6 ms·

jesus christ. the damage our own government has done to microsoft is just insane. if i was a shareholder I would be so pissed. big companies go along with this

jesus christ. the damage our own government has done to microsoft is just insane. if i was a shareholder I would be so pissed. big companies go along with this behavior and collude with the government, but if this has a big enough effect on the bottom line, then it will happen less.

binarray2000 9y ago
You must see it in a broader context. I'll paraphrase you: "jesus christ. the damage our own government has done to [Iraq, Syria, Libya, North Korea, Vietnam, Serbia, Afghanistan...] is just insane. if i was a [citizen of these countries] I would be so pissed." At least, the shareholder has his life and his property (sans the missed opportunity due to "the damage our own government has done to microsoft").
- alexandercrohde 9y ago
  Is it really that simple? Didn't a cache of hacking tools recently end up in hackers' hands?
- MaymayMaster 9y ago
  What the hell does this have to do with anything?
- appleflaxen 9y ago
  i agree with you completely, but it seems irrelevant to this particular conversation.
SomeStupidPoint 9y ago
It seems strange to blame the government -- couldn't you see this as self-inflicted damage from creating an insecure OS that runs a vast number of important computers? I actually blame both, but it's not like MS is an innocent victim here -- there's a lot more they could have done on security, and didn't because it was expensive. If that choice being exploited costs them money, how is that anything but an effect of their own choices?
- nxc18 9y ago
  Microsoft has been investing a lot of effort into security. If they had it their way, you wouldn't even be able to install unverified software. I'm not sure Microsoft has been making the bad "security is expensive" decisions since XP sp2. Note also that they've been ahead of the curve on security since Vista, which was much maligned (partially) as a result. Nowadays both macOS and windows effectively have UAC, but Vista took the heat for it. Same thing with blocking unknown software; Windows took the heat, but just you try to run non-Apple-signed packages on OS x.
  - yoz-y 9y ago
    Does UAC and signing belong to the same bucket though? UAC has always been on macOS 10 because of the bsd root/user separation. For me the main problem is that on windows (Vista at least) the UAC seemed to fire on benign operations while letting you do quite dangerous ones without flinching.
    - nxc18 9y ago
      Its true that there are holes and that UAC isn't a particularly strong security barrier (i.e. If an attacker is at the keyboard it won't do shit). But that's the same for OS x and they have some even worse patterns; e.g. I'm pretty sure half the installers I end up using take your password themselves and pass it on to some waiting sudo under the hood. They at the very least don't use the proper system way of doing things; i can tell because some things trigger touch id and some don't. Similarly, there have been many stories about dropbox circumventing system security. I have no doubt that if dropbox can figure it out, malware writers can, too.
    - riskable 9y ago
      Based on the plethora of methods Microsoft has (intentionally) provided to bypass UAC I'd argue that it's the very definition of "security theater". UAC is nothing but a minor annoyance to attackers at this point. An extra step or two they have to add to their payload. Nothing more. It's also trivial to escalate from a regular user to NT AUTHORITY\SYSTEM (which is a higher privilege than Administrator!). There's so many privilege escalation vulnerabilities in Windows it's hard to keep track of them all! A big reason for that is that Microsoft considers privilege escalation vulnerabilities, "medium risk".
rdtsc 9y ago
They never see it that way. The ones doing it always have a solid propaganda / brainwashing framework to support these kind of actions. Heck they justify running a drone assassination program rationalizing exploiting some windows vulnerabilities is child's play for them. "We are fighting the evils of terrorism" / "It's their fault for releasing software full of these holes" / "It's the target's fault for installing this OS" pretty easy to rationalize this stuff. And I think you are implicitly asking them to think "one day this will leak and will damage the reputation of a major US company" and they probably are not allowed to think that way it's more down the line "we'll just keep it hidden and nobody will ever find out, we are the best at this and not like those other agencies whose stuff has been leaked"
- roywiggins 9y ago
  I don't think developing a malware kit for Windows damages Microsoft's reputation materially. I mean, it's just a fancier RAT, isn't it? The CIA's job is to spy on people. Planting bugs is part of their job. If they didn't plant bugs in computer systems too, what are they being paid for? I mean, you can argue that their entire charter should be rearranged or abolished, but it's hard to blame them when "sneaking into places they're not wanted and exfiltrating data" is kind of their entire reason for existing. (the drone program is a whole other kettle of fish)
chisleu 9y ago
NSA -> Microsoft is a revolving door of employment. EDIT: Apple, Google, etc as well.
sleepybrett 9y ago
Is this the governments fault for finding the exploits or microsoft's for inadequate testing?
- lawnchair_larry 9y ago
  These aren't even exploits. This is just normal OS functionality. There is no security flaw here. It's meant for post-compromise use. You need admin rights before you can use it.
- CaptSpify 9y ago
  Why not both?
- burkaman 9y ago
  The issue is not finding the exploits, but exploiting the exploits.
riazrizvi 9y ago
I seriously doubt it is anything but a quid pro quo arrangement.
- burkaman 9y ago
  Why? What would the CIA/NSA gain by telling Microsoft what they're doing? It's not like it's impossible to find serious security flaws without colluding, independent researchers do it all the time. It seems like asking for a quid pro quo would open up a huge risk of discovery without very much gain.
  - riazrizvi 9y ago
    Why would it be a quid pro quo? A government-hackable system allows intelligence services to 'keep the country safe' by helping data gathering (remember the arguments put forth during the iPhone/FBI kerfuffle). So governments support them through the means at their disposal, funding, govt contracts, State dept deals etc. The company gains because they shift product. Win-win. I'm not sure what the CIA/NSA would gain by explaining their tactics, I don't understand why they would ever do that. IMO it is a non-sequitor to my comment.
eighthnate 9y ago
> if i was a shareholder I would be so pissed. I doubt shareholders are pissed considering the stock has grown 500% since 2009 while paying decent dividends. > big companies go along with this behavior and collude with the government Isn't that called mercantilism? > big companies go along with this behavior and collude with the government, but if this has a big enough effect on the bottom line, then it will happen less. It hasn't affected their bottom line yet. It is concerning how intertwined large corporations are with government.
- appleflaxen 9y ago
  > I doubt shareholders are pissed considering the stock has grown 500% since 2009 while paying decent dividends. > It hasn't affected their bottom line yet. it's unknowable what the bottom line or stock price would be with different circumstances, but there is no question that security disclosures like this are a downward pressure on it. who knows; maybe they did get an even bigger lift from the collusion. the only way it will change is if consumers start pricing in this kind of behavior (paying less for compromised products). it's too bad that's such an unlikely goal.

