Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lessons from last week’s cyberattack

blogs.microsoft.com

Post reply on HN
Print view View original

131–140 of 304 posts

Re: Lessons from last week’s cyberattack

#131

Post by gruez »

ouid wrote: post #125
threeseed wrote: post #86

Earlier quoted context omitted.

Allowing XP to exist forever is not a good thing for security either. There are security architectures in place within Windows 10 for example that do significantly improve security. At some point companies need to cough up the money and upgrade their technology.

Is there some philosophical principle under which you believe that companies must "cough up money" for services that they have already ostensibly paid for? That sounds remarkably like extortion. If Windows XP is proven to be untenably insecure, anyone who bought it should receive a refund.

Microsoft's support policy says they will only provide security updates for 10 years. Any company who wants more than that can pay them extra for the privilege. That's not extortion anymore than extended warranties are extortion.

Re: Lessons from last week’s cyberattack

#132

Post by askvictor »

SomeStupidPoint wrote: post #19
loteck wrote: post #11

The quote bombshell here, and what hasnt yet gotten much attention since sysadmins the world over are busy dealing with fallout, is that the NSA and therefore the US government is directly responsible for the current global cyber-carnage. We developed the capability, we chose to keep it unpatched, we tried to keep it secret, we lost control of it. This has similarities in type, if not in horror, to the development an…

MS issued a patch ahead of the usage of the lost exploit by a wide enough margin that I'm loathe to blame the government for the mere existence. The problem lies in our defensive infrastructure and our ability to roll out patches responding to incidents. It also lies in our security infrastructure: that cryptoworms are a danger speaks to a fundamental lapse in permission and process management systems.

MS also has to share some blame here for updates that break things, and updates that restart at random times (such as when you're doing some really urgent work). This has trained a whole lot of users to believe that windows updates are a risk to their use of the computer, and now just click away any update prompts.

Re: Lessons from last week’s cyberattack

#134

Post by natch »

Microsoft's version:

    I see three areas where this event provides an
    opportunity for Microsoft and the industry to improve.
Fixed version:

    I see three areas where this event provides an
    opportunity for Microsoft, the industry, and
    government to improve.
To be fair, he does go on to point out how this is partly the fault of poorly conceived government policies, namely the NSA's foolish practice of stockpiling exploits. But Microsoft and the industry should keep the heat on the government about this at every opportunity, because the horrifically bad and analogous idea of having government master keys is still being pushed forward.

Re: Lessons from last week’s cyberattack

#135

Post by zild3d »

codedokode wrote: post #38

One of the reasons why such attack was possible is poor security in Windows. Port 445 that was used in an attack is opened by a kernel driver (at least that is what netstat says on WinXP) that runs in ring 0. This driver is enabled by default even if the user doesn't need SMB server and it cannot be easily disabled. Most of services in Windows are run under two privileged user accounts (LocalService or NetworkService…

Why do you claim C++ relates to poor security? OSX and iOS are primarily C, C++, and assembly, (objective C at the higher levels). And linux of course is C and assembly.

Are you saying all of the major operating systems have poor security because they use "vulnerable" languages?

Re: Lessons from last week’s cyberattack

#136

Post by gruez »

DanBC wrote: post #12

No one in the UK seems to be tying this attack to the Conservative Party's desire for backdoors everywhere, which is a shame because it's a nice example for the public of how the government have got this very wrong.

the public doesn't care or doesn't want to care, which is the same reason there's no widespread opposition in the first place.

Re: Lessons from last week’s cyberattack

#137

Post by gech »

fencepost wrote: post #65
Shinkirou wrote: post #31

Earlier quoted context omitted.

No system is perfect. Remember Heartbleed? Microsoft released a patch to correct this particular issue in March, however the IT infrastructure in companies is slow, the whole process is convoluted, yada yada. The point is: the NSA caused this particular problem. Steps should be taken be everyone to ensure something like this doesn't happen ever again.

The NSA did not cause this particular problem. The NSA may have identified the vulnerability, however there is certainly an argument that their other responsibilities outweigh any responsibility that they might have to act as a free security investigation team and report a security vulnerability to an outside corporation. If Russian government intelligence agency security researchers found that bug first would you sa…

> however there is certainly an argument that their other responsibilities outweigh any responsibility that they might have to act as a free security investigation team and report a security vulnerability to an outside corporation.

Yeah, a shitty one. Free? No they're funded by tax payer dollars. I do think we need to argue about priority of responsibilities. Was this exploit used to spy on allies?

Re: Lessons from last week’s cyberattack

#138

Post by asdfgadsfgasfdg »

alex_anglin wrote: post #126
merlincorey wrote: post #123

Earlier quoted context omitted.

> If I booted a RedHat (5.2 came out in 2009ish) or FreeBSD machine from 2009 without patches, and put it on the internet, I'm pretty sure it'd be hosed just as bad (shellshock, heartbleed, ?). the difference is, everyone would tell me I'm an idiot for putting a machine online from 2009. As a tongue in cheek (but totally true) correction, FreeBSD from 2009 would NOT be vulnerable to the shellshock vulnerability unles…

True, but FreeBSD can't guarantee perpetual security for releases. It also doesn't provide warranties, like the majority of software out there. FWIW, I do hold FreeBSD in high regard. It's just that expecting perfection security-wise from complex systems is a fools errand.

> It's just that expecting perfection security-wise from complex systems is a fools errand.

I think that may have been the OP's point. Bash is more complex than sh has to be hence because FreeBSD choose the simpler option they avoid the inherent security implications of complex systems.

(I use bash myself and don't use FreeBSD.)

Re: Lessons from last week’s cyberattack

#139

Post by MichaelGG »

laumars wrote: post #21
MichaelGG wrote: post #6

Earlier quoted context omitted.

Citation please?

The NSA hoarding / leaking aspect of this vulnerability has been reported by most major news outlets. Even the mainstream ones. Albeit most haven't expanded on that point to the level that Microsoft did here.

Sorry I misread it as the NSA was developing the holes as in backdoors, intentionally creating the vulnerability.
Post reply on HN