10 ms·

Microsoft comes under blistering criticism for “grossly irresponsible” security

299 points by WalterSobchak 3y ago

1attice 3y ago
Good. I can't talk about what I saw while working there, but let's just say that I have a nervous tic when someone tells we have a team for security so you need not worry, and when can you have it done by
- esafak 3y ago
  Are there any lessons you can share?
  - 1attice 3y ago
    Yes. If your boss tells you that security isn't your concern as an IC, because other (presumably more specialized) minds are going to be reviewing everything later anyway, try to get transferred. It's not malicious, but the effect is sort of like wearing a blindfold and one hand juggling, throwing things in the air, and presuming that a right hand (a) exists and (b) is not currently holding several other balls. Everyone was super lovely and awesome and smart, but there is (for whatever reason) an attitude that is one of those things that is handled/reviewed by a special team, like accessibility, or HR, or product design, or backups. The thing is, we did have a great security team, it's just that expecting them to have local knowledge of every single line of code is obviously unfair to them, and the idea that you can "do security" on any product just by applying a fixed set of rules somewhere way down the pipeline is to grossly misunderstand how vulns happen and work. Every single IC can and must be on the lookout for vulns. They're vulns. They are literally made out of eyeballs pointed elsewhere. Security is like hygiene: everyone has to wash their own hands after they go, it makes no sense to think that everyone can save time by having a Department of Hand Sanitization.
    - physicles 3y ago
      That’s unfortunate. When I was on windows phone in the late 2000s, every new feature got a round of threat modeling. Each team (pm/test/dev) were responsible for building the threat model themselves, but the threat model was reviewed by another security team. What the hell happened? Is annual security training still a thing?
      - 1attice 3y ago
        There's still annual security training, but it's tapas-model. So basically you have to take N courses by <date>. If you're interested in lockpicking, but your job is in the cloud, you could still meet the requirement by watching a video about lockpicking. (If such a video was offered.) No one follows up, except to ensure that you took enough courses by the given date. Note: My time at this company overlapped heavily with Covid WFH, so things may have been looser/weirder than normal. And regarding threat modelling: I literally have no idea; I was just an IC. All I know is, there were several occasions where delivery cadence was selected for, and in my opinion, on at least some of those occasions, security should have been selected for instead. One charitable explanation is that they'd just threat-modelled my part of the product and decided there weren't any threats there, so there was no need to ease up on the gas pedal. But some threats are subtle, and where you least expect them.
      - Arnavion 3y ago
        >Each team (pm/test/dev) were responsible for building the threat model themselves, but the threat model was reviewed by another security team. That still happens. >Is annual security training still a thing? Yes it is.
ChatGTP 3y ago
Honestly, no one really cares...people will just continue to consume their products as usual. So long as Microsoft has something interesting to offer consumers and business, security will be the last thing people care about. Microsoft has had absolutely terrible security since I've had a computer and it's been heavily criticized the whole time. None of this has stopped their meteoric rise to extreme profitability.
- tormeh 3y ago
  I've realized this about security as well. Unless insurance companies demand higher premiums for choosing Azure, or Azure fails to get certain certifications, then all is well as far as decision-makers are concerned. And this is not even that irrational. Most security issues go unexploited for most companies. Caring about security is IMO a bad business move on average.
  - ChatGTP 3y ago
    After the last Circle CI breach, we were all really annoyed about the way it was handled, IMO It was dishonest and lacked the required transparency for such a breech, we were all quite annoyed and ready to move on, but we've just plugged on using the product like nothing happened. GitHub was similar, they published their freaking private keys accidently, which should raise some major red flags, we're all just going about our business with GitHub. I was down voted hard and fast for my original comment but I'd like to see someone actually disprove my point. I've been in this game way too long to know that almost no security issue matters in the eyes of consumers so long as the company offers decent products and has a great marketing team. I'm ideologically opposed to this lack of inaction and I think you're right, you'd need some type of financial disincentive to change people... Social media itself is a type of privacy breech and people actually openly engage with it.
    - noirbot 3y ago
      Isn't the issue that, if you switch away from a service after an incident, it doesn't necessarily mean that the alternative is going to necessarily be better? GitHub clearly did things poorly, but is Gitlab or Bitbucket better? Or have they just not happened to have messed up publicly yet/recently? Is swapping away just playing musical chairs at high cost to your dev team having to constantly migrate until you've run out of services to migrate to? I don't say this to imply that everyone is equally bad, but to question if is obviously as illogical as you seem to think it is to stick with a company that's had a major security debacle. What certification can you get from another CI vendor about their security procedures that CircleCI wouldn't have given you 2 years ago, or your internal Jenkins team wouldn't have offered?
m463 3y ago
Hasn't microsoft been villainized for poor security since windows first launched? I think this is because of their business model, which is to respond quickly to the market with features, not stability, security or polish. That said, their intrusive data collection is a nightmare.
