Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Chose Profit over Security, Whistleblower Says

propublica.org

Post reply on HN
Print view View original

311–318 of 318 posts

Re: Microsoft Chose Profit over Security, Whistleblower Says

#311

Post by cplat »

execveat wrote: post #81
cplat wrote: post #69

Earlier quoted context omitted.

During my Master's, security was one of the subjects I took. It started with an equation that related risk (how much you'd lose if something bad happened), the probability of that risk, and the cost of mitigating that risk. The instruction being, one tries to find a mitigation that costs less than the exploitation of the risk. And note here that "cost" does not refer to just money, but could be computational cost, en…

For the MS size entities, the risk calculation is way more complicated. The 1:1 between cost of mitigation vs cost of exploitation only applies to opportunistic attacks, really. At the level where APTs get involved, the data / access might be so valuable that they'd gladly outspend blue team's budget by a factor of 10-100.

But wouldn't the value of data be reflect in the cost of exploitation? (By cost of exploitation, I don't mean to say the resources needed to exploit, but what a company would stand to lose if exploited). The values of the variables, sure, can be different. I don't see why the equation has to be.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#312

Post by fsflover »

BenFranklin100 wrote: post #275
gigel82 wrote: post #231

Earlier quoted context omitted.

And Apple, the upstart ("stealth mode") ad company.

The upstart ad company that spent years and tens of billions of dollars to develop a privacy focused AI in the cloud platform? The same upstart that offers encrypted cloud storage that even it can’t decrypt? Congrats on the false equivalency argument. Guys like you do yourself a disservice. No one takes your hyperbolic statements seriously. Keep posting this nonsense if it makes you feel better.

1. https://appleinsider.com/articles/24/04/10/apple-makes-it-re...

2. https://sneak.berlin/20231005/apple-operating-system-surveil...

3. https://news.ycombinator.com/item?id=34299433

Re: Microsoft Chose Profit over Security, Whistleblower Says

#313

Post by fsflover »

tracker1 wrote: post #61
Ylpertnodi wrote: post #52

Earlier quoted context omitted.

I didn't get a Windows phone because i don't trust Microsoft. A friend had one and it was really ok, but no way for me.

In retrospect, I don't trust Apple or Google either...

So you need a GNU/Linux phone?

Re: Microsoft Chose Profit over Security, Whistleblower Says

#314

Post by bayindirh »

pvg wrote: post #283
bayindirh wrote: post #227

Earlier quoted context omitted.

None of them got their two different, non-revocable master keys stolen, I may say.

It's been a while now but at one point, just about every giant tech company simply make install'ed a key-material-leaking TLS bug on just about every endpoint they ran. The bug was introduced by, effectively, some guy on the internet. It implemented a feature statistically nobody was going to use. It's trivial to re-frame all sorts of mishaps as evidence of unseriousness about security, especially if done selectively…

I remember that incident.

I think there's a difference between compiling and installing a buggy software and developing the whole infrastructure yourself on top of the operating system that you solely develop and build.

But that's me.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#315

Post by Thorrez »

HotPotato787 wrote: post #305
Thorrez wrote: post #304

Earlier quoted context omitted.

I think those things the article is advising are the same things Andrew Harris wanted to advise customers to do 3 years prior, but Microsoft didn't want to, because it would make the default configuration sound insecure (it kind of was), jeopardizing government contracts, especially since various government systems would break if those config changes were made.

I get what you're saying, but from my point of view, this seems like something that doesn't need to be advised, because it is so trivial. Yes, if someone pwns my AD, then they can also pwn my cloud if i'm using some sort of federated trust. Even if i'm not, and both systems are completely separate, they just need to steal passwords from the cloud admin, which should be easy given they're already domain admins. Maybe…

>this seems like something that doesn't need to be advised, because it is so trivial

According to the article, that's not the reason Microsoft gave for not advising it. The reasons they gave were (1) it would make governments scared and jeopardize contracts and (2) it would let hackers know about the attack.

Also according to the article, the NYPD weren't aware of the problem until Harris warned them of it, then they quickly disabled seamless SSO:

>On a visit to the NYPD, Harris told a top IT official, Matthew Fraser, about the AD FS weakness and recommended disabling seamless SSO. Fraser was in disbelief at the severity of the issue, Harris recalled, and he agreed to disable seamless SSO.

