Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lessons from last week’s cyberattack

blogs.microsoft.com

Post reply on HN
Print view View original

231–240 of 304 posts

Re: Lessons from last week’s cyberattack

#231

Post by kagamine »

pawadu wrote: post #222
EvanAnderson wrote: post #209

Earlier quoted context omitted.

Anyone can seek help on the open market to support Ubuntu 10.04 forever if they like. You can't go to another company if you don't like the price Microsoft sets for support for Windows XP.

This comment makes my blood boil. Please ask yourself: 1. why would anybody want to keep 10.04 alive? 2. do you think the type of people who stubbornly continue to use 10.04 would know/care enough about security to seek an alternative source for security patches? edit: should maybe add why this pisses me off: just logged into a production server running 12.04, default install apache and updates _turned off_. the owne…

I think you missed the point being made by the person you replied to. The only 10.04 install you should encounter exists due to ignorance and not due to upgrade cost as with a non-open OS. XP/Vista/7/8/10 don't get upgraded due to them being proprietary and having a single point of support (concerning OS level exploits).

So, 1. because there is a community outside of a major corp who are active, so it isn't a burden on Canonical. 2. yes? see 1.

Should any IT professional not have upgraded from 10.04? No. It's free to upgrade, unlike Win which, remember, isn't a single upgrade, licensing is per user.

Re: Lessons from last week’s cyberattack

#232

Post by cryptarch »

nailer wrote: post #229
cryptarch wrote: post #211

Earlier quoted context omitted.

I thought MIT wasn't free software as defined by the FSF? Open source would be the term for that. Free requires end users to receive source, open just allows you to use the source if you have a copy.

Free software is defined by the FSFs list of freedoms and MIT licence certainly provides those freedoms.

Fair enough, I got hung up on the lack of guarantees to distribute code alongside compiled applications.

Would you say compiled MIT programs are still "free software" when they don't come with the source code?

Re: Lessons from last week’s cyberattack

#233

Post by cryptarch »

codedokode wrote: post #58
cryptarch wrote: post #29

Earlier quoted context omitted.

Disabled the SMB services yet? Win + R -> services.msc I routinely disable services (until things stop working and I have to figure where I went too far) and luckily I'd disabled this one on my Win7 gaming box, even though the updates came through as well (I just manually vet updates, and have a bunch of them blacklisted for adding telemetry).

Are you sure this is enough? At least on WinXp, port 445 is opened by a kernel driver and is still opened after stopping the SMB service.

I'm not sure, I only learned to manage services when I was already on Windows 7.

Re: Lessons from last week’s cyberattack

#234

Post by tallanvor »

yoaviram wrote: post #200
loteck wrote: post #11

The quote bombshell here, and what hasnt yet gotten much attention since sysadmins the world over are busy dealing with fallout, is that the NSA and therefore the US government is directly responsible for the current global cyber-carnage. We developed the capability, we chose to keep it unpatched, we tried to keep it secret, we lost control of it. This has similarities in type, if not in horror, to the development an…

Another point which hasn't yet gotten much attention is the valuable role Wikileaks played as an early working system. Without Wikileaks it is likely that Microsoft wouldn't have had the chance to release a patch ahead of any attacks.

The exploit was released in April. Microsoft patched it in March. How did Wikileaks play any role in the problem getting fixed?

Re: Lessons from last week’s cyberattack

#235

Post by tallanvor »

askvictor wrote: post #132
SomeStupidPoint wrote: post #19

Earlier quoted context omitted.

MS issued a patch ahead of the usage of the lost exploit by a wide enough margin that I'm loathe to blame the government for the mere existence. The problem lies in our defensive infrastructure and our ability to roll out patches responding to incidents. It also lies in our security infrastructure: that cryptoworms are a danger speaks to a fundamental lapse in permission and process management systems.

MS also has to share some blame here for updates that break things, and updates that restart at random times (such as when you're doing some really urgent work). This has trained a whole lot of users to believe that windows updates are a risk to their use of the computer, and now just click away any update prompts.

Honestly, though, updates breaking things are quite rare. Sure, I know of "a friend of a friend of a friend" who had something break, but honestly, aside from patch installations sometimes being started at inopportune times, I haven't personally encountered things breaking on any of my systems or those of friends or family. More things get broken because people hear that there are problems and try to stop the updates.

Re: Lessons from last week’s cyberattack

#236

Post by aphexairlines »

muricula wrote: post #97
codedokode wrote: post #38

One of the reasons why such attack was possible is poor security in Windows. Port 445 that was used in an attack is opened by a kernel driver (at least that is what netstat says on WinXP) that runs in ring 0. This driver is enabled by default even if the user doesn't need SMB server and it cannot be easily disabled. Most of services in Windows are run under two privileged user accounts (LocalService or NetworkService…

The thing is there really isn't a production ready alternative. Rust in ring 0 isn't production ready -- a lot of language features needed to run in ring 0 are nightly only. There are no widely used microkernels. Ironically, of the widely used operating systems in the world, Windows does the best job of running drivers in userland.