- ilyt 3y ago
  "Villanized" ? It's not villanizification if it's truty..
  - LargeTomato 3y ago
    The villanizificationery of Microsoft is out of control.
    - inconceivable 3y ago
      i agree, the villainizificationeryzationalism is beyond the pale. truty epical in proportionation.
- a-dub 3y ago
  i was under the impression that they had made massive investments and really turned that around ... or is that ironically only windows? (or just a mistaken impression?)
  - blibble 3y ago
    the same attitude is still there the product only has to be just good enough to get some pointy haired boss to approve the purchase (and he never has to use the software)
  - btilly 3y ago
    They did make massive investments in the mid-2000s on Windows security, and really did turn a lot of things around. But it is a big place. And not everyone gets the memo.
  - 3y ago
whalesalad 3y ago
I can’t imagine choosing Azure and the Microsoft stack for building systems. It’s incomprehensible to me.
- tormeh 3y ago
  It makes sense on an individual level. No one gets fired for buying Microsoft. Maybe they should be, but they won't.
  - blibble 3y ago
    plenty of people have been fired for buying Microsoft Elon Musk was one of them (at what became Paypal)
    - FireBeyond 3y ago
      Musk was fired for digging in and spending months insisting a working MVP written in Java on Solaris be rewritten in Classic ASP on Windows because he knew the latter and not the former, not because of any intrinsic failing of the latter.
- intelVISA 3y ago
  It's a form of self-harm at this point..?
- Gigachad 3y ago
  I worked at a place that used Azure and was told "When Microsoft has a problem, customers understand, its like a natural disaster, can't be avoided. When AWS has a problem customers say 'Huh, what's AWS, fix it now'" I can't remember any outages in the few years I worked there though.
- xnyan 3y ago
  Our company signed a huge 5 year deal with microsoft for azure services just today. We evaluated all major providers for more than a year, Microsoft offered the best terms by far, and we were able to meet all of our needs using it just as well as with AWS or GCP. Honest question, why was the decision wrong? It does not matter to me eather way, I’m just an engineer that was brought in to consult on some aspects of the contract.
OhMeadhbh 3y ago
Many years ago in 2003(?) I interviewed for the role of Security Architect for the Office group (the guys who made Excel, Word, Power Point and (I think) Access.) My resume was reasonably good: I had spent the early 90s doing cryptography at Nortel, RSA (back when they were an engineering company) and Certicom. But I was a software engineer and in the late 90s doing Security Architecture for IBM and "several government agencies you might have heard of." I was REALLY ready to leave DHS at the time so was kind of motivated to bring what I learned about writing secure software to industry. About this time there was a "security stand-down" going down at MSFT in part because several federal customers LITERALLY had to solicit an ACT OF CONGRESS in order to continue to use Win2K (or an early version of XP) with all it's known security flaws. Do not ask me about the version of Win2K in nuclear submarines. (Really. Don't ask me. That was someone else's project. I really don't know anything about it other than the rumors that were swirling around BlackHat.) So here I am, coming in as some guy who's hip to secure software development and tools and how to convince devs to do the right thing re: security even though they're under a deadline. My third interview of the day was this guy who supposedly wrote Excel and was the "third highest ranking coder in all of MSFT" (not Simonyi, I would have recognized him.) And his first question was "So... how's your QA skills?" This isn't what I'm thinking I'm interviewing for, so I say "Pardon?" and he replies... "This security thing is bullshit. Bill's going to eventually realize it's bullshit and in a couple months we'll go back to writing software the same way we used to. So I'm going to have to find a job for you and I'm thinking QA; that's the same thing as security." I did not get that job. I believe Michael Howard or Dave Leblanc got it. They went on to write a pretty decent book about secure product development and if you're a microsoft shop and have heard of the Secure Development Lifecycle, it's largely because of Michael and Dave. (Don't worry, I was fine. I went on to work at Handspring and PalmSource and a bunch of enterprisey dev shops that were hip to the idea of developing secure code. And my life was probably filled with fewer headaches than anyone at MSFT.) But... I remembered that interaction. Microsoft keeps saying "oh yeah! we're big on security!" And in many ways they are. MSVC (or DevStudio or .NET whizbang or whatever they call it now) have several very cool fuzzing and analysis tools. I've heard the Azure group is better about security than they were, though that's rather a low bar. I feel for them since they have a metric boat-load of legacy code and a development methodology that sort of guarantees failure. They are also the strangest and most conceited group of developers I've met (with the possible exception of Amazon or Facebook or Netflix.) Come to think of it... what the heck is it about these FAANG companies? I bet I'm just meeting the duds. There have GOT to be decent developers in there somewhere. They're all HUGE dev organizations and I appreciate how difficult it is to get that many developers pointing in the same direction at the same time. But at the end of the day, MSFT has a culture that really doesn't care about security. Or at least that's my take on it. I'm sure there are plenty of places in Redmond where people care about writing code that isn't buggy or vulnerable. But it's 20 years later and it still hasn't spread far enough. So it goes.
falsandtru 3y ago
> He also faulted Microsoft for waiting five years to refresh the signing key abused in the attacks Too long.
