Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

washingtonpost.com

Post reply on HN
Print view View original

121–130 of 456 posts

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#121

Post by bilekas »

alephnerd wrote: post #75
zanecodes wrote: post #72

Earlier quoted context omitted.

CrowdStrike is not made or owned by Microsoft.

Giving OP the benefit of the doubt, there were issues with how the Windows kernel had little guardrails and restrictions. That said, that was the EU's fault, as the EU in 2009 forced Microsoft to fully expose their OS internals to outside vendors during an anti-trust settlement, and with little ability to enforce vendor standards: ""Microsoft shall make available to interested undertakings Interoperability Informatio…

> Giving OP the benefit of the doubt, there were issues with how the Windows kernel had little guardrails and restrictions.

This also wasn't Microsofts fault. It was bad kernel code, and don't say you would like microsoft to audit everyone else's code before it can be deployed somewhere.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#123

Post by p_ing »

charles_f wrote: post #80

> CISA advises vulnerable organizations [...] to disconnect affected products from the public-facing Internet until an official patch is available. It's interesting to me that you'd go the hassle of hosting your own SharePoint on prem, but leave it internet facing. I would have assumed a the Venn diagram of these organizations to be entirely contained in orgs forcing you to use a VPN.

Hosting internal services be they SharePoint or Exchange behind a [pre-auth] reverse proxy isn't that unusual.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#124

Post by p_ing »

shrubble wrote: post #19

Wasn’t Microsoft just recently using Chinese people living in China to administer DOD servers? I would guess they use Sharepoint inside the DOD?

There is a DoD version of M365 which has SPO, but that isn't what the article is discussing.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#125

Post by blibble »

anonymars wrote: post #109
mschuster91 wrote: post #98

Earlier quoted context omitted.

> Private Teams messages are stored in individual Exchange mailboxes. Good lord. It truly is a layer of dung layered upon more layers of dung.

I don't think this is nearly as crazy as you may think at first glance Imagine if it was just a hidden (special) folder in an Exchange mailbox. Voila, you already have a well-known and widely implemented and tested message syncing solution both for content and status (read/unread) I assume Windows Phone worked the same way with its text message backup. When you'd set up a new phone it would take a while for your Micr…

explains why scrolling up in teams loads 3 messages at a time too

very slowly

and why the search doesn't work

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#126

Post by bilekas »

mschuster91 wrote: post #98
kuhsaft wrote: post #84

Earlier quoted context omitted.

It’s impossible to stop using M365 while stopping usage of SharePoint (cloud or on-premises). See https://news.ycombinator.com/item?id=44640219 Here’s just one example: Each M365 Teams Team creates an M365 Group which creates a SharePoint site and Exchange mailbox. Teams channel files are stored in that SharePoint site. Teams channel messages are stored in the Exchange mailbox. Private files dropped in Teams are stor…

> Private Teams messages are stored in individual Exchange mailboxes. Good lord. It truly is a layer of dung layered upon more layers of dung.

I know it's popular to dump on Microsoft and there are some valid reasons, this is not one of them.

There are so many companies and businesses that rely on offline data, or silo'd data than will be tied through their AD LDAP account permission, M365, teams included, is such a better option than hand rolling all of them and praying you configured every service correctly.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#127

Post by p_ing »

tialaramex wrote: post #35
timewizard wrote: post #22

Why didn't they just rewrite it in Rust?

IIRC Microsoft is rewriting some of these backend services in Rust, although not because it will increase security but because it lets them get better perf than existing solutions without the safety tradeoff they'd have suffered to go to C++ which would have been their option 15-20 years ago. I don't know whether Sharepoint was on that list.

SharePoint is primarily written in C# [.NET Framework 4.8] and leverages ASP.NET; there would be no reason to rewrite the majority in another language. There is some C++ in SharePoint Search (and a few other components here and there).

IIS which SharePoint runs atop of is written in presumably primarily C.

You can decompile most of SharePoint if you ever need to peek at the code. That's a huge advantage to figure out how it works.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#128

Post by LinXitoW »

alephnerd wrote: post #75
zanecodes wrote: post #72

Earlier quoted context omitted.

CrowdStrike is not made or owned by Microsoft.

Giving OP the benefit of the doubt, there were issues with how the Windows kernel had little guardrails and restrictions. That said, that was the EU's fault, as the EU in 2009 forced Microsoft to fully expose their OS internals to outside vendors during an anti-trust settlement, and with little ability to enforce vendor standards: ""Microsoft shall make available to interested undertakings Interoperability Informatio…

The obvious answer would've been to create a secure public API and have defender use that. But like always, corporations throw a hissy fit and implement the worst possible version of the ruling. Then people hate the EU instead of the corporation for no good reason.

It's the exact same thing as with Google Maps in Google Search. The EU did NOT say "Remove Google Maps" it said "Give competitors equal opportunity". The most user-hostile choice was removing the Google Maps integration entirely (because "no access" is still "equal access"), instead of offering users the choice.

Personally, the digital policies are one of the few things the EU generally gets right, and (as unrealistic as it is) I hope all the Googles and Apples go choke on it and di...solve.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#130

Post by anonymars »

zamadatix wrote: post #111
anonymars wrote: post #100

Earlier quoted context omitted.

Maybe I'm missing something but doesn't this very story cut your assertion off at the knees? With a VPN the attack surface of this vulnerability would have been miniscule compared to a publicly accessible zero-day RCE (And it's not like you have to allow carte-blanche access behind the wall) Defense in depth!

In zero trust "exposed to the internet" is a bit of a misnomer compared to how traditional security would use the term. A better description might be "you're allowed to form a session to it from over the internet but only after your identity and set of rights have been verified". From this view: "zero trust" < "vpn" < "wide open" (in terms of exposure).

So it's essentially a more seamless and granular analog of a VPN? A device sits in front of the network and requires some sort of authenticated handshake (ideally all SSO) before passing packets through to a target endpoint?
Post reply on HN