6 ms·

SolarWinds hacking campaign puts Microsoft in hot seat

43 points by mikece 6y ago

edrobap 6y ago
> Many security experts believe Microsoft’s single sign-on model, emphasizing user convenience over security, is ripe for retooling to reflect a world where state-backed hackers now routinely run roughshod over U.S. networks. I believe convenience is not coming at the cost of security. SSO certainly has a single-node-failure problem. If it’s down, it causes DoS. If it’s hacked, the hackers can get access to the data user is authorised to view across multiple systems. But given the widespread use of the same passwords across multiple systems, this argument against SSO is weak. Besides that, the convenience of SSO is only for the user. It is for the organisation as well.
soarfourmore 6y ago
> Risks in Microsoft’s foreign dealings also came into relief when the Biden administration imposed sanctions Thursday on a half-dozen Russian IT companies it said support Kremlin hacking. Most prominent was Positive Technologies, which was among more than 80 companies that Microsoft has supplied with early access to data on vulnerabilities detected in its products. Following the sanctions announcement, Microsoft said Positive Tech was no longer in the program and removed its name from a list of participants on its website. What?! Microsoft gave vulnerability data to a Russian company that hacked the USA? Why was that company even in this program to begin with?
- Hiopl 6y ago
  Isn't it obvious? Tech has a clear blind spot for geopolitics. Saying anything critical of China or Russia, even if well-founded, is a great way to get downvotes and be stamped as propaganda or parroting propaganda. It's representative for how these companies and their employees view these issues. So it's funny and depressing to see a comment here questioning why a Russian company was allowed to join a program like this after a massive hack by Russian entities, when Russian efforts in this sphere are more than well-documented.
- helsinkiandrew 6y ago
  It is a, presumably successful, billion dollar cyber security company, that did lots of legitimate work too. As were talking about state intelligence agencies, I would guess several of the other 80 companies are also leaking information, either through the company or employees.
helsinkiandrew 6y ago
> But it [Microsoft] also seeks to deflect blame, saying it is customers who do not always make security a priority. > ...Microsoft was itself compromised by the SolarWinds intruders Microsoft need to take responsibility for the security of their products. Vulnerabilities need to be fixed not sent to other companies for add-on virus scanners to detect. Applications shouldn’t be able to run amok with admin passwords. I’d guess a more sandboxed bespoke permission is needed (do you give application x permission to access this part of the file system)
- CyberRage 6y ago
  Windows is a mess. I don't expect it to be any secure in the following years. It is unlikely that non-admin permissions were able to stop the attack. the amount of 0-day EOP's within windows is ridiculous, truly unbelievable.
  - pjmlp 6y ago
    Modern Windows is more secure by default than most GNU/Linux distributions. The only Linux distribution that beats it is Android, with LinuxSE, seccomp, userspace drivers (Treble), hardned access to native code, one user per app and sandbox enabled by default.
    - CyberRage 6y ago
      Respectable linux distros(not just android!) use SE, sandboxing etc. Windows lags far behind OS's like Android, iOS and even ChromeOS when it comes to security.
      - pjmlp 6y ago
        Pity that CVE database proves otherwise. Where are the driver validation tools with a Z3 theorem prover for Linux drivers? Where is the SAL static analysis for C and C++ kernel code like Windows has since XP SP2? Where is the majority of userspace code implemented in managed languages like .NET?
grumpyautist 6y ago
They shouldn't blame Microsoft. They should blame themselves for using microsoft
- tuwtuwtuwtuw 6y ago
  I am not really following the article, somehow I mostly see ads. Not sure if it's some content is missing for me. If you install a piece of software which does monitoring of your IT infrastructure in your servers, and that software has malware in it which collects info it shouldn't, wouldn't you have the same issue regardless of what OS you are using?
  - Craighead 6y ago
    solarwinds exists because of its ability to bridge gaps in Microsoft products more so than any other platform
  - ev1 6y ago
    It's absurd that I have to block hundreds of unwanted, expensive (on mobile data) requests. The page is nearly unreadable without it. https://i.imgur.com/DlCy3J4.png https://i.imgur.com/DlCy3J4.png Several paragraphs of text. WTF?

