15 ms·
Microsoft says it found malicious software in its systems
- joenathanone 6y agoIt's only a matter of time before these hacks are weaponized, and it would appear that the US is totally unprepared.
- TheAdamAndChe 6y agoWhat makes you say this? I thought it was a common rumor that the NSA had backdoors in everything. Wouldn't Mutually Assured Destruction make an attack irrational, just as it deters nuclear attacks?
- laegooose 6y agobut who do you retaliate against? Cyber-attack is harder to attribute than a missile launch
- bayindirh 6y agoNSA back doors are different. Yes, there’s a MAD component but, when you weaponize an independent software vendor, this becomes asymmetric warfare. Its presence manifests a different set of skills. Exploitation is not necessary. Presence itself is enough of a warning. It says “we’re equal now. We can be in your turf, sleep for a long time and even use your own companies as launch pads”.
- andyjpb 6y agoMutually Assured Destruction relies on the victim knowing that they've been destroyed. Lots of these so-called "Cyber weapons" are operated by actors who are very effective at leaving no trace. It's been in the background before but in the reports about this SolarWinds issue the "leaves no trace" angle is starting to be emphasised much more. Not knowing if or what has been compromised means that the attacker can choose when or how to use the information they obtained and the victim will be surprised, even a long time down the line.
- IfOnlyYouKnew 6y agoThat "common rumor" has always struck me as particularly stupid. I believe it's popular because "everything is worse than you think" conspiratorial cynicism is what passes for intelligence these days. This hack by itself should be proof that the NSA has no such capabilities. And, no, stopping this hack would not have compromised anything. They could have tipped off any one of a rather large number of security researchers, companies, or vendors affected who would have gladly made up a believable story as to how they noticed this.
- paxys 6y agoAlmost everyone has lost personal information to such hacks at some point or the other. Critical infrastructure (e.g. hospital systems) has been held for ransom. National elections have been swayed by state-sponsored actors. Companies have lost plenty of IP to foreign competitors and governments. They are already weaponized, and have been for a while. The time to start taking information security seriously was 15 years ago.
- aboringusername 6y ago> The time to start taking information security seriously was 15 years ago. Yet we openly embrace hardware we don't understand riddled with flaws and software we can't see in to or audit and makes requests without our consent. When you login to $bankingApp are you aware of all the DNS requests, information it's POSTing? Heck, Facebook's SDK derps and cripples many applications. Our software stack is built on a mountain of hacks, flaws and quite frankly, insanity. Computing, from the hardware to the kernel needs completely revamping, because nothing else will be able to salvage our current environment.
- bayindirh 6y agoI find it extremely ironic. I’m currently finishing “Countdown to Zero Day” and some people are saying that NOBUS (nobody but us) doctrine reduces the attack surface considerably. Some other people highlight this mentality as extremely dangerous from a defense standpoint. Ten years after Stuxnet/Flame saga, USA is experiencing a same kind of attack and their stated preparedness has not improved from the levels stated in that book. It’s fascinating. Edit: No. I’m not enjoying this. There’s no schadenfreude.
- Threeve303 6y ago> Some other people highlight this mentality as extremely dangerous from a defense standpoint. Often the answer this group offers is yet another third party solution that is popular at the time. Then they give these tools the high level of permissions they need to function. Cycle repeats.
- bayindirh 6y agoNope. They advocate immediate disclosure of zero day exploits found by government and mandatory policies against stocking of these vulnerabilities for using them as/in cyber weapons. That book contains no corporate backing/advertising.
- Threeve303 6y agoSorry, I wasn't referring to the book specifically. Just talking about my experience during these kinds of conversations in government and the corporate world.
- XMPPwocky 6y ago> They advocate immediate disclosure of zero day exploits found by government How do you think governments find these vulnerabilities? Accidentally, under the couch cushions? What you actually seem to be proposing- in practice- is a ban on government-funded vulnerability research.
- 6y ago
- nfoz 6y agoThat's what I call Cortana
- vsareto 6y agoI'm really curious what's going to happen to SolarWinds the company, if anything, because of all this.
- maxerickson 6y agoStealing a joke I saw on Twitter, they rebrand.
