3 ms·
They are doing stuff like that, but it doesn't make for sexy clickbait, so nobody posts it. For example, last week Microsoft released a patch for an exchange se
by hn8788 5y ago
They are doing stuff like that, but it doesn't make for sexy clickbait, so nobody posts it. For example, last week Microsoft released a patch for an exchange server exploit that NSA discovered and reported.
- rtkwe 5y agoThere's also the issue that there's no mechanism to force companies to keep servers up to date or face consequences so it's only possible to really do half the work. Blue teams could find every vulnerability out there but you'd still have companies running old versions or refusing to put out patches to their customers (and customers not updating devices deployed in their home).
- rocqua 5y agoThe mechanism has sort of revealed itself recently, and it is not a net positive: ransomware.
- rtkwe 5y agoTrue enough I guess, though it’s definitely not what I’d pick. Tangentially I wonder why ransomware hasn’t been a thing for longer. Was it an issue of how to do payments that crypto solved?
- rocqua 5y agoThe consensus seems to be that it is crypto making receiving the ransom easier, and Russia (and other jurisdictions) giving ransomware crews free reign. I think the second one might be more important, because it is generally known who the big crews are, and it is actually easy to screw up the opsec on crypto.
- Kalium 5y agoIt's also worth bearing in mind that the Departments of Commerce, Energy, Homeland Security, and Treasury all have efforts to this effect. And as you say, nobody writes articles about how the Department of Energy helped a solar operator figure out a patching strategy. It's boring. Energy effort here: https://www.energy.gov/national-security-safety/cybersecurity https://www.energy.gov/national-security-safety/cybersecurit...
- godelski 5y agoI mean it's HN, I'm happy to read and hear about that stuff. That is the kind of thing I want on the front page here. Also it does mean bad PR on their part. Which that is part of cultural warfare.
- nixpulvis 5y agoWait, blue team gets to take credit for fixing the reports of red team?! This seems like normal old grey programming to me.