6 ms·
I remember this kind of thing happening all the time in the 90s and part of the 00s... It's just 10 to 1000 times worse now days since EVERYTHING is online now.
by rhacker 6y ago
I remember this kind of thing happening all the time in the 90s and part of the 00s... It's just 10 to 1000 times worse now days since EVERYTHING is online now.
- yudlejoza 6y agoI wasn't aware Exchange Server was still this prevalent, and that its pwnage was still alive and kicking. Great job M$.
- Triv888 6y agowhich one is your favorite alternative?
- CraigJPerry 6y agoPostfix. But that’s only an MTA i hear you cry, Exchange does both MTA & MDA! Bear with me. Postfix is software to learn from. It might be written in C but the architecture is the epitome of beautiful modular design. It’s not just the meticulous separation of concerns, the care and attention to detail, everything from string handling to memory management is pristinely handled. https://github.com/vdukhovni/postfix https://github.com/vdukhovni/postfix Even at runtime the beauty of the architecture allows for a sysadmin to choose (via master.cf) exactly how the components should be composed to fit their needs. The defaults are crafted for minimum fuss if you just need to get it running ASAP. The software is ergonomic in addition to being artfully crafted. So what does all this care and attention get you? Only 9 CVEs in 22 years, only 3 of which are code exec, only 2 of which are (maybe) remote code exec, only 1 of which is unauth user RCE - but very hard in practice to exploit. Maybe it’s just not that popular? It was 1/3 of all SMTP servers on the internet according to a 2019 scan. So it’s the best MTA ever to exist, but what about MDA? Well, that was the whole point. Compose well crafted components together to build a system. You especially don’t run part of your mailserver’s web interface in kernel space because, well i’m not sure why IIS/Exchange does that :-)
- logical_person 6y agowow if you remove features from software it becomes more secure? nice!
- throwaway99x99 6y agoMinimization of surface area is a key security principle. And, generally, security hates complexity.
- jimnotgym 6y ago..yet imagine telling the CEO you intend to turn of OWA because it is 'more surface area'. Features are what people pay for
- shaklee3 6y agoWhy is written in C bad? Lots of great enterprise software is c/c++.
- tonyedgecombe 6y agoActually I don't think there is much C going on in enterprise software anymore. Java and C# replaced it a long time ago.
- tsimionescu 6y agoSo Postfix does about 1/10th of what Exchange does, and is secure. Very well, do one thing and do it well. You talk about composing it with other stuff to create a system, but fail to mention if that system will still be more secure than Exchange. Even if each component of the system is individually very secure, that still doesn't tell you much about the security of the system. It's extremely easy to piece together two secure components and obtain 0 security. Edit: accidentally said 'not secure' instead of 'secure' in first statement, completely changing the meaning. Corrected in-place.
- Godel_unicode 6y ago
- toyg 6y agoMeh, this is actually great publicity for O365.
- gscott 6y agoJust like after the Experian hack, Experian ramped up their commercials for their paid Identity Theft Protection service. I was seeing their commercials every hour. https://www.experian.com/consumer-products/identity-theft-and-credit-protection.html https://www.experian.com/consumer-products/identity-theft-an...
- jesboat 6y agoThe huge data breach a couple years ago was Equifax, not Experian. It does not seem particularly hypocritical for Experian to try to capitalize on it
- taspeotis 6y agoI mean organisations with their own Exchange Server are just organisations that aren’t on Microsoft 365 yet. Which is basically hosted Exchange. It’s turtles all the way down.
- technion 6y agoUnfortunately "moving to Office 365" for many organisations doesn't get rid of Exchange. Microsoft's article on "how and when" is basically a list of reasons you might be stuck with it. https://docs.microsoft.com/en-us/exchange/decommission-on-premises-exchange https://docs.microsoft.com/en-us/exchange/decommission-on-pr...
- jiggawatts 6y ago> However, we have put little effort into how to get you from a hybrid configuration to the cloud only. It's hilarious to see someone at Microsoft say the quiet part out loud. Next thing you know they'll admit in writing that they have no plans for supporting Azure AD tenant to tenant trusts. Or, for that matter, tenant to tenant migrations as well... I mean, think about it: Who would want that? Nobody with a KPI of on-prem to cloud migrations at Microsoft headquarters, certainly!
- hanselot 6y agoThe number of words I assume Microsoft made up just to allow this sentence to function is baffling. Buzzwords and Microsoft are as always inseperable.
- ocdtrekkie 6y agoYep, getting 365 means you still end up hosting your own stuff, also paying Microsoft to host copies of it, and basically doubling your attack surface.
- lc9er 6y agoEven if you move to O365/Exchange Online, you’ll likely always have some Exchange footprint. The only way to get around this is to migrate your AD to Azure.
- jhanschoo 6y agoHow is it worse now? It looks to me that it's better now since SAAS companies today just patch their products on their end, and even this situation is better than needing physical media as in the past if the patch is too big.
- slickrick216 6y agoPractice. All those folks are still alive and now there’s more of them. They’ve all been practicing too.
- panarky 6y agoFormer US CISO Chris Krebs says this is a bigger deal than what's been reported so far. This is a crazy huge hack. The numbers I've heard dwarf what's reported here & by my brother from another mother (@briankrebs). https://twitter.com/C_C_Krebs/status/1368004401705717768 https://twitter.com/C_C_Krebs/status/1368004401705717768
- Godel_unicode 6y agoChris Kerbs was definitely not the US CISO. He was the director of CISA, the Cybersecurity and Infrastructure Security Agency. CISO of the US is usually a meaningless figurehead, Krebs actually did things.
- panarky 6y agoHis last name is "Krebs".
- Godel_unicode 6y agoFeel free to read the last sentence in my post.
- slickrick216 6y agoYeah I just had an awkward conversation with a relative who works for a company that has a on site email server running exchange. When I asked him had he patched or upgraded it he said no Microsoft does all that. Grim.