binarray2000 9y ago

You must see it in a broader context. I'll paraphrase you: "jesus christ. the damage our own government has done to [Iraq, Syria, Libya, North Korea, Vietnam, Serbia, Afghanistan...] is just insane. if i was a [citizen of these countries] I would be so pissed." At least, the shareholder has his life and his property (sans the missed opportunity due to "the damage our own government has done to microsoft").

alexandercrohde 9y ago
Is it really that simple? Didn't a cache of hacking tools recently end up in hackers' hands?
MaymayMaster 9y ago
What the hell does this have to do with anything?
appleflaxen 9y ago
i agree with you completely, but it seems irrelevant to this particular conversation.

SomeStupidPoint 9y ago

It seems strange to blame the government -- couldn't you see this as self-inflicted damage from creating an insecure OS that runs a vast number of important computers? I actually blame both, but it's not like MS is an innocent victim here -- there's a lot more they could have done on security, and didn't because it was expensive. If that choice being exploited costs them money, how is that anything but an effect of their own choices?

nxc18 9y ago
Microsoft has been investing a lot of effort into security. If they had it their way, you wouldn't even be able to install unverified software. I'm not sure Microsoft has been making the bad "security is expensive" decisions since XP sp2. Note also that they've been ahead of the curve on security since Vista, which was much maligned (partially) as a result. Nowadays both macOS and windows effectively have UAC, but Vista took the heat for it. Same thing with blocking unknown software; Windows took the heat, but just you try to run non-Apple-signed packages on OS x.
- yoz-y 9y ago
  Does UAC and signing belong to the same bucket though? UAC has always been on macOS 10 because of the bsd root/user separation. For me the main problem is that on windows (Vista at least) the UAC seemed to fire on benign operations while letting you do quite dangerous ones without flinching.
  - nxc18 9y ago
    Its true that there are holes and that UAC isn't a particularly strong security barrier (i.e. If an attacker is at the keyboard it won't do shit). But that's the same for OS x and they have some even worse patterns; e.g. I'm pretty sure half the installers I end up using take your password themselves and pass it on to some waiting sudo under the hood. They at the very least don't use the proper system way of doing things; i can tell because some things trigger touch id and some don't. Similarly, there have been many stories about dropbox circumventing system security. I have no doubt that if dropbox can figure it out, malware writers can, too.
  - riskable 9y ago
    Based on the plethora of methods Microsoft has (intentionally) provided to bypass UAC I'd argue that it's the very definition of "security theater". UAC is nothing but a minor annoyance to attackers at this point. An extra step or two they have to add to their payload. Nothing more. It's also trivial to escalate from a regular user to NT AUTHORITY\SYSTEM (which is a higher privilege than Administrator!). There's so many privilege escalation vulnerabilities in Windows it's hard to keep track of them all! A big reason for that is that Microsoft considers privilege escalation vulnerabilities, "medium risk".

