Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

washingtonpost.com

Post reply on HN
Print view View original

91–100 of 456 posts

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#91

Post by alephnerd »

zelphirkalt wrote: post #85
alephnerd wrote: post #75

Earlier quoted context omitted.

Giving OP the benefit of the doubt, there were issues with how the Windows kernel had little guardrails and restrictions. That said, that was the EU's fault, as the EU in 2009 forced Microsoft to fully expose their OS internals to outside vendors during an anti-trust settlement, and with little ability to enforce vendor standards: ""Microsoft shall make available to interested undertakings Interoperability Informatio…

Security by obscurity is a bad security concept. If anything making that information available prevented things from lurking in there and doing even more damage.

I agree with your position on security via obscurity being uslesss, but the issue was the settlement didn't allow Microsoft to add limits such as additional validation checks on vendors offerings, as those actions could be construed as violating the "non-discriminatory terms".

Any vendor's legal team worth their mettle could then argue that any additional validation on vendors is unfair given that MS would always have significant internal knowledge about how the Windows Kernel operated.

It's yet another example of the EU getting in the way of itself.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#92

Post by cm2187 »

tombert wrote: post #24

At the risk of massive downvotes, I have to admit that a small part of me wants this so that maybe corporations stop using Sharepoint as soon as possible. Seriously, I haven't used it since 2017, but every time I used it then it was the worst part of my day. I used to have a shirt that said SHarepoIT Happens that I would wear to work, and it seemed like the one thing I could get my coworkers agree on was that Sharepo…

And sharepoint in large organisations I have been at recently is now using oauth which breaks Microsoft's own sharepoint client API. That whole software is one massive waste of time and buget.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#93

Post by theteapot »

shrubble wrote: post #19

Wasn’t Microsoft just recently using Chinese people living in China to administer DOD servers? I would guess they use Sharepoint inside the DOD?

Says this in the article:

> A programming flaw in its cloud services also allowed China-backed hackers to steal email from federal officials. On Friday, Microsoft said it would stop using China-based engineers to support Defense Department cloud-computing programs after a report by investigative outlet ProPublica revealed the practice, prompting Defense Secretary Pete Hegseth to order a review of Pentagon cloud deals.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#96

Post by vel0city »

jongjong wrote: post #45
kuhsaft wrote: post #28

Earlier quoted context omitted.

For collaborative documentation, there’s probably a bunch of alternatives. But SharePoint is the linchpin for Microsoft 365. Well technically SharePoint and Exchange. You can’t use any Microsoft 365 products without SharePoint. OneDrive uses SharePoint. Outlook Groups and Teams Channels create Microsoft 365 Groups. Every Microsoft 365 Group creates a SharePoint site. Microsoft Loop uses Microsoft SharePoint Embedded.…

Google Docs and Libre Office both produce compatible documents. There's really no reason to force one or the other. It's just conflating needs. Document editing and file storage are two different tasks. It's weird that people want everything integrated. It's not much effort to just drag and drop a file into G-Drive, OneDrive, Dropbox, box.com...

> Document editing and file storage are two different tasks.

Not if you want to enable multiple users to be live editing the document at the same time.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#97

Post by persolb »

tombert wrote: post #24

At the risk of massive downvotes, I have to admit that a small part of me wants this so that maybe corporations stop using Sharepoint as soon as possible. Seriously, I haven't used it since 2017, but every time I used it then it was the worst part of my day. I used to have a shirt that said SHarepoIT Happens that I would wear to work, and it seemed like the one thing I could get my coworkers agree on was that Sharepo…

As a mid size company that does work with government agencies, it’s near impossible to use anything ‘better’ solution. Cybersecurity requirements are getting so onerous that Sharepoint is too commercially feasible of an option to use anything else for a shared file store between organizations.

The fact that Sharepoint sucks* doesn’t matter… because anything else is seen as a risk.

* folders with lots of files are hard to scroll through because each page is lazy loaded, the automation functions are buggy, logins between different M365 tenants breaks and is not correctable by a normal site admin, human readable URL paths aren’t standard, search is shit, tables/filters are buggy, the new interface hides a bunch of the permissions logic, some things like permission groups need to be managed via outlook, etc etc. I’m sure a bunch of my gripes are technically fixable, but these aren’t things that should need a web search in order to use/fix.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#98

Post by mschuster91 »

kuhsaft wrote: post #84
tombert wrote: post #24

At the risk of massive downvotes, I have to admit that a small part of me wants this so that maybe corporations stop using Sharepoint as soon as possible. Seriously, I haven't used it since 2017, but every time I used it then it was the worst part of my day. I used to have a shirt that said SHarepoIT Happens that I would wear to work, and it seemed like the one thing I could get my coworkers agree on was that Sharepo…

It’s impossible to stop using M365 while stopping usage of SharePoint (cloud or on-premises). See https://news.ycombinator.com/item?id=44640219 Here’s just one example: Each M365 Teams Team creates an M365 Group which creates a SharePoint site and Exchange mailbox. Teams channel files are stored in that SharePoint site. Teams channel messages are stored in the Exchange mailbox. Private files dropped in Teams are stor…

> Private Teams messages are stored in individual Exchange mailboxes.

Good lord. It truly is a layer of dung layered upon more layers of dung.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#100

Post by anonymars »

Arainach wrote: post #89
charles_f wrote: post #80

> CISA advises vulnerable organizations [...] to disconnect affected products from the public-facing Internet until an official patch is available. It's interesting to me that you'd go the hassle of hosting your own SharePoint on prem, but leave it internet facing. I would have assumed a the Venn diagram of these organizations to be entirely contained in orgs forcing you to use a VPN.

Best practice is to assume the network is compromised - a VPN doesn't provide as much guarantee as people would like. In large fleets, devices are regularly lost, damaged, retired, etc. In organizations with high target value, physical penetration through any number of means should be assumed. So you don't do that. You use zero trust and don't care that things are exposed to the internet. Working from anywhere (remot…

Maybe I'm missing something but doesn't this very story cut your assertion off at the knees?

With a VPN the attack surface of this vulnerability would have been miniscule compared to a publicly accessible zero-day RCE

(And it's not like you have to allow carte-blanche access behind the wall)

Defense in depth!

Post reply on HN