6 ms·

US senator blasts Microsoft for “negligent cybersecurity practices”

25 points by pwmtr 3y ago

bediger4000 3y ago
Now, or back circa 1995-2005?
- brad0 3y ago
  > Microsoft’s Threat Intelligence team has said that Storm-0558, a China-based hacking outfit that conducts espionage on behalf of that country’s government, exploited them starting on May 15. Microsoft drove out the attackers on June 16 after a customer tipped off company researchers of the intrusion. By then, Storm-0558 had breached accounts belonging to 25 organizations. Looks like it was a couple of months ago.
brad0 3y ago
> Wyden went on to say some blame also falls on the Biden administration. In 2021 Biden issued an executive order that created a Cyber Safety Review Board and tasked it, among other things, with studying the SolarWinds attack. The SolarWinds review never took place. Microsoft messed up and their key was stolen, wtf does the solarwinds hack have to do with this?
- hulitu 3y ago
  > Microsoft messed up and their key was stolen, wtf does the solarwinds hack have to do with this? Let me guess : Solar Winds used Microsoft ?
notmypenguin 3y ago
I cannot understand how Microsoft products or any proprietary software is acceptable in DOD or National Security provisioning
- _8j50 3y ago
  They have sequestered environmentd for that, check out Fedramp. They basically have their own DC and security requirements met. Every cloud provider has a fedramp version of services. Even the CIA uses this. Cost-benefit analysis wins.
hilbert42 3y ago
Most cyber breaches would stop if governments levied fines of a level commensurate with the breaches. For instance, if companies were fined on a pro rata basis that equaled or exceeded profit from storing people's data then those companies that couldn't guarantee security wouldn't take the risk and get out of the business. If there are objections to this fines model then there are others. It seems to me the real problem with cyber security is lobbying pressure from corporate interests on politicians, hence no appropriate laws with enough deterrent value in place.
- Beached 3y ago
  while I agree that fines for breaches should be more frequent and severe, it's impossible to guarantee security
  - orhmeh09 3y ago
    It's also impossible to guarantee a building won't collapse or a plane won't fall out of the sky. Someone needs to be accountable.
    - bob-09 3y ago
      In Davenport, Iowa, the fine for a building collapse is $300. https://cbs2iowa.com/news/local/owner-of-davenport-apartment-complex-that-collapsed-facing-300-fine https://cbs2iowa.com/news/local/owner-of-davenport-apartment...
    - jstarfish 3y ago
      > It's also impossible to guarantee a building won't collapse or a plane won't fall out of the sky. Breaches aren't random accidents, they're deliberate acts of espionage.
  - hilbert42 3y ago
    "...it's impossible to guarantee security" I agree, but with the right laws in place that have appropriate sanctions that cover both corporations and their employees then we'd see a dramatic reduction. A solution won't be found by just prosecuting corporations alone, for as we've seen with Google, Facebook etc. they've billions at their disposal so fines are just part of the cost of doing business. Their employees also have to be held accountable at the risk of being jailed. Few employees would risk jail just to support corporate profits. Carefully-worded law could make this work without being too punitive. Security breaches will still happen and some unavoidable given the state of art etc. In those circumstances employees who could demonstrate their bona fides etc. would be immune from prosecution. It's a matter of political will, cyber security can be greatly improved if the citizenry wants it badly enough.
Beached 3y ago
so let me get this straight. One of the world's largest targets fell victim to one of the world's largest, best resourced, and practiced state sponsored groups, and they kept the dwell time down to ONLY one month? who the fuck does this senior think he is saying negligent. if they were negligent they would have ignored the tip of, or would not have been able to find them, or not be able to give them the boot with confidence, or not be able to identify scope of impact. if anything, this makes me MORE comfortable storing my shit with MS
DANmode 3y ago
Is this the same Microsoft handling United States primaries?
- _8j50 3y ago
  No
_8j50 3y ago
If you think MS doesn't have bug bounties and more red teaming and appsec auditing than most orgs you'd be mistaken. The fact is, this is victim blaming plain and simple with a logic error (likely) in code that was exploited by a nation state. It was the government who does not retaliate against China. I have seen no evidence of negligence or anything MS could have done better. Or any evidence that similar vulns in gcp iam, okta,etc... isn't possible. Americans are scared shitless of a conflict with China and here you have politicians following suit, blaming MS and Biden for getting attacked instead of finding ways to retaliate -- not in kind but in an escalating, public and humiliating manner. Even if it means seeding an armed conflict. Ask yourself wtf the NSA and CIA are doing other than spying on us and doing their best to help make minorities' lives unpleasant. If the US IC is capable and potent then they are absolutley incompetent by the fact that they keep their exploits secret because they very damn well know how pulic knowledge of a hack affects mass paychology, diplomatic relations and people's confidence in their government. CCP party members should be blaming Xi and tencent for a retaliation instead of our own politicians against our victims.

