Live data from Hacker News

Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

washingtonpost.com

231–240 of 456 posts

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#231
post #215

Earlier quoted context omitted.

Microsoft’s version of “Zero Trust” doesn’t care if things are reachable from the public internet. They have been preaching “identity is the new perimeter” [1] for years, and it doesn’t wash. The NIST Zero Trust Architecture (ZTA) implementation guides (SP 1800-35) [2] cut through the nonsense and AI generated marketing smoke. In ZTA, ALL network locations are untrusted. Network connections are created by a Policy En…

> Network connections are created by a Policy Engine that creates and tears down tunnels to each resource dynamically using attribute-based-access-controls (ABAC). Per request. What does it mean in technical terms? What kind of tunnels are whose and what is their purpose?

There are four different micro-segmentation variations in the NIST reference guide: device-agent/gateway, enclaves, resource portals, and application sandboxing.

Basically a policy evaluation point (PEP) evaluates the security posture of both parties before and after a handshake, then creates a logical or physical path of some kind of between the actor and the resource. This can be done with software-defined virtual networks and stateful firewalls, at one or more of the OSI layers.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#232

Earlier quoted context omitted.

Says this in the article: > A programming flaw in its cloud services also allowed China-backed hackers to steal email from federal officials. On Friday, Microsoft said it would stop using China-based engineers to support Defense Department cloud-computing programs after a report by investigative outlet ProPublica revealed the practice, prompting Defense Secretary Pete Hegseth to order a review of Pentagon cloud deals…

Absolutely insane. Especially in light of their layoffs. Should be criminal. According to another comment in the thread, it is?

Microsoft only has a market cap if 3.7 trillion. They can't afford to hire domestically.

Anyway, from what I can tell being in this industry, a lot of things need to be explicitly illegal to stop companies from doing it.

Edit: The penalities also have to be meaningful. There's a lot of "technically not legal, but sue us lol" going on.

"Hey, this is a really really stupid idea." Isn't going to stop a middle manager from trying to come in under budget.

At most MS will pay a nominal fine, and proceed to learn nothing.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#233

Earlier quoted context omitted.

Maybe I'm missing something but doesn't this very story cut your assertion off at the knees? With a VPN the attack surface of this vulnerability would have been miniscule compared to a publicly accessible zero-day RCE (And it's not like you have to allow carte-blanche access behind the wall) Defense in depth!

In zero trust "exposed to the internet" is a bit of a misnomer compared to how traditional security would use the term. A better description might be "you're allowed to form a session to it from over the internet but only after your identity and set of rights have been verified". From this view: "zero trust" < "vpn" < "wide open" (in terms of exposure).

That’s my understanding.

In a pure implementation, the same level of trust is implied (absolutely none at all) whether a device is connecting to a resource from the public internet or the same subnet.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#235

Earlier quoted context omitted.

They're using Microsoft because all of the alternatives have the same issues. FOSS isn't magically immune to vulnerabilities. It doesn't help that the FOSS community generally prefers the C programming language over more modern and safer alternatives as a cultural thing. The result is just as many vulnerabilities, if not more, per line of code or per feature. Keep in mind that SharePoint is an enormous product with a…

Rust is very popular and quickly getting adopted. The number of Debian packages that use Rust libraries more then doubled and is now at 8% https://www.phoronix.com/news/Rust-Debian-2025

Rust has never been successfully used to develop large-scale software of the size of SharePoint, Exchange, or anything of that order of magnitude: gigabytes of compiled code with the main executable being 10s of megabytes in size.

An observation I've made about Rust is that because it eschews OOP, it tends not to "scale" to large development teams for single applications. It's great for CLI tools, small web apps, etc... but after some scale it runs out of steam.

This is exacerbated by its glacial compile times compared to other languages, even C++, let alone C#.

I just can't imagine something the size of SharePoint being developed entirely in Rust!

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#239

Earlier quoted context omitted.

Oh CISA... What a pity that CISA has been purged down of effective useful people and turned into another sad selected-for-political-compliance-only force. Arizona recently got attacked from Iranian hackers & didn't even bother trying to get help from CISA. https://archive.is/2025.07.19-143305/https://www.azcentral.c... CISA is so so vital. Investigating incredibly wide ranging attacks like this, or the Salt Typhoon a…

It almost seems like the goal is to hurt people

[flagged]

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#240

Earlier quoted context omitted.

Could be that Microsoft can navigate all the regulatory bullshit that surrounds anything government. I don't know of anyone doing that for anything Linux.

There's tons of Red Hat in federal IT, that's not the issue. It's just that Microsoft dominates the client-facing software business, and Red Hat has minimal presence there so while you might see RHEL desktops at e.g. NASA you're unlikely to see them anywhere else, and there's no real open source equivalent of SharePoint or Office out there. Maybe [0] will be one, eventually, but it would take a long long time to repl…

Huh, I didn't know Red Hat did any government stuff.
Post reply on HN