>In an interview, Fraser confirmed the meeting.

>“This was identified as one of those areas that was prime, ripe,” Fraser said of the SAML weakness. “From there, we figured out what’s the best path to insulate and secure.”

>But still, could you elaborate on the default configuration being insecure? I know next to nothing about Azure/Entra, maybe I'm missing something important.

I'm not very familiar with Azure either. I'm getting most of this from the article. It sounds like the weakness is that by default trust federation to Microsoft 365 is enabled. Microsoft's post-Solarwinds article recommends disabling it.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#316

Post by Aerbil313 »

graemep wrote: post #83
JohnMakin wrote: post #73

The misaligned incentives between security and profit, especially in public companies, is not really a fixable problem without a massive cultural shift. I'm not sure at this point what could even trigger one. I've always dabbled in cybersecurity, taking on the hat in various roles over the years but have refused to go full time into it due to what I have personally seen in the industry - an overwhelming focus on comp…

This is exactly it. There is no incentive to prioritise security. It is not visible to customers, except in terms of compliance, most likely a check-list approach. I think it needs a massive cultural shift, but from customers. If customers were willing to evaluate security (consumers cannot, but enterprise can) properly, demand binding assurances, and make buying choices accordingly industry would respond. Of course…

It’s a market. There’s no demand for security. How often has the average Joe has one of their online accounts hacked or credit card details stolen in 2024?

Obviously the most effective way of incentivizing companies to focus on security is NSA assembling a team to hack important companies, create real harm and accompanying press releases. Ah sorry, I meant Russian hacker news.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#317

Post by nlewycky »

sangnoir wrote: post #265
weitendorf wrote: post #249

Earlier quoted context omitted.

Google makes zero-trust work by having a highly "centralized" or "uniform" tech stack all the way from tooling, to hosting, to infra. So everything defaults to zero-trust and it's not something you would need to think about setting up. Most big organizations have built up their internal/external tech over decades, with large parts of it being essentially "mothballed", and high degree of heterogeneity stemming from te…

> Shifting to zero-trust requires a lot of migration work across all of this, "training" ie figuring out how to get stubborn IT people to buy in to the new way of doing things[...] You're right, most times organizations need a fire lit underneath them to change, for Google, it probably was the NSA annotation "SSL added and removed here :^)" on a slide showing Google's architecture from the Snowden leaks.

> You're right, most times organizations need a fire lit underneath them to change, for Google, it probably was the NSA annotation "SSL added and removed here :^)" on a slide showing Google's architecture from the Snowden leaks.

As an insider, it was not. The move to zero-trust started with "A new approach to China": https://googleblog.blogspot.com/2010/01/new-approach-to-chin...

Re: Microsoft Chose Profit over Security, Whistleblower Says

#318

Post by wutwutwat »

michaelt wrote: post #234
alkonaut wrote: post #228

Earlier quoted context omitted.

I think I agree with this conclusion. But I work in a Shaw-like enterprise (only the products are more mundane than flooring). What are the hurdles we’d see if we tried it? What processes and practices are we likely using, that would break under the zero trust model?

For a start, you'll have a bunch of internal applications that are not hardened to be exposed on the public internet, and that you have neither the time nor the money to replace. A "zero trust" product vendor will therefore offer you something exactly like a VPN, but for some reason they'll say it's not a VPN. You will have "heuristics to detect anomalies" and users won't be allowed to directly see what 'anomalies' a…

> if someone plugs their phone into their laptop to charge it, they'll start getting network timeouts when they try to use the ERP system. After waiting 30 minutes for it to come back online, then calling the helpdesk, they'll be told that the charging phone counts as an unencrypted disk and they need to unplug it.

Good thing they killed the nic or blocked the LAN traffic on the laptop while it's connected to that high speed cellular network modem! And as we all know, once a potentially malicious payload delivering unencrypted drive is unplugged, the threat is gone and you can have your network back. If that weren't true, you'd see folks sprinkling usb thumb drives in the parking lots of their target's offices. What's next, usb cables with microcontrollers, keyloggers, and wifi?

/s

If helpdesk is making calls like that, add all the zero trust you want, you're still screwed

Post reply on HN