rdtsc 9y ago

They never see it that way. The ones doing it always have a solid propaganda / brainwashing framework to support these kind of actions. Heck they justify running a drone assassination program rationalizing exploiting some windows vulnerabilities is child's play for them. "We are fighting the evils of terrorism" / "It's their fault for releasing software full of these holes" / "It's the target's fault for installing this OS" pretty easy to rationalize this stuff. And I think you are implicitly asking them to think "one day this will leak and will damage the reputation of a major US company" and they probably are not allowed to think that way it's more down the line "we'll just keep it hidden and nobody will ever find out, we are the best at this and not like those other agencies whose stuff has been leaked"

roywiggins 9y ago
I don't think developing a malware kit for Windows damages Microsoft's reputation materially. I mean, it's just a fancier RAT, isn't it? The CIA's job is to spy on people. Planting bugs is part of their job. If they didn't plant bugs in computer systems too, what are they being paid for? I mean, you can argue that their entire charter should be rearranged or abolished, but it's hard to blame them when "sneaking into places they're not wanted and exfiltrating data" is kind of their entire reason for existing. (the drone program is a whole other kettle of fish)

chisleu 9y ago

NSA -> Microsoft is a revolving door of employment. EDIT: Apple, Google, etc as well.

sleepybrett 9y ago

Is this the governments fault for finding the exploits or microsoft's for inadequate testing?

lawnchair_larry 9y ago
These aren't even exploits. This is just normal OS functionality. There is no security flaw here. It's meant for post-compromise use. You need admin rights before you can use it.
CaptSpify 9y ago
Why not both?
burkaman 9y ago
The issue is not finding the exploits, but exploiting the exploits.

riazrizvi 9y ago

I seriously doubt it is anything but a quid pro quo arrangement.

burkaman 9y ago
Why? What would the CIA/NSA gain by telling Microsoft what they're doing? It's not like it's impossible to find serious security flaws without colluding, independent researchers do it all the time. It seems like asking for a quid pro quo would open up a huge risk of discovery without very much gain.
- riazrizvi 9y ago
  Why would it be a quid pro quo? A government-hackable system allows intelligence services to 'keep the country safe' by helping data gathering (remember the arguments put forth during the iPhone/FBI kerfuffle). So governments support them through the means at their disposal, funding, govt contracts, State dept deals etc. The company gains because they shift product. Win-win. I'm not sure what the CIA/NSA would gain by explaining their tactics, I don't understand why they would ever do that. IMO it is a non-sequitor to my comment.

eighthnate 9y ago

> if i was a shareholder I would be so pissed. I doubt shareholders are pissed considering the stock has grown 500% since 2009 while paying decent dividends. > big companies go along with this behavior and collude with the government Isn't that called mercantilism? > big companies go along with this behavior and collude with the government, but if this has a big enough effect on the bottom line, then it will happen less. It hasn't affected their bottom line yet. It is concerning how intertwined large corporations are with government.

appleflaxen 9y ago
> I doubt shareholders are pissed considering the stock has grown 500% since 2009 while paying decent dividends. > It hasn't affected their bottom line yet. it's unknowable what the bottom line or stock price would be with different circumstances, but there is no question that security disclosures like this are a downward pressure on it. who knows; maybe they did get an even bigger lift from the collusion. the only way it will change is if consumers start pricing in this kind of behavior (paying less for compromised products). it's too bad that's such an unlikely goal.