Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

washingtonpost.com

Post reply on HN
Print view View original

141–150 of 456 posts

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#141

Post by pphysch »

dizlexic wrote: post #69
ho_schi wrote: post #25

Earlier quoted context omitted.

I wonder what drives people using Microsoft and then using more from this company. We didn’t knew it better, back then. We knew it better, now. But migrating is work. So we prefer to suffer! And harm others! This Linux and BSD people are so annoying with their desire for compatibility. They shall suffer, too! And when we buy everything from a Monopoly, we don’t need to think. Somehow. Part of the game is that you’ve…

From what I've seen in my industry? To pass all the liability to Microsoft. "If something happens, we used enterprise grade industry standard software. We did our due diligence." This outlook is basically why we can't innovate anymore. I had to recently sit through a meeting where our CTO quoted all the "blogs" he's been reading as a way to slap down my suggestion for an in-house project. It's all about CYA.

Surely there's an untapped market for infosec liability insurance.

Pay the CYA bill, let the engineers build/choose something that actually works. Win-win.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#142

Post by this_steve_j »

Arainach wrote: post #89
charles_f wrote: post #80

> CISA advises vulnerable organizations [...] to disconnect affected products from the public-facing Internet until an official patch is available. It's interesting to me that you'd go the hassle of hosting your own SharePoint on prem, but leave it internet facing. I would have assumed a the Venn diagram of these organizations to be entirely contained in orgs forcing you to use a VPN.

Best practice is to assume the network is compromised - a VPN doesn't provide as much guarantee as people would like. In large fleets, devices are regularly lost, damaged, retired, etc. In organizations with high target value, physical penetration through any number of means should be assumed. So you don't do that. You use zero trust and don't care that things are exposed to the internet. Working from anywhere (remot…

Microsoft’s version of “Zero Trust” doesn’t care if things are reachable from the public internet. They have been preaching “identity is the new perimeter” [1] for years, and it doesn’t wash.

The NIST Zero Trust Architecture (ZTA) implementation guides (SP 1800-35) [2] cut through the nonsense and AI generated marketing smoke.

In ZTA, ALL network locations are untrusted. Network connections are created by a Policy Engine that creates and tears down tunnels to each resource dynamically using attribute-based-access-controls (ABAC). Per request.

Microsoft doesn’t have any products that can do full ZTA, so several pillars are missing from their “Zero Trust” marketing materials.

[1] https://www.microsoft.com/insidetrack/blog/securing-the-bord...

[2] https://doi.org/10.6028/NIST.SP.1800-35

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#143

Post by firesteelrain »

pyuser583 wrote: post #95

I've heard many Pentagon employees claim that if someone wanted to take out the US military, all they'd have to do is kill Sharepoint. It's the go-to warm-up joke whenever someone in the military gives a speech.

We had a lot of SharePoint back in the day

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#144

Post by xxpor »

michaelt wrote: post #134
anonymars wrote: post #100

Earlier quoted context omitted.

Maybe I'm missing something but doesn't this very story cut your assertion off at the knees? With a VPN the attack surface of this vulnerability would have been miniscule compared to a publicly accessible zero-day RCE (And it's not like you have to allow carte-blanche access behind the wall) Defense in depth!

Arainach is advocating for something called "Zero Trust" which, from a user's perspective, is very much like a VPN. It's software your employer pre-installs on your work PC, that asks you to log in with your work SSO credentials, performs some endpoint security checks, then routes your traffic over a virtual network adapter, and thereby allows you to access workplace resources, even when working from home. The main d…

>then routes your traffic over a virtual network adapter

this is not a requirement of zero trust.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#146

Post by tacker2000 »

mschuster91 wrote: post #98
kuhsaft wrote: post #84

Earlier quoted context omitted.

It’s impossible to stop using M365 while stopping usage of SharePoint (cloud or on-premises). See https://news.ycombinator.com/item?id=44640219 Here’s just one example: Each M365 Teams Team creates an M365 Group which creates a SharePoint site and Exchange mailbox. Teams channel files are stored in that SharePoint site. Teams channel messages are stored in the Exchange mailbox. Private files dropped in Teams are stor…

> Private Teams messages are stored in individual Exchange mailboxes. Good lord. It truly is a layer of dung layered upon more layers of dung.

To be fair exchange works quite well for mail and calendar, it syncs very fast, is easy to set up and the cloud version is easy to administer (i never had to admin an on-prem exchange but ive heard its not fun).

Using this infra for teams makes sense since it already works well. As one poster said, its probably via some hidden folder.

I wonder what they did with skype, did they actually integrate any of it into teams or just dump it entirely?

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#147

Post by tialaramex »

p_ing wrote: post #127
tialaramex wrote: post #35

Earlier quoted context omitted.

IIRC Microsoft is rewriting some of these backend services in Rust, although not because it will increase security but because it lets them get better perf than existing solutions without the safety tradeoff they'd have suffered to go to C++ which would have been their option 15-20 years ago. I don't know whether Sharepoint was on that list.

SharePoint is primarily written in C# [.NET Framework 4.8] and leverages ASP.NET; there would be no reason to rewrite the majority in another language. There is some C++ in SharePoint Search (and a few other components here and there). IIS which SharePoint runs atop of is written in presumably primarily C. You can decompile most of SharePoint if you ever need to peek at the code. That's a huge advantage to figure out…

[flagged]

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#148

Post by pentamassiv »

jiggawatts wrote: post #131
ho_schi wrote: post #25

Earlier quoted context omitted.

I wonder what drives people using Microsoft and then using more from this company. We didn’t knew it better, back then. We knew it better, now. But migrating is work. So we prefer to suffer! And harm others! This Linux and BSD people are so annoying with their desire for compatibility. They shall suffer, too! And when we buy everything from a Monopoly, we don’t need to think. Somehow. Part of the game is that you’ve…

They're using Microsoft because all of the alternatives have the same issues. FOSS isn't magically immune to vulnerabilities. It doesn't help that the FOSS community generally prefers the C programming language over more modern and safer alternatives as a cultural thing. The result is just as many vulnerabilities, if not more, per line of code or per feature. Keep in mind that SharePoint is an enormous product with a…

Rust is very popular and quickly getting adopted. The number of Debian packages that use Rust libraries more then doubled and is now at 8%

https://www.phoronix.com/news/Rust-Debian-2025

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#149

Post by bodhi_mind »

dotty- wrote: post #145
bodhi_mind wrote: post #129

My real-time security alert feed picked this up before the major news outlets: https://zerodaypublishing.com/feed

that's cool, do you support an RSS feed?

Not yet, but I’m planning to roll one out later this week! Are you in cybersecurity or just tracking vulnerabilities for fun/work?

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#150

Post by doubled112 »

dylan604 wrote: post #104
threetonesun wrote: post #63

Earlier quoted context omitted.

While Sharepoint might some day die, it will only be replaced by another piece of software that gets launched for nobody to ever use.

Clearly Sharepoint is being used. Otherwise, this would not be a news story. So if every single Sharepoint user switched to another piece of software, it would be more than nobody using it.

I think you missed the joke here, being that Sharepoint is installed in many of orgs, but never used after installation.

I have worked at an org that did the same. We already had Confluence. Somebody decided we needed Sharepoint. We licensed and installed it. Six months later we migrated the handful of documents and files and decommissioned it.

Post reply on HN