- BitwiseFool 6y agoTruth in humor, there's a good chance that's exactly what will happen.
- jen729w 6y agoI was about to start a SW design literally the first day back next year. Not any more.
- vntok 6y agoWhy not? Surely they must have put the very best minds money can buy on the problem to fix it?
- jen729w 6y agoWell yeah, that was me. ;-) Perception is why. Especially for certain clients. Let’s pretend that I work for the French department of the interior and some time early next year I go to install SolarWinds. You think the boss is gonna OK that, knowing it’ll be in the paper the next day? No chance. They’re screwed for a while, only hope they have is staying afloat long enough for our short memories to forget this.
- dboreham 6y agoThey re-emerge called "737-Max".
- Dirlewanger 6y agoNothing. Equifax had nothing happen to them, this won't be any different.
- textech 6y agoThis is precisely the reason why I'm against moving everything to the cloud. Find your way into AWS or Azure and you will have everything on a silver platter.
- wayne 6y agoThat might be true for a tech-competent company with a well-staffed security team, but for many companies and for individual data, I'd trust Amazon and Microsoft to secure my data more than I'd trust myself.
- textech 6y agoIf they really had access to everything for the past several months then that doesn't say much for their competency.
- djsumdog 6y agoI think this is the wrong analogue. I absolutely would not trust Amazon or Microsoft with my personal data (I'm the type that hosts my own e-mail, sync, docs, etc.) Now for a BUSINESS, I could see the advantage in less maintenance cost and being able to spin up/down services easily. It is easier and that cost is measurable (up to a point; when you get big enough AWS costs become obscene compared to self-hosting. I've been at more than one shop that moved things back on-prem to save money).
- qz2 6y agoYeah migrating to AWS is not cheaper. It never is. It’s a complete fucking lie to be honest. I’m actually dealing with an issue where one RDS instance in AWS costs more over three years than the entire infrastructure and software investment did on the on-prem.
- JamesBarney 6y agoWhen they talk about being cheaper, they're talking about the salary of an infrastructure team, not the cost of the infrastructure itself.
- ipsum2 6y agoEarlier discussion: https://news.ycombinator.com/item?id=25461954 https://news.ycombinator.com/item?id=25461954 From yesterday: > "We have no indication of this," company President Brad Smith told New York Times reporter Nicole Perlroth. Perlroth said the company stood by a statement it issued on Sunday saying it had no indication of a vulnerability in any Microsoft product or cloud service in its investigations of the hacking campaign."
- deleted 6y ago[deleted]
- justincormack 6y agoThe references NSA advisory https://media.defense.gov/2020/Dec/17/2002554125/-1/-1/0/AUTHENTICATION_MECHANISMS_CSA_U_OO_198854_20.PDF https://media.defense.gov/2020/Dec/17/2002554125/-1/-1/0/AUT... basically says some people running AD in Azure have been compromised, so this seems to be bad reporting.
- octoberfranklin 6y agoStall until Friday afternoon before releasing bad news. Standard procedure.
- arminiusreturns 6y agoMicrosoft products themselves should be considered malicious.
- pedro2 6y agoI am pretty sure this just happened because the US hasn’t yet implemented encryption backdoors.
- desireco42 6y agoHa ha ha :) That must be it for sure.
- nix23 6y agoI am pretty sure that Microsoft is then allowed to use the "no backdoor" edition internally...for the rest the "backdoor included" edition.
- bregma 6y agoAs I understand it from my readings here on HN, the solution is to rewrite everything from scratch using Rust.
- dvfjsdhgfv 6y agoI always had a feeling the author of n-gate actively participates in some discussions here, and sometimes even provokes some threads.
- layoutIfNeeded 6y agoYou’re violating the prime directive.
- SCUSKU 6y agoI got a hearty chuckle out of this, thank you.
- dboreham 6y agoThen run on an airgapped computer with custom firmware in its hard drives.
- jrockway 6y agoI think I saw an article here that says that a few times per century, a star explodes in a distant galaxy and the resulting radiation can interact with a spinning hard drive in such a way as to allow Facebook to enhance their ad targeting profile on you. So no spinning hard drives, please.
