Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

csoonline.com

Post reply on HN
Print view View original

181–190 of 404 posts

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#181

Post by crmd »

fujigawa wrote: post #135
crmd wrote: post #94

One of the first things I do after getting an inquiry from a recruiter or friend referral is lookup the MX record for the company’s email domain. It is an anonymous one-command check to see if they’re a Microsoft shop. If they are, it’s enormous personal red flag. MSFT is very popular so I’m only speaking about my own experience, but I have learned over the course of 20 years that an MSFT IT stack is highly correlate…

I'm gonna be honest, you sound like a problem employee. The companies not using Microsoft, are using Google. Which in my experience is equally or measurably worse. Just personal data points, but every avowed Microsoft hater I've ever worked with has been... difficult. Like a-drag-on-the-team-because-he-refuses-to-use-company-tools difficult. Edit: How does an aged post on this site go from +4 to -1 in the span of a f…

The chairman of my last big company said I was “ungovernable” at one of our last board dinners, so I’m reluctantly inclined to agree with you.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#182

Post by NeutralCrane »

fujigawa wrote: post #135
crmd wrote: post #94

One of the first things I do after getting an inquiry from a recruiter or friend referral is lookup the MX record for the company’s email domain. It is an anonymous one-command check to see if they’re a Microsoft shop. If they are, it’s enormous personal red flag. MSFT is very popular so I’m only speaking about my own experience, but I have learned over the course of 20 years that an MSFT IT stack is highly correlate…

I'm gonna be honest, you sound like a problem employee. The companies not using Microsoft, are using Google. Which in my experience is equally or measurably worse. Just personal data points, but every avowed Microsoft hater I've ever worked with has been... difficult. Like a-drag-on-the-team-because-he-refuses-to-use-company-tools difficult. Edit: How does an aged post on this site go from +4 to -1 in the span of a f…

Google is leaps and bounds preferable in my experience than Microsoft. I agree with the above. A Microsoft shop isn’t a guarantee the company culture is bad, but it’s correlated enough to be a flag.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#183

Post by NeutralCrane »

dieortin wrote: post #147
fujigawa wrote: post #145

Earlier quoted context omitted.

They are all equally crap. I'm convinced the people designing collaboration tools don't have to use them on a daily basis.

I’m sure the people who designed Teams and Meet use their own products on a daily basis. And if those are crap, what’s a better alternative?

Zoom + Slack

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#184

Post by NeutralCrane »

unethical_ban wrote: post #114
crmd wrote: post #94

One of the first things I do after getting an inquiry from a recruiter or friend referral is lookup the MX record for the company’s email domain. It is an anonymous one-command check to see if they’re a Microsoft shop. If they are, it’s enormous personal red flag. MSFT is very popular so I’m only speaking about my own experience, but I have learned over the course of 20 years that an MSFT IT stack is highly correlate…

Companies that don't use Outlook? All five of them? I've seen companies with varying levels of MS product integration but Outlook is pretty foundational. Now, if a company says they use SharePoint or Teams to store their documentation, run to the hills. Wikis or bust.

I’ve worked for six companies and only one of them uses Outlook. I think there is some availability bias by industry or job type. I know there are lots of companies that use Outlook, but you may be overestimating how many do, particularly among the companies more likely to be represented here (tech and/or startups).

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#185

Post by stackskipton »

BeetleB wrote: post #137
stackskipton wrote: post #111

Earlier quoted context omitted.

Just like everyone else before invention of Email and Document sharing? However, like every other business, no one is willing to slow down velocity for security reasons so now we are here. Unless you have a fix for "Line must go up", market pressures will always cause this.

> market pressures will always cause this. Market pressures dominate nuclear weapons development?

Sure, all the “Let’s run government like a business” types. Cut IT budget and outsource to contractors who want maximum profit.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#186

Post by unethical_ban »

NeutralCrane wrote: post #184
unethical_ban wrote: post #114

Earlier quoted context omitted.

Companies that don't use Outlook? All five of them? I've seen companies with varying levels of MS product integration but Outlook is pretty foundational. Now, if a company says they use SharePoint or Teams to store their documentation, run to the hills. Wikis or bust.

I’ve worked for six companies and only one of them uses Outlook. I think there is some availability bias by industry or job type. I know there are lots of companies that use Outlook, but you may be overestimating how many do, particularly among the companies more likely to be represented here (tech and/or startups).

I tend to work at banks, multinationals and power.

My direct employer uses GSuite (and Google docs as a source of record is as bad as a 2000s file share)

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#187

Post by bdangubic »

NeutralCrane wrote: post #184
unethical_ban wrote: post #114

Earlier quoted context omitted.

Companies that don't use Outlook? All five of them? I've seen companies with varying levels of MS product integration but Outlook is pretty foundational. Now, if a company says they use SharePoint or Teams to store their documentation, run to the hills. Wikis or bust.

I’ve worked for six companies and only one of them uses Outlook. I think there is some availability bias by industry or job type. I know there are lots of companies that use Outlook, but you may be overestimating how many do, particularly among the companies more likely to be represented here (tech and/or startups).

Large enterprises (1000+ employees): probably 70-80%+

Mid-sized businesses (100-1000 employees): around 60-70%

Small businesses: more variable, maybe 40-60%

this reply was written by “AI” :)

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#188

Post by [deleted] »

numpad0 wrote: post #179
bitmasher9 wrote: post #144

Earlier quoted context omitted.

Doing research on a potential employer and filtering out opportunities based on preferred toolchains is a green flag not a red flag.

I think the point is that GP red flagging all MS shops, which is more or less just sorting companies by headcount and flagging all from top, implies incompetency at GP's side than at the company side. Like, if a fighter jet pilot came and told all American jets are equally weak and overcomplicated and ineffective, it probably tells more about that pilot than about the jets. I don't know if that's the case, but that w…

[deleted]

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#190

Post by Root_Denied »

diggan wrote: post #44
SoftTalker wrote: post #11

Earlier quoted context omitted.

As the effect of yesterday's AWS event demonstrates, the major Amazon, Microsoft, and Google data centers are surely top tier targets in every adversary's war plans. The decentralized internet is less of a reality today than it was years ago.

Don't we have more internet submarine cables and less single points of failure in our internet infrastructure today than years ago? If so, shouldn't that make it easier to route around failures? The web though I agree isn't very decentralized.

Considering that the AWS outage took out a lot of lines of communication (email, video, chat systems) for both commercial and government entities, I'd say that US-East-1 is a pretty big single point of failure. Even if it didn't result in infrastructure impact directly, if there was some kind of infrastructure issue and you had delayed or unavailable communications, how would you know? How quickly could a response be mounted? There's some parts of the infrastructure that could damage themselves irreparably in the time it would take to to fix the outage or get comms routed through a backup channel - like parts of the electrical grid or water treatment plants.

An attacker (read: nation-state actor) wouldn't even need to take down US-East-1, it could just take advantage of the outage.

I assume (hope?) there's some kind of backup comms plan or infra in place for critical events, but I don't actually know.

Post reply on HN