Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

washingtonpost.com

Post reply on HN
Print view View original

341–350 of 456 posts

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#341

Post by ToucanLoucan »

labcomputer wrote: post #227
ThunderSizzle wrote: post #193

Earlier quoted context omitted.

There is waste. A God awful amount of waste, fraud, and abuse. You don't rack up a 1.8 trillion deficit and a debt per capita that is 7x the income per capita without waste, fraud, and abuse. The problem is that while common sense would dictate those nonsensical expenses as such, they were part of the official process, so it was all legalized, so they avoid the FWA labels because the rule writers have made it so.

The problem with your argument is that Social Security (old people income), Medicare (old people healthcare) and interest on the national debt account for fully one half of total federal spending. Add in national defense and you reach two thirds. Interest is trivially accounted for. We know how much debt is outstanding. Social Security and Medicare expenditures are well within 5% of what should be expected, given the…

A solid portion of the 1.8 trillion figure the GP quoted was also the insane spending that had to happen to keep the economy somewhat afloat during the pandemic.

Of course in proper propagandist fashion, we only ever hear about how much money the undeserving poors got, and nothing about the millions upon millions of dollars in loans given to private businesses and their owners that were definitely, 100% used for them to weather the pandemic, and later forgiven despite being explicitly loans.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#342

Post by hnlmorg »

dijit wrote: post #333
hnlmorg wrote: post #332

Earlier quoted context omitted.

Neither Wikipedia nor Redhat are as big targets as Microsoft’s ecosystems. Not even remotely.

ok, nginx+linux power nearly every website, is that close enough of a sizable target? As mentioned, even if we exclude websites, Linux is a pretty enormous target. Much more enormous than microsoft - by an order of magnitude or more, yet: we don’t seem to have these kind of issues. Curious, don’t you think?

Nginx doesn’t have the same attack surface.

Microsoft’s back office suite is massive. So you’re talking about Nginx + a CMS + online office suite + video conferencing + identity providers and so on and so forth.

There isn’t really a direct comparison in the FOSS world. It’s either smaller in scope or smaller in terms of high profile organisation adoption.

This is why I think it’s easier to ignore the “Linux” part. Not because Linux is technically a kernel, but because there isn’t a directly comparable solution that targets Linux / GNU or whatever other base OS moniker you want to use. Same is true for BSD, Darwin and so on.

The alternatives to Microsoft’s dominance are typically more narrow in scope and usually proprietary too (eg Okta for identities, Google Docs for O365, etc)

Does this mean that Microsoft products are secure? Not really. It just means we cannot make a fair comparison against FOSS when it comes to these specific types of attacks.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#343

Post by notakio »

dijit wrote: post #333
hnlmorg wrote: post #332

Earlier quoted context omitted.

Neither Wikipedia nor Redhat are as big targets as Microsoft’s ecosystems. Not even remotely.

ok, nginx+linux power nearly every website, is that close enough of a sizable target? As mentioned, even if we exclude websites, Linux is a pretty enormous target. Much more enormous than microsoft - by an order of magnitude or more, yet: we don’t seem to have these kind of issues. Curious, don’t you think?

Very curious. Just based on the incidents we see, and analyze over time, almost all of them are compromised Windows systems. When I say "almost", I'll provide these stats: ~4500 Windows incidents over 5 years, vs. two Linux incidents.

Similarly, looking at vulnerability counts by vendor doesn't paint a rosy picture of our largest vendor Microsoft, either. But it pales in comparison to the incident statistics, which speak for themselves.

To Microsoft's credit, they've managed to turn their weaknesses into a secondary industry, wherein they now no longer sell just the disease, they also sell the cure. "Oh, your Windows systems have security problems? Have we told you about our expansive security solutions? They're only an additional $your_budget_doubled per year!"

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#344

Post by notakio »

hnlmorg wrote: post #342
dijit wrote: post #333

Earlier quoted context omitted.

ok, nginx+linux power nearly every website, is that close enough of a sizable target? As mentioned, even if we exclude websites, Linux is a pretty enormous target. Much more enormous than microsoft - by an order of magnitude or more, yet: we don’t seem to have these kind of issues. Curious, don’t you think?

Nginx doesn’t have the same attack surface. Microsoft’s back office suite is massive. So you’re talking about Nginx + a CMS + online office suite + video conferencing + identity providers and so on and so forth. There isn’t really a direct comparison in the FOSS world. It’s either smaller in scope or smaller in terms of high profile organisation adoption. This is why I think it’s easier to ignore the “Linux” part. No…

If every car in your neighborhood that gets broken into is manufactured by a single manufacturer, it is in your interest in asking why that is, and perhaps considering that fact when shopping for a new car.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#345

Post by HPsquared »

quaestio wrote: post #311
ryanjshaw wrote: post #280

Earlier quoted context omitted.