25 points by pwmtr 3y ago

bediger4000 3y ago

Now, or back circa 1995-2005?

brad0 3y ago
> Microsoft’s Threat Intelligence team has said that Storm-0558, a China-based hacking outfit that conducts espionage on behalf of that country’s government, exploited them starting on May 15. Microsoft drove out the attackers on June 16 after a customer tipped off company researchers of the intrusion. By then, Storm-0558 had breached accounts belonging to 25 organizations. Looks like it was a couple of months ago.

brad0 3y ago

> Wyden went on to say some blame also falls on the Biden administration. In 2021 Biden issued an executive order that created a Cyber Safety Review Board and tasked it, among other things, with studying the SolarWinds attack. The SolarWinds review never took place. Microsoft messed up and their key was stolen, wtf does the solarwinds hack have to do with this?

hulitu 3y ago
> Microsoft messed up and their key was stolen, wtf does the solarwinds hack have to do with this? Let me guess : Solar Winds used Microsoft ?

notmypenguin 3y ago

I cannot understand how Microsoft products or any proprietary software is acceptable in DOD or National Security provisioning

_8j50 3y ago
They have sequestered environmentd for that, check out Fedramp. They basically have their own DC and security requirements met. Every cloud provider has a fedramp version of services. Even the CIA uses this. Cost-benefit analysis wins.

hilbert42 3y ago

Most cyber breaches would stop if governments levied fines of a level commensurate with the breaches. For instance, if companies were fined on a pro rata basis that equaled or exceeded profit from storing people's data then those companies that couldn't guarantee security wouldn't take the risk and get out of the business. If there are objections to this fines model then there are others. It seems to me the real problem with cyber security is lobbying pressure from corporate interests on politicians, hence no appropriate laws with enough deterrent value in place.

Beached 3y ago
while I agree that fines for breaches should be more frequent and severe, it's impossible to guarantee security
- orhmeh09 3y ago
  It's also impossible to guarantee a building won't collapse or a plane won't fall out of the sky. Someone needs to be accountable.
  - bob-09 3y ago
    In Davenport, Iowa, the fine for a building collapse is $300. https://cbs2iowa.com/news/local/owner-of-davenport-apartment-complex-that-collapsed-facing-300-fine https://cbs2iowa.com/news/local/owner-of-davenport-apartment...
  - jstarfish 3y ago
    > It's also impossible to guarantee a building won't collapse or a plane won't fall out of the sky. Breaches aren't random accidents, they're deliberate acts of espionage.
- hilbert42 3y ago
  "...it's impossible to guarantee security" I agree, but with the right laws in place that have appropriate sanctions that cover both corporations and their employees then we'd see a dramatic reduction. A solution won't be found by just prosecuting corporations alone, for as we've seen with Google, Facebook etc. they've billions at their disposal so fines are just part of the cost of doing business. Their employees also have to be held accountable at the risk of being jailed. Few employees would risk jail just to support corporate profits. Carefully-worded law could make this work without being too punitive. Security breaches will still happen and some unavoidable given the state of art etc. In those circumstances employees who could demonstrate their bona fides etc. would be immune from prosecution. It's a matter of political will, cyber security can be greatly improved if the citizenry wants it badly enough.

Beached 3y ago

so let me get this straight. One of the world's largest targets fell victim to one of the world's largest, best resourced, and practiced state sponsored groups, and they kept the dwell time down to ONLY one month? who the fuck does this senior think he is saying negligent. if they were negligent they would have ignored the tip of, or would not have been able to find them, or not be able to give them the boot with confidence, or not be able to identify scope of impact. if anything, this makes me MORE comfortable storing my shit with MS

DANmode 3y ago

Is this the same Microsoft handling United States primaries?

_8j50 3y ago
No

_8j50 3y ago

If you think MS doesn't have bug bounties and more red teaming and appsec auditing than most orgs you'd be mistaken. The fact is, this is victim blaming plain and simple with a logic error (likely) in code that was exploited by a nation state. It was the government who does not retaliate against China. I have seen no evidence of negligence or anything MS could have done better. Or any evidence that similar vulns in gcp iam, okta,etc... isn't possible. Americans are scared shitless of a conflict with China and here you have politicians following suit, blaming MS and Biden for getting attacked instead of finding ways to retaliate -- not in kind but in an escalating, public and humiliating manner. Even if it means seeding an armed conflict. Ask yourself wtf the NSA and CIA are doing other than spying on us and doing their best to help make minorities' lives unpleasant. If the US IC is capable and potent then they are absolutley incompetent by the fact that they keep their exploits secret because they very damn well know how pulic knowledge of a hack affects mass paychology, diplomatic relations and people's confidence in their government. CCP party members should be blaming Xi and tencent for a retaliation instead of our own politicians against our victims.