Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

washingtonpost.com

Post reply on HN
Print view View original

131–140 of 456 posts

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#131

Post by jiggawatts »

ho_schi wrote: post #25
jmclnx wrote: post #7

Another day another vulnerability with Microsoft. I wonder if this will incentivize the countries to move faster with Linux. Probably not since there are so many of these breaches people just ignore them. I miss the old days when a breach involved someone breaking into the computer room and grabbing as many mag tapes as they can carry and run :)

I wonder what drives people using Microsoft and then using more from this company. We didn’t knew it better, back then. We knew it better, now. But migrating is work. So we prefer to suffer! And harm others! This Linux and BSD people are so annoying with their desire for compatibility. They shall suffer, too! And when we buy everything from a Monopoly, we don’t need to think. Somehow. Part of the game is that you’ve…

They're using Microsoft because all of the alternatives have the same issues.

FOSS isn't magically immune to vulnerabilities.

It doesn't help that the FOSS community generally prefers the C programming language over more modern and safer alternatives as a cultural thing. The result is just as many vulnerabilities, if not more, per line of code or per feature. Keep in mind that SharePoint is an enormous product with a 3.6 GB ISO image used to install it. If you think anyone is able to develop that volume of server code and have zero vulnerabilities... I have a bridge to sell you.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#132

Post by h2zizzle »

caconym_ wrote: post #76
azemetre wrote: post #53

Earlier quoted context omitted.

You're assuming their purpose was to find waste, it was not. Their purpose was to be the Chicago boys in DC.

Seems like generally it ended up being a surveillance play, in practice if not original intent. For example, Dog coin has been reported to be passing data taken from other agencies directly to ICE^[1] for law enforcement applications, and there was that other matter of logins apparently from Russia using accounts the Dog coin personnel demanded agencies create on their internal systems with (auditable) logging disabl…

I see your refusal to acquiesce to Musk's appropriation of an innocent meme, and raise you a, "Keep calling it 'doge', but pronounce it phonetically to piss him off."

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#133

Post by frollogaston »

ThinkBeat wrote: post #86

I have spent far too much of my life on SharePoint. Having it internet facing has never been a good idea. Not really what it is meant for, though the promo verbiage on that has changed over different versions. Some folks wanted SharePoint as their "web server", I would set that installation up entirely separted from all other instances they may have on the network.

I've only interacted with SharePoint briefly one time years ago, thought public web hosting was the entire purpose.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#134

Post by michaelt »

anonymars wrote: post #100
Arainach wrote: post #89

Earlier quoted context omitted.

Best practice is to assume the network is compromised - a VPN doesn't provide as much guarantee as people would like. In large fleets, devices are regularly lost, damaged, retired, etc. In organizations with high target value, physical penetration through any number of means should be assumed. So you don't do that. You use zero trust and don't care that things are exposed to the internet. Working from anywhere (remot…

Maybe I'm missing something but doesn't this very story cut your assertion off at the knees? With a VPN the attack surface of this vulnerability would have been miniscule compared to a publicly accessible zero-day RCE (And it's not like you have to allow carte-blanche access behind the wall) Defense in depth!

Arainach is advocating for something called "Zero Trust" which, from a user's perspective, is very much like a VPN.

It's software your employer pre-installs on your work PC, that asks you to log in with your work SSO credentials, performs some endpoint security checks, then routes your traffic over a virtual network adapter, and thereby allows you to access workplace resources, even when working from home.

The main difference is it adds some semi-authenticated states. Correct device, username, password, and 2FA, but failed a device posture check because they plugged their phone into their laptop to charge it? The 'Zero Trust' system can block some systems, while letting them retain access to others.

The other big difference is the pricing - rather than paying a five-figure sum upfront for networking hardware, you instead pay $25 per employee per month, forever.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#135

Post by 010101010101 »

miffy900 wrote: post #119
ThinkBeat wrote: post #86

I have spent far too much of my life on SharePoint. Having it internet facing has never been a good idea. Not really what it is meant for, though the promo verbiage on that has changed over different versions. Some folks wanted SharePoint as their "web server", I would set that installation up entirely separted from all other instances they may have on the network.

