story is more about unintended consequences instead of MSFT) - I own an alerting system - For log based alerts, it looks for a keyword e.g. "alert_log" - I make a spreadsheet to track data about alerts and call one of the sheets "alert_log" - Alert system starts going crazy: using tons of CPU, number of alerts processed goes through the roof but not a l…

As a firewall engineer I have to tell people to make sure to disable traffic logs for syslogs from the firewall for this reason.
Post reply on HN