5 ms·

The proper mitigation would be actually using much simpler, better quality software. Microsoft Exchange Server is quite famous for being an attack vector on cor

The proper mitigation would be actually using much simpler, better quality software. Microsoft Exchange Server is quite famous for being an attack vector on corporate networks. At my previous job, the company was advised (by a very capable and expensive security consulting company) to keep Exchange as separate as possible from the corporate network - this of course is a bit counter intuitive, when you want to use e.g. Single Sign-On, contacts and more typically with Active Directory (AD). Thankfully my job wasn't to administer or develop any solutions for AD or Exchange so I just took a note. Obviously, no engineer can have even a sufficient overview of the full Exchange Server implementation not speaking of full understanding. In such a situation security, quality and user (or admin for that matter) experience always take a big hit. It doesn't help Exchange Server is most likely developed using programming languages and approaches that more or less demand complecting the solution with OOP-related ceremony. Supporting two decades or more of legacy features and protocols doesn't help. Some companies even want to connect AD and Exchange to SharePoint... which is at least as complex as Exchange. The problem companies don't understand is that you have to work on simplifying, which is very hard - much harder than adding features. If you don't, the interactions between components will overwhelm even the largest and best skilled team on the planet. The result is, we see breaches and security issues like this every day and realistically, nobody who can decide anything in the corporate environment gives a f** anymore because nobody pays the more or less laughable fines with their own money and nobody really goes to jail but the user data is lost, peoples lives are shattered.

EvanAnderson 6y ago
Exchange product architecture was absolutely to blame for this. Very particualrly, the "/ECP" directory should have never been allowed to be Internet accessible. (I believe the upcoming version finally rectifies that in a "supported" way.) In general, though, Microsoft hasn't focused enough on making Exchange more compartmentalized. The servers' privileges in Active Directory are too high (though this is supposedly being addressed in the upcoming version too.)
- kaliszad 6y ago
  Thank you for the insight. Certainly, "in the upcoming version" is a bit late for those affected and most of those other Exchange-related hacks in the past. The thinking around Exchange is still more or less left in the 20th century and it shows.
discreteevent 6y ago
"It doesn't help Exchange Server is most likely developed using programming languages and approaches that more or less demand complecting the solution with OOP-related ceremony." This statement certainly doesn't help the credibility of your comment.
- systematical 6y ago
  Cause you could never have exploits in functional...ever.
mattmanser 6y ago
I find this comment extremely unhelpful. There's a reason why everyone uses microsoft exchange, despite all its myriad of flaws, and the flaws of its major client Outlook. And it's because it offers so much functionality, precisely because it so much more complicated. It's like saying you can secure your house if you build a 20ft wall round it with no gate. Sure you can, but it becomes pretty useless.
- doctor_eval 6y ago
  I don’t think that’s true at all. Exchange is awful. It’s slow, hard to configure and doesn’t offer anything you can’t do better with simpler tools. Like the majority of awful “enterprise” products on the market, the primary reason that it’s popular is because it’s from a megacorp who speaks the language of the buyers, who are all aspiring megacorps. I was horrified the first time I used exchange and couldn’t wait to change providers the moment I had the chance. So it’s more like saying you can secure your house if you use a security service who sets security targets instead of sales targets.
  - lc9er 6y ago
    It’s pretty bad, but it’s probably the best of the available tools at the time. Serious competitors like Groupwise and Lotus were kind of nightmares. Open source alternatives offered great individual components, but not the integrated solution you got with Exchange/Outlook/Sharepoint. Sometimes being the least worst option is all it takes.
  - Karunamon 6y ago
    Exchange ... doesn’t offer anything you can’t do better with simpler tools. I call maximum shenanigans on this. Exchange is a fully-integrated groupware suite with a single-pane-of-glass on both the management and the user side. I am aware of precisely zero feature-complete alternatives, let alone anything "better".
    - kaliszad 6y ago
      Feature completeness doesn't mean the software is better. I think, many of those companies affected or the poor people there certainly wished for at least a moment they didn't use Exchange.
FpUser 6y ago
>"It doesn't help Exchange Server is most likely developed using programming languages and approaches that more or less demand complecting the solution with OOP-related ceremony" What on Earth OOP has to do with the quality / security of the Exchange? This reads like someone is on crusade.
- kaliszad 6y ago
  Well, I kind of am to be frank. OOP really mostly obscures an implementation and is often taught almost religiously as "the true one way". In the end, Exchange is a stellar example of the obscured and therefore unfathomable implementation. You should really watch "Simple Made Easy" by Rich Hickey and think really hard about it. If you don't come to the conclusion that most software development could be way more sustainable in the long run would we use simpler tools and approaches instead of complecting everything especially with questionable OOP balast then maybe we have very different experiences.
  - FpUser 6y ago
    >"OOP really mostly obscures an implementation " I see nothing wrong with OOP. It is convenient for many things. It is not a silver bullet though. Nothing is. Personally I do not adhere to any concept / programming paradigm. They're just tools. I use many. Depends on what I am doing. Generally one can take a tool and put it to good use while the other will fuck things up regardless.
    - disgruntledphd2 6y ago
      I think OOP is useful where you need to have state and functions kept together. It's a little easier to have foobar.update(), rather than update(foobar, state). I started off mostly programming in R, so using mostly bare functions, but I have to admit that objects are really, really useful when you need to maintain state. Yes, you can do it with closures, but it's a little harder and a little uglier. That being said, the mutability that makes objects useful is also problematic in that you can end up with magically updating references without defensive copying.
xwolfi 6y ago
What s even more complicated than convincing a company simplifying is necessary? Convincing a developper to add features rather than remove requirement when the feature has no simple implementation in view :D
- kaliszad 6y ago
  I know it was meant as fun. I had a bitter laugh. :-) Actually, you want to work in a setting where you understand the need and value of a feature and how it fits into the overall design and feel of the (software/ hardware) solution to a problem. Is such a case, you understand that there is no requirement but a need or pain point that needs to be addressed, if you want to deliver more value to the user, some of which may turn into financial or other benefit for you.