Actually it wasn't too long ago, in the early-2010's, that Microsoft was promoting SharePoint for internet sites; I think at one point some Europoean car manufacturer (BMW? Ferrari?) had their global marketing site on SharePoint. Of course that didn't last long, as Microsoft licensed it at a crazy price ($40k per site or something like that).

I worked on a couple of public facing SharePoint 2010 sites for large, well known companies before while it was in RC and immediately after - MS had a big marketing push to get people to build more than Intranet portals on it at the time. It seems like that died off entirely once Office 365 came around, and it was never a good idea in the first place, but it was definitely a thing.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#136

Post by rocqua »

threetonesun wrote: post #63
neuroelectron wrote: post #46

Earlier quoted context omitted.

My boss spent over a year trying to get me to setup Sharepoint. About 6 months into this, I finally looked into it and what it provided and said no. Eventually he hired a second tech and he set it up "in an afternoon." Good for him. Nobody ever used it. He also stole my high speed USB drive.

While Sharepoint might some day die, it will only be replaced by another piece of software that gets launched for nobody to ever use.

SharePoint is like exchange. It will likely never die, instead becoming a hidden layer that has been papered over 100 times.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#137

Post by hug »

anonymars wrote: post #130
zamadatix wrote: post #111

Earlier quoted context omitted.

In zero trust "exposed to the internet" is a bit of a misnomer compared to how traditional security would use the term. A better description might be "you're allowed to form a session to it from over the internet but only after your identity and set of rights have been verified". From this view: "zero trust" < "vpn" < "wide open" (in terms of exposure).

So it's essentially a more seamless and granular analog of a VPN? A device sits in front of the network and requires some sort of authenticated handshake (ideally all SSO) before passing packets through to a target endpoint?

Yes, that's zero trust in a nutshell: A VPN that does a tunnel per TCP connection instead of one tunnel for all TCP connections.

The other salient point is that all connections are established outbound through a broker, and importantly this is the case from both sides: The appliance at the terminating end of the tunnel establishes reverse tunnels to the broker for the connections, so it's never "exposed to the internet".

The broker can then push to your SIEM or whatever so you can have your SOC log jockeys harass your employees for accidentally leaving NordVPN on after watching international sports.

There are actual benefits: You can do things like allow logins to system A from anywhere, but system B only from your home country, you can do JIT network access requests, etc... but mostly it's vendor marketing to get you to spend too much money.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#138

Post by baby_souffle »

anonymars wrote: post #130
zamadatix wrote: post #111

Earlier quoted context omitted.

In zero trust "exposed to the internet" is a bit of a misnomer compared to how traditional security would use the term. A better description might be "you're allowed to form a session to it from over the internet but only after your identity and set of rights have been verified". From this view: "zero trust" < "vpn" < "wide open" (in terms of exposure).

So it's essentially a more seamless and granular analog of a VPN? A device sits in front of the network and requires some sort of authenticated handshake (ideally all SSO) before passing packets through to a target endpoint?

At a high level, yeah.

They can be implemented using a variety of technical patterns but they all share a common "each request is authenticated, encrypted" property instead of "anything goes once the tunnel is up" property.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#139

Post by vpShane »

jmclnx wrote: post #7

Another day another vulnerability with Microsoft. I wonder if this will incentivize the countries to move faster with Linux. Probably not since there are so many of these breaches people just ignore them. I miss the old days when a breach involved someone breaking into the computer room and grabbing as many mag tapes as they can carry and run :)

> I wonder if this will incentivize the countries to move faster with Linux.

I hope so. We're seeing it now though. Germany, Norway.

Not saying there won't be CVEs when they move, but at least there's freedom and openness already available to switch to.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#140

Post by _carbyau_ »

exabrial wrote: post #122
zanecodes wrote: post #72

Earlier quoted context omitted.

CrowdStrike is not made or owned by Microsoft.

So yes or no were a bunch of Microsoft products hacked?

Definitively no. It was not a hack at all.

It was misconfigured software running inside the kernel.

The issue was this misconfiguration was "urgently pushed" from Crowdstrike and depending on who you believe it overrode customer testing policies.

Post reply on HN