- deleted 6y ago[deleted]
- jasonhansel 6y agoAnd make sure to keep it in a sound-proof room to avoid side channel attacks.
- wintorez 6y agoI mean other than its systems?!
- msoucy 6y agoI know, right? It's not nice to refer to your own product as malicious software.
- wintorez 6y agoIt keeps adding shit nobody asked for to its systems, and people have to search for how to remove them: https://www.ghacks.net/2020/11/28/what-is-meet-now-in-windows-10-and-how-to-remove-it/ https://www.ghacks.net/2020/11/28/what-is-meet-now-in-window...
- marcosdumay 6y agoHow do those people break keyboard based scrolling, and only keyboard based scrolling? It's incredibly prevalent, but the only way I can imagine doing that is by capturing every key at the top level... that I can't imagine any reason for doing.
- meow_mix 6y agomcafee anti virus?
- ChrisMarshallNY 6y ago> mcafee anti virus? I think that this is the only effective McAfee anti-virus: https://i.insider.com/55b111ed2acae7b7188b90ef https://i.insider.com/55b111ed2acae7b7188b90ef
- Triv888 6y agothat is a good/funny video (some cursing): https://www.youtube.com/watch?v=bKgf5PaBzyg https://www.youtube.com/watch?v=bKgf5PaBzyg
- tpmx 6y agoThe next few decades will be interesting.
- bob1029 6y agoI cannot wait until we are able to afford to run our critical business infrastructure on our own computers (again). I have a lot of trust in Microsoft & Amazon, but with the complexity of their organizations, there is no way they can provide the same kind of security assurances as if I were to have my own locked cage at some colo. Certainly, you could spin a fantastical tale about how AWS's 23+ layer physical security perimeter is superior to whatever is available at my local facilities. But, I have grown to classify this sort of stuff under the "what if 2 SHA256 hashes collide" category of fear-driven development. I almost have to convince myself on a daily basis now that "everything is fine" with how we are currently using the cloud. The selling points for moving to the cloud are very powerful and I agree with most of them. But at the same time, the idea that you are locked into this same combined fate as everyone else leaves me with the constant sensation that I should have brought a parachute with me.
- kerng 6y agoSecurity resources are sparse and large companies pay lots of money and hire them away. So attempting to defend by yourself could leave you more vulnerable. Probably a middle ground is the best- to benefit from expertise on both sides.
- polote 6y agoCompanies are hiring and working with tons of physical security pentesters to assess how much easy is it to enter their offices. At the same time nobody is paying anyone to assess for the security of my house. But I'm sure it is easier to enter a Google office than my home
- kerng 6y agoGood point, that's why the industry is moving (some companies have already moved to) an approach that assumes your device is compromised and your work laptop and identity is treated as untrusted by default which does not get you unvetted access to everything. You might have todo many things to get more access... and still there is no 100% security, just a little more security
- totaldude87 6y agoI don’t even know where to begin you can put in a 1000 firewalls or anti malware or greater defense systems , but apparently nothing would have stopped this? May be a stricter password policy and git scan?
- deleted 6y ago[deleted]
- dane-pgp 6y agoThe only secure password is the one you can't remember.
- insert_coin 6y agoThis should be a clear warning to all politicians pushing for backdoors, but it won't, and they'll blame anyone but themselves.
- jmclnx 6y agoI have been searching and it looks like this is specific to Microsoft Systems, though other systems may have helped spread it. From a couple of articles I found, the issue was in file SolarWinds.Orion.Core.BusinessLayer.dll The reason I looked was because I never saw anything stating what OS are directly impacted, all they talked about was how bad it was. I now understand why Microsoft is pushing so many articles about this issue (outside of the fact it looks like it is a big problem for lots of companies/gov/people).
- legulere 6y agoI wonder if sandboxing would reduce the impact of such attacks. It makes me look forward to fuchsia.
- yogthos 6y agousing a password of solarwinds123 in production is kind of asking to be hacked https://www.techdirt.com/articles/20201215/13203045893/security-researcher-reveals-solarwinds-update-server-was-secured-with-password-solarwinds123.shtml https://www.techdirt.com/articles/20201215/13203045893/secur...