EvanAnderson 6y ago

Exchange product architecture was absolutely to blame for this. Very particualrly, the "/ECP" directory should have never been allowed to be Internet accessible. (I believe the upcoming version finally rectifies that in a "supported" way.) In general, though, Microsoft hasn't focused enough on making Exchange more compartmentalized. The servers' privileges in Active Directory are too high (though this is supposedly being addressed in the upcoming version too.)

kaliszad 6y ago
Thank you for the insight. Certainly, "in the upcoming version" is a bit late for those affected and most of those other Exchange-related hacks in the past. The thinking around Exchange is still more or less left in the 20th century and it shows.

discreteevent 6y ago

"It doesn't help Exchange Server is most likely developed using programming languages and approaches that more or less demand complecting the solution with OOP-related ceremony." This statement certainly doesn't help the credibility of your comment.

systematical 6y ago
Cause you could never have exploits in functional...ever.

mattmanser 6y ago

I find this comment extremely unhelpful. There's a reason why everyone uses microsoft exchange, despite all its myriad of flaws, and the flaws of its major client Outlook. And it's because it offers so much functionality, precisely because it so much more complicated. It's like saying you can secure your house if you build a 20ft wall round it with no gate. Sure you can, but it becomes pretty useless.

doctor_eval 6y ago
I don’t think that’s true at all. Exchange is awful. It’s slow, hard to configure and doesn’t offer anything you can’t do better with simpler tools. Like the majority of awful “enterprise” products on the market, the primary reason that it’s popular is because it’s from a megacorp who speaks the language of the buyers, who are all aspiring megacorps. I was horrified the first time I used exchange and couldn’t wait to change providers the moment I had the chance. So it’s more like saying you can secure your house if you use a security service who sets security targets instead of sales targets.
- lc9er 6y ago
  It’s pretty bad, but it’s probably the best of the available tools at the time. Serious competitors like Groupwise and Lotus were kind of nightmares. Open source alternatives offered great individual components, but not the integrated solution you got with Exchange/Outlook/Sharepoint. Sometimes being the least worst option is all it takes.
- Karunamon 6y ago
  Exchange ... doesn’t offer anything you can’t do better with simpler tools. I call maximum shenanigans on this. Exchange is a fully-integrated groupware suite with a single-pane-of-glass on both the management and the user side. I am aware of precisely zero feature-complete alternatives, let alone anything "better".
  - kaliszad 6y ago
    Feature completeness doesn't mean the software is better. I think, many of those companies affected or the poor people there certainly wished for at least a moment they didn't use Exchange.

FpUser 6y ago

>"It doesn't help Exchange Server is most likely developed using programming languages and approaches that more or less demand complecting the solution with OOP-related ceremony" What on Earth OOP has to do with the quality / security of the Exchange? This reads like someone is on crusade.

kaliszad 6y ago
Well, I kind of am to be frank. OOP really mostly obscures an implementation and is often taught almost religiously as "the true one way". In the end, Exchange is a stellar example of the obscured and therefore unfathomable implementation. You should really watch "Simple Made Easy" by Rich Hickey and think really hard about it. If you don't come to the conclusion that most software development could be way more sustainable in the long run would we use simpler tools and approaches instead of complecting everything especially with questionable OOP balast then maybe we have very different experiences.
- FpUser 6y ago
  >"OOP really mostly obscures an implementation " I see nothing wrong with OOP. It is convenient for many things. It is not a silver bullet though. Nothing is. Personally I do not adhere to any concept / programming paradigm. They're just tools. I use many. Depends on what I am doing. Generally one can take a tool and put it to good use while the other will fuck things up regardless.
  - disgruntledphd2 6y ago
    I think OOP is useful where you need to have state and functions kept together. It's a little easier to have foobar.update(), rather than update(foobar, state). I started off mostly programming in R, so using mostly bare functions, but I have to admit that objects are really, really useful when you need to maintain state. Yes, you can do it with closures, but it's a little harder and a little uglier. That being said, the mutability that makes objects useful is also problematic in that you can end up with magically updating references without defensive copying.

xwolfi 6y ago

What s even more complicated than convincing a company simplifying is necessary? Convincing a developper to add features rather than remove requirement when the feature has no simple implementation in view :D

kaliszad 6y ago
I know it was meant as fun. I had a bitter laugh. :-) Actually, you want to work in a setting where you understand the need and value of a feature and how it fits into the overall design and feel of the (software/ hardware) solution to a problem. Is such a case, you understand that there is no requirement but a need or pain point that needs to be addressed, if you want to deliver more value to the user, some of which may turn into financial or other benefit for you.