43 points by mikece 6y ago

> Many security experts believe Microsoft’s single sign-on model, emphasizing user convenience over security, is ripe for retooling to reflect a world where state-backed hackers now routinely run roughshod over U.S. networks. I believe convenience is not coming at the cost of security. SSO certainly has a single-node-failure problem. If it’s down, it causes DoS. If it’s hacked, the hackers can get access to the data user is authorised to view across multiple systems. But given the widespread use of the same passwords across multiple systems, this argument against SSO is weak. Besides that, the convenience of SSO is only for the user. It is for the organisation as well.

soarfourmore 6y ago

> Risks in Microsoft’s foreign dealings also came into relief when the Biden administration imposed sanctions Thursday on a half-dozen Russian IT companies it said support Kremlin hacking. Most prominent was Positive Technologies, which was among more than 80 companies that Microsoft has supplied with early access to data on vulnerabilities detected in its products. Following the sanctions announcement, Microsoft said Positive Tech was no longer in the program and removed its name from a list of participants on its website. What?! Microsoft gave vulnerability data to a Russian company that hacked the USA? Why was that company even in this program to begin with?

Hiopl 6y ago
Isn't it obvious? Tech has a clear blind spot for geopolitics. Saying anything critical of China or Russia, even if well-founded, is a great way to get downvotes and be stamped as propaganda or parroting propaganda. It's representative for how these companies and their employees view these issues. So it's funny and depressing to see a comment here questioning why a Russian company was allowed to join a program like this after a massive hack by Russian entities, when Russian efforts in this sphere are more than well-documented.
helsinkiandrew 6y ago
It is a, presumably successful, billion dollar cyber security company, that did lots of legitimate work too. As were talking about state intelligence agencies, I would guess several of the other 80 companies are also leaking information, either through the company or employees.

helsinkiandrew 6y ago

> But it [Microsoft] also seeks to deflect blame, saying it is customers who do not always make security a priority. > ...Microsoft was itself compromised by the SolarWinds intruders Microsoft need to take responsibility for the security of their products. Vulnerabilities need to be fixed not sent to other companies for add-on virus scanners to detect. Applications shouldn’t be able to run amok with admin passwords. I’d guess a more sandboxed bespoke permission is needed (do you give application x permission to access this part of the file system)

CyberRage 6y ago
Windows is a mess. I don't expect it to be any secure in the following years. It is unlikely that non-admin permissions were able to stop the attack. the amount of 0-day EOP's within windows is ridiculous, truly unbelievable.
- pjmlp 6y ago
  Modern Windows is more secure by default than most GNU/Linux distributions. The only Linux distribution that beats it is Android, with LinuxSE, seccomp, userspace drivers (Treble), hardned access to native code, one user per app and sandbox enabled by default.
  - CyberRage 6y ago
    Respectable linux distros(not just android!) use SE, sandboxing etc. Windows lags far behind OS's like Android, iOS and even ChromeOS when it comes to security.
    - pjmlp 6y ago
      Pity that CVE database proves otherwise. Where are the driver validation tools with a Z3 theorem prover for Linux drivers? Where is the SAL static analysis for C and C++ kernel code like Windows has since XP SP2? Where is the majority of userspace code implemented in managed languages like .NET?

grumpyautist 6y ago

They shouldn't blame Microsoft. They should blame themselves for using microsoft

tuwtuwtuwtuw 6y ago
I am not really following the article, somehow I mostly see ads. Not sure if it's some content is missing for me. If you install a piece of software which does monitoring of your IT infrastructure in your servers, and that software has malware in it which collects info it shouldn't, wouldn't you have the same issue regardless of what OS you are using?
- Craighead 6y ago
  solarwinds exists because of its ability to bridge gaps in Microsoft products more so than any other platform
- ev1 6y ago
  It's absurd that I have to block hundreds of unwanted, expensive (on mobile data) requests. The page is nearly unreadable without it. https://i.imgur.com/DlCy3J4.png https://i.imgur.com/DlCy3J4.png Several paragraphs of text. WTF?