Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

washingtonpost.com

Post reply on HN
Print view View original

431–440 of 456 posts

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#431

Post by shuckles »

mschuster91 wrote: post #279
shuckles wrote: post #271

Earlier quoted context omitted.

Hard to square this with every startup after ~2006 running a substantial, if not majority, Mac fleet. In addition to the major tech companies.

Startups rarely use MDM solutions, that's a thing when you hit >> 1000 users because you need dedicated teams to hand-hold the MDM.

Neither of those claims is true in my experience. MDM is par for the course for SOC2, which is increasingly popular these days, and managing MDM seems like one of many responsibilities of ops teams.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#432

Post by eddythompson80 »

p_ing wrote: post #372
sanskarix wrote: post #351

It’s kind of wild how we end up here over and over, a big government breach, angry headlines, but the tech never seems to change (imo). If you work in IT, this whole SharePoint story is probably a deja vu, A few real-world points that stood out to me: - SharePoint (and a lot of other MS stuff) didn’t win because it was bulletproof, just because it was bundled “FREE” and nobody got fired for rolling it out in the 2000…

> SharePoint (and a lot of other MS stuff) didn’t win because it was bulletproof, just because it was bundled “FREE” In what world has SharePoint Server and SharePoint Standard + Enterprise User CALs ever been "FREE"? > Security honestly feels like a service for a lot of giants. While code security is on Microsoft, infrastructure security is on the organization deploying SharePoint Server. Remember, the topic you're…

> In what world has SharePoint Server and SharePoint Standard + Enterprise User CALs ever been "FREE"?

Yeah.. I think people say "bundled FREE" when they really referring to MS enterprise packages. It's similar to how Comcast will sell you TV for $100, land line for $20, internet for $100, but you can get a TV/land line package for $90? or a TV/internet for $130. You can "bundle FREE" phone on your TV/internet package for an extra $5. (And yes, I heard support before tell me "For $10 more a month, you get a free upgrade to 1Gbps". ???? How is that free? They will say "It's the same package, but one level up for $10 more. It comes with free 1Gbps upgrade. what doesn't make sense?"

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#433

Post by mixdup »

sanskarix wrote: post #351

It’s kind of wild how we end up here over and over, a big government breach, angry headlines, but the tech never seems to change (imo). If you work in IT, this whole SharePoint story is probably a deja vu, A few real-world points that stood out to me: - SharePoint (and a lot of other MS stuff) didn’t win because it was bulletproof, just because it was bundled “FREE” and nobody got fired for rolling it out in the 2000…

Something to understand here is that Sharepoint is not Windows. Sure it runs on Windows, but the vulnerability here was the application. Are we going to argue that applications that run on Linux cannot have security vulnerabilities? Especially large archaic enterprisey things like this?

I bet Oracle and SAP have similar types of things happen to their application suites but no one runs public websites on Oracle eApplications (yeah, plenty of companies have that exposed to the internet, but it's not The Company's Website)

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#434

Post by greatgib »

kuhsaft wrote: post #156
greatgib wrote: post #151

Earlier quoted context omitted.

When you dig it up, it is totally crazy and the total shit that we could expect. Nothing works really well nowadays with exchange (classic, new, web, ...) or Teams. It is a complex layer based on sharepoint, that was not designed for that, because OneDrive is so bad that they have absolutely no way to manage a proper sharing of files between multiple persons, and so even less between teams and orgs.

Yeah. Once you start working with the SharePoint API and Exchange API, you realize how it’s a miracle that Teams works at all. It’s bonkers. I once figured out that you can go to the permissions page on the SharePoint site created by Teams and remove access for the corresponding M365 group. M365 relies on SharePoint and Exchange, but they don’t rely on M365. So, you can potentially break Teams.

I the nice things like that, if someone gives you access to their Teams but you don't have a "storage" license on their domain, you will be able to exchange messages but a lot of things will not work without explicit clear error. And especially sending or receiving a file, image or anything in a chat conversation.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#435

Post by p_ing »

eddythompson80 wrote: post #432
p_ing wrote: post #372

Earlier quoted context omitted.

