Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

csoonline.com

Post reply on HN
Print view View original

141–150 of 404 posts

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#141

Post by dlgeek »

awesome_dude wrote: post #121
stackskipton wrote: post #111

Earlier quoted context omitted.

Just like everyone else before invention of Email and Document sharing? However, like every other business, no one is willing to slow down velocity for security reasons so now we are here. Unless you have a fix for "Line must go up", market pressures will always cause this.

Um, email was invented, like in the last millenium, well before Microsoft was a thing (only slightly sarky)

Microsoft was a thing before email.

Microsoft was founded in 1975. The standard for SMTP wasn't published in 1981. Most early predecessors were the late 70s.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#142

Post by AlotOfReading »

unethical_ban wrote: post #114
crmd wrote: post #94

One of the first things I do after getting an inquiry from a recruiter or friend referral is lookup the MX record for the company’s email domain. It is an anonymous one-command check to see if they’re a Microsoft shop. If they are, it’s enormous personal red flag. MSFT is very popular so I’m only speaking about my own experience, but I have learned over the course of 20 years that an MSFT IT stack is highly correlate…

Companies that don't use Outlook? All five of them? I've seen companies with varying levels of MS product integration but Outlook is pretty foundational. Now, if a company says they use SharePoint or Teams to store their documentation, run to the hills. Wikis or bust.

This varies widely by niche. My experience is that a solid majority of West Coast tech companies / startups use Gmail or other non-MS hosted solutions. Outlook or MS365 are a good indicator that the codebase may be older than some of the people writing it.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#143

Post by HippyTed »

SoftTalker wrote: post #55
diggan wrote: post #44

Earlier quoted context omitted.

Don't we have more internet submarine cables and less single points of failure in our internet infrastructure today than years ago? If so, shouldn't that make it easier to route around failures? The web though I agree isn't very decentralized.

Maybe yes in that regard. But in the past, most organizations ran their own mail and web servers. Software supporting the business ran on-prem. Now they use Google or Azure or AWS. So business and civilian usage, at least, seem more vulnerable now.

We sacrificed resillience for effeciency. Now things are much more fragile and liable to exploitation.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#144

Post by bitmasher9 »

fujigawa wrote: post #135
crmd wrote: post #94

One of the first things I do after getting an inquiry from a recruiter or friend referral is lookup the MX record for the company’s email domain. It is an anonymous one-command check to see if they’re a Microsoft shop. If they are, it’s enormous personal red flag. MSFT is very popular so I’m only speaking about my own experience, but I have learned over the course of 20 years that an MSFT IT stack is highly correlate…

I'm gonna be honest, you sound like a problem employee. The companies not using Microsoft, are using Google. Which in my experience is equally or measurably worse. Just personal data points, but every avowed Microsoft hater I've ever worked with has been... difficult. Like a-drag-on-the-team-because-he-refuses-to-use-company-tools difficult. Edit: How does an aged post on this site go from +4 to -1 in the span of a f…

Doing research on a potential employer and filtering out opportunities based on preferred toolchains is a green flag not a red flag.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#145

Post by fujigawa »

Etheryte wrote: post #140
fujigawa wrote: post #135

Earlier quoted context omitted.

I'm gonna be honest, you sound like a problem employee. The companies not using Microsoft, are using Google. Which in my experience is equally or measurably worse. Just personal data points, but every avowed Microsoft hater I've ever worked with has been... difficult. Like a-drag-on-the-team-because-he-refuses-to-use-company-tools difficult. Edit: How does an aged post on this site go from +4 to -1 in the span of a f…

I don't know man, you're gonna have a very tough crowd if you're gonna try and convince anyone that Teams is as good as Google Meet.

They are all equally crap. I'm convinced the people designing collaboration tools don't have to use them on a daily basis.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#146

Post by HippyTed »

doublerabbit wrote: post #17
JumpCrisscross wrote: post #13

Earlier quoted context omitted.

> needs to be a law that all nuclear and nuclear-adjacent facilities have no connection to the Internet Why the special treatment for nuclear? Do you really think redlining a dam or storm-levee system would be less damaging? Also, turning off internet connections means less-capable remote shut shut-off. Less-responsive power plants. Fewer eyes on telemetry. We should be mindful of what is and isn't connected to the i…

> Also, turning off internet connections means less-capable remote shut shut-off. Why does it have to be remote what's wrong with it being in-house? Besides a shut-off should never be able to be triggered remotely. The same goes for digital emergency shut off buttons; all should be physical. > Less-responsive power plants. What? How is remote any more responsive than physical workers being in-house? If power-plants o…

The one exception I can think of is remote shutdown in the face of a rapid natural disaster. Like how the japanese train network is set to shut down rapidly when a high power quake is detected.

But that is very geography dependant.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#147

Post by dieortin »

fujigawa wrote: post #145
Etheryte wrote: post #140

Earlier quoted context omitted.

I don't know man, you're gonna have a very tough crowd if you're gonna try and convince anyone that Teams is as good as Google Meet.

They are all equally crap. I'm convinced the people designing collaboration tools don't have to use them on a daily basis.

I’m sure the people who designed Teams and Meet use their own products on a daily basis. And if those are crap, what’s a better alternative?

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#148

Post by thomasjudge »

nneonneo wrote: post #127
unethical_ban wrote: post #114

Earlier quoted context omitted.

Companies that don't use Outlook? All five of them? I've seen companies with varying levels of MS product integration but Outlook is pretty foundational. Now, if a company says they use SharePoint or Teams to store their documentation, run to the hills. Wikis or bust.

God, Teams is absolutely miserable. Video calling on Teams makes you appreciate just how well Zoom works. Teams macOS client? Crashes on startup, even after clearing all of my user data. Teams iOS client? You can join a call by a link, but you can't see the call UI because it's behind the login window. Teams on Firefox? No video support for years , and most recently just glitches out and shows an empty page when tryi…

The Teams mac client is so awful I completely gave up on it

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#149

Post by kyrra »

pandemic_region wrote: post #115
crmd wrote: post #94

One of the first things I do after getting an inquiry from a recruiter or friend referral is lookup the MX record for the company’s email domain. It is an anonymous one-command check to see if they’re a Microsoft shop. If they are, it’s enormous personal red flag. MSFT is very popular so I’m only speaking about my own experience, but I have learned over the course of 20 years that an MSFT IT stack is highly correlate…

How can you see from the MX record if it is Microsoft?

The "dig" command can get them for you

$ dig ycombinator.com mx

  ;; ANSWER SECTION:
  ycombinator.com. 300 IN MX 20 alt1.aspmx.l.google.com.
  ycombinator.com. 300 IN MX 10 aspmx.l.google.com.
  ycombinator.com. 300 IN MX 20 alt2.aspmx.l.google.com.
  ycombinator.com. 300 IN MX 30 aspmx4.googlemail.com.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#150

Post by LoganDark »

baobun wrote: post #129
jahewson wrote: post #100

Earlier quoted context omitted.

What would you recommend instead?

For security-critical or sensitive situations, auditability should be a requirement. That implies access to source code and capabilty to build it. Decisions like these need to be done from first principles. SharePoint shouldn't even have been a contender here if looked at seriously. Do your own homework.

Doesn't Microsoft have government programs that grant source code access for products like Windows and (probably) SharePoint?
Post reply on HN