This is SharePoint on-premise, so Google Workspace isn’t a good comparison? Also, even if we do look at cloud: Workspace isn’t bad (exception: sheets vs Excel), but SharePoint is the center of Teams, Power Platform, PowerBI… to replace M365 with Workspace means a lot of research, setup and testing of 3rd party alternatives to the above. If you’ve ever worked in a well configured Microsoft stack, nothing beats the int…

Sheets is vastly superior to Excel for most users ;)

Most users don't produce most of the value.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#346

Post by paganel »

poemxo wrote: post #152

We need more Red Hat and less Microsoft in the on-prem enterprise business. These exploitable vulnerabilities are unacceptable when your customers are the likes of DoD. No one considers Google anything less than an impenetrable fortress, but when it's some government entity responsible for keeping American lives safe it's like "ah yeah they probably have a vulnerable on-prem Sharepoint that could easily be pwned." So…

> your customers are the likes of DoD.

One of the answers should be for the DoD, or any other such military institution, to try and rely a little bit less on everything being "digitilized", or at least to change it all into a more fragmented data/information "archipelago", with no centralised unique source-of-truth.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#347

Post by ToucanLoucan »

azemetre wrote: post #53
ToucanLoucan wrote: post #51

Earlier quoted context omitted.

I'm not sure which part pisses me off more: that tons of professionals lost their jobs and will likely not work in public service again because of it, or that through all that, they barely found any actual waste at all. A fucking farce.

You're assuming their purpose was to find waste, it was not. Their purpose was to be the Chicago boys in DC.

I'm assuming nothing of the sort. I assume what I always assume in these situations; that unqualified ignorant fuckwits convinced a bunch of other unqualified ignorant fuckwits to vote for them, so they could make their lack of understanding everyone else's problem. And likely get away with a huge sack of money Hanna Barbera style in the process.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#348

Post by pmontra »

baby_souffle wrote: post #138
anonymars wrote: post #130

Earlier quoted context omitted.

So it's essentially a more seamless and granular analog of a VPN? A device sits in front of the network and requires some sort of authenticated handshake (ideally all SSO) before passing packets through to a target endpoint?

At a high level, yeah. They can be implemented using a variety of technical patterns but they all share a common "each request is authenticated, encrypted" property instead of "anything goes once the tunnel is up" property.

HTTPS calls with any kind of authentication (cookies, tokens, even basic auth) are one way to be "authenticated, encrypted" for "each request". If they go to a reverse proxy at the entrance of a company network (a common setup for every internet facing http server) they are a way to do without a VPN.

And yet every customer of mine have some of their servers on a VPN. At the very least they enable ssh only on ports on the private network.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#349

Post by ubermonkey »

PeterStuer wrote: post #290
poemxo wrote: post #152

We need more Red Hat and less Microsoft in the on-prem enterprise business. These exploitable vulnerabilities are unacceptable when your customers are the likes of DoD. No one considers Google anything less than an impenetrable fortress, but when it's some government entity responsible for keeping American lives safe it's like "ah yeah they probably have a vulnerable on-prem Sharepoint that could easily be pwned." So…

"Why do Microsoft products enjoy a monopoly on the server ...?" They don't. There's plenty, even a majority, of non-Windows servers in gov (I know, some depts are true MS shops). Sharepoint is one of those things that snuck in via the desktop. It was touted by MS as an evolution of shared folders with "Intranet" features included. If you already ran a Windows Server for fileshares, Sharepoint was "free". The initial…

I was involved in a software startup that was aligned with MSFT 18 or so years ago. We built the web app side of our tool in Sharepoint precisely to be a good team player, and make ourselves more attractive to Redmond, even though it gave us no real benefits.

The support problems were INSANE. We ended up spending an entire release cycle pulling the web app out of Sharepoint and just doing a proper stand-alone web site. Support calls plummeted.

Sharepoint is something only a marketer could love.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#350

Post by ptsneves »

this_steve_j wrote: post #231
betaby wrote: post #215

Earlier quoted context omitted.

> Network connections are created by a Policy Engine that creates and tears down tunnels to each resource dynamically using attribute-based-access-controls (ABAC). Per request. What does it mean in technical terms? What kind of tunnels are whose and what is their purpose?

There are four different micro-segmentation variations in the NIST reference guide: device-agent/gateway, enclaves, resource portals, and application sandboxing. Basically a policy evaluation point (PEP) evaluates the security posture of both parties before and after a handshake, then creates a logical or physical path of some kind of between the actor and the resource. This can be done with software-defined virtual…

So the policy evaluation point has the keys to the kingdom and is the single point of failure, vs standard distributed authorisation declaration that would be up to each component of the system to implement.

How is this PEP better?

Post reply on HN