> SharePoint (and a lot of other MS stuff) didn’t win because it was bulletproof, just because it was bundled “FREE” In what world has SharePoint Server and SharePoint Standard + Enterprise User CALs ever been "FREE"? > Security honestly feels like a service for a lot of giants. While code security is on Microsoft, infrastructure security is on the organization deploying SharePoint Server. Remember, the topic you're…

> In what world has SharePoint Server and SharePoint Standard + Enterprise User CALs ever been "FREE"? Yeah.. I think people say "bundled FREE" when they really referring to MS enterprise packages. It's similar to how Comcast will sell you TV for $100, land line for $20, internet for $100, but you can get a TV/land line package for $90? or a TV/internet for $130. You can "bundle FREE" phone on your TV/internet packag…

Generally EA licensing didn't work like that. You still picked individual SKUs (Windows client, Windows Server, SQL Standard, etc), you simply got some level of discount, maybe eval licenses, some level of support, a TAM(CSAM), and paid when you tru-up (was three years, may be different now).

There wasn't, as far as I recall, "buy SQL Server Enterprise, get SharePoint Server Enterprise SKU for free" type licensing deals.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#436

Post by [deleted] »

BobbyTables2 wrote: post #205
zamadatix wrote: post #111

Earlier quoted context omitted.

In zero trust "exposed to the internet" is a bit of a misnomer compared to how traditional security would use the term. A better description might be "you're allowed to form a session to it from over the internet but only after your identity and set of rights have been verified". From this view: "zero trust" < "vpn" < "wide open" (in terms of exposure).

Makes “zero trust” sound like basic username/password from ancient times.

[deleted]

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#437

Post by zamadatix »

mike_hearn wrote: post #430
tjohns wrote: post #425

Earlier quoted context omitted.

They absolutely do, that’s fair. The big difference is once you’re in, with a VPN you have direct access to the whole network. With a zero trust setup, access has to be granted to you (or your ACL group) on a per-application basis. It makes it much harder for an attacker to move laterally when everything is default-deny.

But you can combine VPNs with SSO and limited permissions. Real networks all work that way these days. Logging into the VPN doesn't get you very far, you'll need to be provisioned with specific apps and permissions too.

If you crank it a bit further to add:

- You must "VPN in" to access any corporate resources of any type, even ones on the corporate network when you're sourcing from the corporate network

- The client forms a separate "VPN connection" (can be clientless, but same concept) per app you access, rather than assuming a single parent VPN server can get them to any resource

- Every default ruleset started with deny all and only specific allow rules were added over time

Then you've got enough to call it a zero trust implementation. You can also take things the other way, i.e. you could "deconfigure" a zero trust setup to look and function almost exactly as a normal corporate VPN tunnel.

Rather than go through this whole thread each time, people just refer to all of this as "zero trust networking".

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#438

Post by zamadatix »

BobbyTables2 wrote: post #205
zamadatix wrote: post #111

Earlier quoted context omitted.

In zero trust "exposed to the internet" is a bit of a misnomer compared to how traditional security would use the term. A better description might be "you're allowed to form a session to it from over the internet but only after your identity and set of rights have been verified". From this view: "zero trust" < "vpn" < "wide open" (in terms of exposure).

Makes “zero trust” sound like basic username/password from ancient times.

At the end of the day "you get access to things based on proving your identity" is not a novel concept. How you deploy, operate, and enforce that is where the differences in technologies lie.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#439

Post by eddythompson80 »

p_ing wrote: post #435
eddythompson80 wrote: post #432

Earlier quoted context omitted.

> In what world has SharePoint Server and SharePoint Standard + Enterprise User CALs ever been "FREE"? Yeah.. I think people say "bundled FREE" when they really referring to MS enterprise packages. It's similar to how Comcast will sell you TV for $100, land line for $20, internet for $100, but you can get a TV/land line package for $90? or a TV/internet for $130. You can "bundle FREE" phone on your TV/internet packag…

Generally EA licensing didn't work like that. You still picked individual SKUs (Windows client, Windows Server, SQL Standard, etc), you simply got some level of discount, maybe eval licenses, some level of support, a TAM(CSAM), and paid when you tru-up (was three years, may be different now). There wasn't, as far as I recall, "buy SQL Server Enterprise, get SharePoint Server Enterprise SKU for free" type licensing de…

> There wasn't, as far as I recall, "buy SQL Server Enterprise, get SharePoint Server Enterprise SKU for free" type licensing deals.

Yes, I didn't mean to say it was like that. More that you get discounts, credits, etc. Every EA agreement I heard of seemed custom and different for that enterprise needs. Throwing in Azure credits or a discount on a product if you get another product or increase volume, etc seemed to be typical.

Post reply on HN