Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

washingtonpost.com

Post reply on HN
Print view View original

151–160 of 456 posts

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#151

Post by greatgib »

anonymars wrote: post #109
mschuster91 wrote: post #98

Earlier quoted context omitted.

> Private Teams messages are stored in individual Exchange mailboxes. Good lord. It truly is a layer of dung layered upon more layers of dung.

I don't think this is nearly as crazy as you may think at first glance Imagine if it was just a hidden (special) folder in an Exchange mailbox. Voila, you already have a well-known and widely implemented and tested message syncing solution both for content and status (read/unread) I assume Windows Phone worked the same way with its text message backup. When you'd set up a new phone it would take a while for your Micr…

When you dig it up, it is totally crazy and the total shit that we could expect.

Nothing works really well nowadays with exchange (classic, new, web, ...) or Teams. It is a complex layer based on sharepoint, that was not designed for that, because OneDrive is so bad that they have absolutely no way to manage a proper sharing of files between multiple persons, and so even less between teams and orgs.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#152

Post by poemxo »

We need more Red Hat and less Microsoft in the on-prem enterprise business. These exploitable vulnerabilities are unacceptable when your customers are the likes of DoD.

No one considers Google anything less than an impenetrable fortress, but when it's some government entity responsible for keeping American lives safe it's like "ah yeah they probably have a vulnerable on-prem Sharepoint that could easily be pwned."

So why is this? Why do Microsoft products enjoy a monopoly on the server in these sectors when more secure (Linux-based) options are far cheaper and widely deployed already? Isn't security the number one priority in those spaces?

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#153

Post by LoganDark »

poemxo wrote: post #152

We need more Red Hat and less Microsoft in the on-prem enterprise business. These exploitable vulnerabilities are unacceptable when your customers are the likes of DoD. No one considers Google anything less than an impenetrable fortress, but when it's some government entity responsible for keeping American lives safe it's like "ah yeah they probably have a vulnerable on-prem Sharepoint that could easily be pwned." So…

Could be that Microsoft can navigate all the regulatory bullshit that surrounds anything government. I don't know of anyone doing that for anything Linux.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#154

Post by hn_acc1 »

tough wrote: post #74
to11mtm wrote: post #54

Earlier quoted context omitted.

This is what happens when Chesterton's fence is ignored...

not just ignored but purposefully burnt down

Chesterton's fence, his dad's moat and his grandpa's bunker..

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#155

Post by phil21 »

dizlexic wrote: post #69
ho_schi wrote: post #25

Earlier quoted context omitted.

I wonder what drives people using Microsoft and then using more from this company. We didn’t knew it better, back then. We knew it better, now. But migrating is work. So we prefer to suffer! And harm others! This Linux and BSD people are so annoying with their desire for compatibility. They shall suffer, too! And when we buy everything from a Monopoly, we don’t need to think. Somehow. Part of the game is that you’ve…

From what I've seen in my industry? To pass all the liability to Microsoft. "If something happens, we used enterprise grade industry standard software. We did our due diligence." This outlook is basically why we can't innovate anymore. I had to recently sit through a meeting where our CTO quoted all the "blogs" he's been reading as a way to slap down my suggestion for an in-house project. It's all about CYA.

I call it the liabilty fairy.

It's why school boards don't do anything useful, among many many other things in our society. It's an endemic disease.

Most of the time it's extremely exaggerated, but it's trotted out and used as a CYA excuse almost immediately by most in the executive/managerial class. Both due to outright laziness and incompetence, and also as just a... why take any personal risk whatsoever making actual decisions with any impact if I can keep my cushy job and career rolling by being as milquetoast as possible.

Never mind you get the big bucks to make such important and controversial decisions at great personal (career) risk when some inevitably go wrong. Everyone forgot that part. Such roles should be hard, difficult, and risky.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#156

Post by kuhsaft »

greatgib wrote: post #151
anonymars wrote: post #109

Earlier quoted context omitted.

I don't think this is nearly as crazy as you may think at first glance Imagine if it was just a hidden (special) folder in an Exchange mailbox. Voila, you already have a well-known and widely implemented and tested message syncing solution both for content and status (read/unread) I assume Windows Phone worked the same way with its text message backup. When you'd set up a new phone it would take a while for your Micr…

When you dig it up, it is totally crazy and the total shit that we could expect. Nothing works really well nowadays with exchange (classic, new, web, ...) or Teams. It is a complex layer based on sharepoint, that was not designed for that, because OneDrive is so bad that they have absolutely no way to manage a proper sharing of files between multiple persons, and so even less between teams and orgs.

Yeah. Once you start working with the SharePoint API and Exchange API, you realize how it’s a miracle that Teams works at all. It’s bonkers.

I once figured out that you can go to the permissions page on the SharePoint site created by Teams and remove access for the corresponding M365 group.

M365 relies on SharePoint and Exchange, but they don’t rely on M365. So, you can potentially break Teams.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#158

Post by hn_acc1 »

jiggawatts wrote: post #131
ho_schi wrote: post #25

Earlier quoted context omitted.

I wonder what drives people using Microsoft and then using more from this company. We didn’t knew it better, back then. We knew it better, now. But migrating is work. So we prefer to suffer! And harm others! This Linux and BSD people are so annoying with their desire for compatibility. They shall suffer, too! And when we buy everything from a Monopoly, we don’t need to think. Somehow. Part of the game is that you’ve…

They're using Microsoft because all of the alternatives have the same issues. FOSS isn't magically immune to vulnerabilities. It doesn't help that the FOSS community generally prefers the C programming language over more modern and safer alternatives as a cultural thing. The result is just as many vulnerabilities, if not more, per line of code or per feature. Keep in mind that SharePoint is an enormous product with a…

I mean.. people contributing to FOSS generally program in what they know - i.e. I have some time to contribute, I'll spend 10 productive hours in C, because I know what I'm doing, vs. learning Rust only to spend 30 hours and not really getting anything done.

I contributed to a Tcl/Tk library that I was using at work that had a specific issue with some image files, so I fixed it internally, and contributed the fix back to the FOSS project (with permission from work).

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#159

Post by xyst »

If I am ever on the board of a company, I will always vote no confidence in the dipshit CTO or founder that willingly install/mandate use of Microsoft junk in the company.

As a corporate drone that has accidentally opened various Microsoft office suite links inside of Teams. My dislike for anything Microsoft continues to grow.

Am I surprised that sharepoint has vulnerabilities? Hell no.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#160

Post by zamadatix »

anonymars wrote: post #130
zamadatix wrote: post #111

Earlier quoted context omitted.

In zero trust "exposed to the internet" is a bit of a misnomer compared to how traditional security would use the term. A better description might be "you're allowed to form a session to it from over the internet but only after your identity and set of rights have been verified". From this view: "zero trust" < "vpn" < "wide open" (in terms of exposure).

So it's essentially a more seamless and granular analog of a VPN? A device sits in front of the network and requires some sort of authenticated handshake (ideally all SSO) before passing packets through to a target endpoint?

Something I'll add to the other responses is "the network" isn't an assumption of zero trust. Whether it's a single server on the private corporate network or a multi-cloud multi-region service hosted on the internet zero trust treats them the same.

My way of mapping it to VPN mindset is "per app clientless VPNs straight to where the things are hosted". In an extremely open ruleset with all of the servers on a corporate network this could theoretically devolve into "a traditional clientless VPN to the office".

Post reply on HN