Microsoft had enough resources in the 90s and 2000s to get a safe language like ocaml running at least their network services.

Re: Lessons from last week’s cyberattack

#237

Post by pawadu »

kagamine wrote: post #231
pawadu wrote: post #222

Earlier quoted context omitted.

This comment makes my blood boil. Please ask yourself: 1. why would anybody want to keep 10.04 alive? 2. do you think the type of people who stubbornly continue to use 10.04 would know/care enough about security to seek an alternative source for security patches? edit: should maybe add why this pisses me off: just logged into a production server running 12.04, default install apache and updates _turned off_. the owne…

I think you missed the point being made by the person you replied to. The only 10.04 install you should encounter exists due to ignorance and not due to upgrade cost as with a non-open OS. XP/Vista/7/8/10 don't get upgraded due to them being proprietary and having a single point of support (concerning OS level exploits). So, 1. because there is a community outside of a major corp who are active, so it isn't a burden…

You too are missing the point. The same people who didn't upgrade from 10.04 would probably also not take advantage of the Microsofts offer to upgrade to win10 free of charge, because .

I am so happy that win10 patches are mandatory despite all the whining. In fact, I want them to take it one step further and adopt the ChromeOS update model.

Re: Lessons from last week’s cyberattack

#238

Post by tragic »

CamperBob2 wrote: post #79
flukus wrote: post #75

Earlier quoted context omitted.

> The problem lies in our defensive infrastructure and our ability to roll out patches responding to incidents. The problem is corporate IT (or management) think they can create some sort of stable environment, driven by fear of having things break. Organizationally they need to accept that they are operating in a dynamic and hostile ecosystem and that the risk of worms is higher than the risk of some random app brea…

Organizationally they need to accept that they are operating in a dynamic and hostile ecosystem and that the risk of worms is higher than the risk of some random app breaking on a windows patch. Except it's not. The account used by the hackers has supposedly earned about 4 Bitcoins so far. Meanwhile, many people from home users to professional IT personnel can recall incidents where Windows Update has broken somethin…

This is a little misleading. The cost of the attack to businesses, governments etc is vastly greater than the laughable amount of money actually raised by the criminals.

A doctor who needs to look at an X-ray and comes up against WC is not going to pay up on her credit card. She will call the IT department to 'fix the broken computer'. But she still won't be able to look at the damn X-ray.

Re: Lessons from last week’s cyberattack

#239

Post by Angostura »

loteck wrote: post #11

The quote bombshell here, and what hasnt yet gotten much attention since sysadmins the world over are busy dealing with fallout, is that the NSA and therefore the US government is directly responsible for the current global cyber-carnage. We developed the capability, we chose to keep it unpatched, we tried to keep it secret, we lost control of it. This has similarities in type, if not in horror, to the development an…

> we chose to keep it unpatched

Are you saying that the choice was made my the NSA whole failed to report it, or suggesting that Microsoft colluded in keeping a known exploit open?

Re: Lessons from last week’s cyberattack

#240

Post by EvanAnderson »

pawadu wrote: post #222
EvanAnderson wrote: post #209

Earlier quoted context omitted.

Anyone can seek help on the open market to support Ubuntu 10.04 forever if they like. You can't go to another company if you don't like the price Microsoft sets for support for Windows XP.

This comment makes my blood boil. Please ask yourself: 1. why would anybody want to keep 10.04 alive? 2. do you think the type of people who stubbornly continue to use 10.04 would know/care enough about security to seek an alternative source for security patches? edit: should maybe add why this pisses me off: just logged into a production server running 12.04, default install apache and updates _turned off_. the owne…

I don't particularly care why an organization would want to maintain a piece of software indefinitely. That's not my problem.

I do think that's important to recognize that there is model under which an organization can. I'd even argue that it's a more "free market" than that of single-source proprietary software, too. If there's a market in maintaining non-proprietary software someone will pop up to fill it (even if it's just a lone-wolf consultant). With proprietary software that can't happen.

Whether or not an organization or individual chooses to maintain software is an orthogonal concern to the model under which they maintain it. Even when there is a free market for maintenance some will opt to eschew maintenance. Personally, I'd like those organizations to pay the cost by way of data loss, downtime, going out of business, etc.

I'm not overly worried about it. I think traditional regulatory and risk management will eventually catch up. Someday (hopefully sooner, rather than alter) businesses won't be able to get basic insurance policies unless they can prove they're doing IT maintenance, for example.

Post reply on HN