4 ms·

Does Microsoft offer favourable treatment or withhold patches when it comes to state level APTs? Can we trust Microsoft to be neutral and offer security patches

by melony 5y ago

Does Microsoft offer favourable treatment or withhold patches when it comes to state level APTs? Can we trust Microsoft to be neutral and offer security patches in a timely manner and defend the interests of their consumer customers above all? With the whole conflict in Europe, the issue of state level adversaries is raring its head again.

inglor 5y ago
Not the opinion of my employer but: no. A state level attacker can likely acquire 0-day exploits that are not patched and bypass defenses. Microsoft's offering does some really cool stuff like: - Automatically detecting anomalous behavior in the network and isolating suspected devices/ips/machines/programs. - Have real time security engineers constantly monitoring your network and hunting attackers and suspicious activity. - Tools that automatically isolate possible attackers and help measure the impact of attacks. > Can we trust Microsoft to be neutral and offer security patches in a timely manner Yes, that for sure. Once an exploit is discovered it is typically very quickly identified. A lot of the times security patches don't come from Microsoft though - if you consider something like Log4Shell (the Log4J vulnerability) for example. > defend the interests of their consumer customers above all? I'm... not sure about "above all" since I am not sure what "all" is but if the implication is that Microsoft won't patch a security flaw for a state level APT then "yes". At least - if it ever happened it happened _way_ above my pay grade and if employees would learn of it there would be outrage. > With the whole conflict in Europe, the issue of state level adversaries is raring its head again. I think state level actors have consistently been a problem. Note again as already mentioned none of this represents the opinion of my employer, just my thoughts.
- KennyBlanken 5y ago
  > I'm... not sure about "above all" since I am not sure what "all" is but if the implication is that Microsoft won't patch a security flaw for a state level APT then "yes". At least - if it ever happened it happened _way_ above my pay grade and if employees would learn of it there would be outrage. cough NSAKEY cough Provided a backdoor for state security forces. Did it in NT, and then even after they were caught, did it again in Win2k. You underestimate people's moral flexibility, especially that of "patriots."
  - ChrisLomont 5y ago
    My reply above to your NSAKEY stuff applies here too.
autoexec 5y ago
You have to assume that the state is collecting every scrap of data that MS gets from telemetry. I'm sure MS is collecting a ton of data for themselves as well. As much as the company line might say that PI is scrubbed we know anonymization is a joke, and PI isn't limited to names and credit card numbers. You can learn a lot about a person by the contents of their Prefetch folder, their Steam folder, their internet history, the amount of *.h *.c *.py files are on their drive and how often they are updated etc. I'm sure on enterprise systems MS is pretty hands off. They've got a very stable cash cow there they don't want to scare away, but home users are probably screwed and you should expect that. MS has been making their opinion of their user's right to privacy and to control what their own computer very clear over the years. They've repeatedly demonstrated a willingness to leverage their OS against the users and their wishes for power and profit. Act accordingly.
- ForOldHack 5y ago
  LTSC. Long Term Support Channel. Anti-telemetry anyway.
  - autoexec 5y ago
    Even with LTSC you can't disable all telemetry, It could have been a great (and very popular) option for companies (even though it wouldn't help home users), but MS didn't want that and discouraged its use in everything but the most extreme cases (https://www.computerworld.com/article/3326065/microsoft-trash-talks-windows-10-ltsc-again.html https://www.computerworld.com/article/3326065/microsoft-tras...) even before they cut support to 5 years instead of 10. Maybe things will be better with windows 11?

by melony 5y ago

inglor 5y ago

Not the opinion of my employer but: no. A state level attacker can likely acquire 0-day exploits that are not patched and bypass defenses. Microsoft's offering does some really cool stuff like: - Automatically detecting anomalous behavior in the network and isolating suspected devices/ips/machines/programs. - Have real time security engineers constantly monitoring your network and hunting attackers and suspicious activity. - Tools that automatically isolate possible attackers and help measure the impact of attacks. > Can we trust Microsoft to be neutral and offer security patches in a timely manner Yes, that for sure. Once an exploit is discovered it is typically very quickly identified. A lot of the times security patches don't come from Microsoft though - if you consider something like Log4Shell (the Log4J vulnerability) for example. > defend the interests of their consumer customers above all? I'm... not sure about "above all" since I am not sure what "all" is but if the implication is that Microsoft won't patch a security flaw for a state level APT then "yes". At least - if it ever happened it happened _way_ above my pay grade and if employees would learn of it there would be outrage. > With the whole conflict in Europe, the issue of state level adversaries is raring its head again. I think state level actors have consistently been a problem. Note again as already mentioned none of this represents the opinion of my employer, just my thoughts.

KennyBlanken 5y ago
> I'm... not sure about "above all" since I am not sure what "all" is but if the implication is that Microsoft won't patch a security flaw for a state level APT then "yes". At least - if it ever happened it happened _way_ above my pay grade and if employees would learn of it there would be outrage. cough NSAKEY cough Provided a backdoor for state security forces. Did it in NT, and then even after they were caught, did it again in Win2k. You underestimate people's moral flexibility, especially that of "patriots."
- ChrisLomont 5y ago
  My reply above to your NSAKEY stuff applies here too.

autoexec 5y ago

You have to assume that the state is collecting every scrap of data that MS gets from telemetry. I'm sure MS is collecting a ton of data for themselves as well. As much as the company line might say that PI is scrubbed we know anonymization is a joke, and PI isn't limited to names and credit card numbers. You can learn a lot about a person by the contents of their Prefetch folder, their Steam folder, their internet history, the amount of *.h *.c *.py files are on their drive and how often they are updated etc. I'm sure on enterprise systems MS is pretty hands off. They've got a very stable cash cow there they don't want to scare away, but home users are probably screwed and you should expect that. MS has been making their opinion of their user's right to privacy and to control what their own computer very clear over the years. They've repeatedly demonstrated a willingness to leverage their OS against the users and their wishes for power and profit. Act accordingly.

ForOldHack 5y ago
LTSC. Long Term Support Channel. Anti-telemetry anyway.
- autoexec 5y ago
  Even with LTSC you can't disable all telemetry, It could have been a great (and very popular) option for companies (even though it wouldn't help home users), but MS didn't want that and discouraged its use in everything but the most extreme cases (https://www.computerworld.com/article/3326065/microsoft-trash-talks-windows-10-ltsc-again.html https://www.computerworld.com/article/3326065/microsoft-tras...) even before they cut support to 5 years instead of 10. Maybe things will be better with windows 11?