- falsandtru 3y ago
  I'm really surprised that anyone downvoted this comment.
insanitybit 3y ago
TBH the issues that I've seen with Azure are pretty shocking. Like "I don't believe anyone did a basic pentest against that system even once" levels of shocking. That's insane for a company the size of Microsoft. These vulns are cross tenancy violations, which, again, is insane. That's as bad as it gets for the cloud. > This incident demonstrates the evolving challenges of cybersecurity in the face of sophisticated attacks. The insane thing is that some of these vulns are as easy to discover as just running nmap. I'm sort of shocked that people haven't run into them accidentally. Hardly sophisticated. I'm not trusting Azure with shit.
- deleted 3y ago
  [deleted]
- midoridensha 3y ago
  >That's insane for a company the size of Microsoft. Why? Why does company size have anything at all to do with the security of their product? Microsoft has been making shoddy, horribly insecure products for decades now. Do you need me to list all the email viruses and other such things that were running rampant in the 90s and 2000s? What's truly insane is that people keep expecting Microsoft to do better, and then being disappointed when they don't. The common saying is "the definition of insanity is doing the same thing and expecting a different result", and that's exactly what most people do in regards to Microsoft and product quality or security.
  - insanitybit 3y ago
    > Why? Why does company size have anything at all to do with the security of their product? Because they have a massive security team. Size has a lot to do with security. > What's truly insane is that people keep expecting Microsoft to do better, and then being disappointed when they don't. Microsoft has done a ton of impressive security work when it comes to Windows, they've really stepped up their game. They've invested quite heavily.
    - devwastaken 3y ago
nerdjon 3y ago
Something that bothers me a bit more about this, I feel like I have not really heard about many of these issues while thinking that I have been doing a decent job of staying on top of things like this by paying attention to hacker news. Does Azure things just not filter up as much as I would expect or did I just happen to miss them? It isn't like Azure is just ignored in the industry, time and time again I see it billed as the "non amazon aws" for companies that don't want to support AWS due to Amazon. I feel like I hear more about GCloud issues than I do Azure issues which is concerning given how little GCloud is used even compared to Azure.
- luckydata 3y ago
  GCloud is probably used MORE than Azure. Microsoft has a lot of stuff that's not cloud in their revenue to make it look bigger. Leaked numbers show GCloud revenue are actually about even with Azure. https://www.cnbc.com/2022/12/21/google-leaked-doc-microsoft-azure-losing-money-on-29-bln-in-revenue.html https://www.cnbc.com/2022/12/21/google-leaked-doc-microsoft-...
  - jzebedee 3y ago
    This doesn't come close to the actual market share you'll find in the likes of Gartner or others. The cloud landscape has long been AWS, Azure, and GCloud as a distant third.
    - luckydata 3y ago
      did you read the article?
      - jzebedee 3y ago
        Yes, and it amounts to a puff piece for GCloud. "We don't think we're as far behind as everyone else does" is not a compelling argument. Google is only too happy to believe Gartner rankings when it's in their favor [1]. [1] https://cloud.google.com/blog/products/infrastructure/google-a-leader-in-gartner-magic-quadrant-for-cloud-infrastructure-and-platform-services https://cloud.google.com/blog/products/infrastructure/google...
1vuio0pswjnm7 3y ago
https://traffic.megaphone.fm/RFEI6083180368.mp3?updated=1690839584 https://traffic.megaphone.fm/RFEI6083180368.mp3?updated=1690... Listening to the cybersecurity person interviewed here play down the significance, one is left to possibly believe cybersecurity folks rely on Microsoft to keep them employed. According to this podcast, the only reason the government discovered this breach is because they were paying Microsoft for the "privilege" to see who was accessing their email. Most customers were not paying thus would never have discovered similar unwanted access. If charging for this transparency is a "business model", as the podcast suggests, and there were only a relatively small number of "customers", it really makes one wonder. How much money were they making from this "business model".
excalibur 3y ago
Noticed that, did you?
jrm4 3y ago
Well that's about 20 years late, but okay :)
Animats 3y ago
Amit Yoran, right again. He was once head of computer security for Homeland Security, and become unpopular for pointing out that Microsoft was the problem.
Eisenstein 3y ago
> The senator went on to pin blame on Microsoft for the recent mass breach of the Departments of State and Commerce and the other Azure customers. Specific failings, Wyden said, included Microsoft having “a single skeleton key that, when inevitably stolen, could be used to forge access to different customers’ private communications.” > "Microsoft’s engineers should never have deployed systems that violated such basic cybersecurity principles" I hope someone quotes this line back when they inevitably introduce a 'we want a backdoor to encryption' legislation.
- philsnow 3y ago
  What does "forge access" even mean? I would have said "gain access". Although, even worse, the private key could likely have been used to actually forge communications from those parties.
jquast 3y ago
How much of Azure infrastructure is managed by Windows? Are they using their own operating systems, hardware devices, drivers, firmware blobs and tools, or are they struggling like everyone else to glue all that FOSS together securely?
- Too 3y ago
  Some of it uses this https://en.m.wikipedia.org/wiki/CBL-Mariner https://en.m.wikipedia.org/wiki/CBL-Mariner. The rest is likely a crazy mix of Windows, Linux and other home built tools.
  - yencabulator 3y ago
    CBL is a mix of Linux and Microsoft home built tools.
- jiggawatts 3y ago
  It’s a mix. A lot of their PaaS services are Microsoft Service Fabric under the hood, running on Windows Server. This is vaguely like Kubernetes but worse. So for example they can’t do zone affinity for traffic routing, so all of their zone-redundant traffic ping-pongs between data centres like crazy. If you use just a couple of layers of their services like private endpoints and app gateway, you can expect to see 15ms response times.
  - aoetalks 3y ago
    You can do zone affinity with service fabric. It’s difficult, but not impossible.
    - jiggawatts 3y ago
      Granted, but none of the Azure services do that. It’s like the difference between someone that is illiterate and someone that never reads anything.
cookiengineer 3y ago
Honestly I don't understand how any company can rely on Microsoft for security, and how they can get away with blaming their customers so often. You can literally kerberoast Azure AD by default, and that's a known to be used in the wild attack vector since 2014. In a cloud service. Today. Spammers literally rent Azure VMs because they know that the IP range of azure is not processed by Outlooks/Exchanges email filters. So often researchers did the right thing and disclosed everything correctly just to get Microsoft to say "oh yeah here is another RCE, but we don't give a damn. Oh, and there is no patch either." It's just so ridiculous. There's even unfixed RCEs of VBA from the Office 2013 days which still work, because the mentality of never touch a running software creeped into how Office is built (which is: have a literal copy of all outdated Office versions for the sake of compatibility). And then people wonder why "Hackers" always say that Microsoft is insecure and why ISO27001 is now a google dork to find easy to hack victims.
- dhab 3y ago
  I am compiling these as a case against adoption of Microsoft Can anyone provide references for these proving their current existence?
deleted 3y ago
[deleted]
warrenm 3y ago
Wonder how this headline and article jives with Azure achieving FedRAMP statuses, DoD IL5, and other security certifications? If Azure is as bad as this article makes them sound, does that mean most major security certifications are also as pointless they look from the outside? Like the pointless ISO 9001 certification - which only states "we have a process; here's the process; we follow the process; we don't deviate from the process"?
- yencabulator 3y ago
  As someone who's worked on obtaining Common Criteria and FIPS certifications, I fully believe security certifications have little to do with security. Especially if you don't carefully read the definition of Security Target therein; that part is very much like the arbitrary process in your ISO 9001 mention.
johnea 3y ago
Nice to see the legislators catching up to decades old news: https://www.pressenterprise.com/2015/06/10/cartoons-broken-windows-and-us-cybersecurity/ https://www.pressenterprise.com/2015/06/10/cartoons-broken-w...

299 points by WalterSobchak 3y ago

Good. I can't talk about what I saw while working there, but let's just say that I have a nervous tic when someone tells we have a team for security so you need not worry, and when can you have it done by

esafak 3y ago
Are there any lessons you can share?
- 1attice 3y ago
  Yes. If your boss tells you that security isn't your concern as an IC, because other (presumably more specialized) minds are going to be reviewing everything later anyway, try to get transferred. It's not malicious, but the effect is sort of like wearing a blindfold and one hand juggling, throwing things in the air, and presuming that a right hand (a) exists and (b) is not currently holding several other balls. Everyone was super lovely and awesome and smart, but there is (for whatever reason) an attitude that is one of those things that is handled/reviewed by a special team, like accessibility, or HR, or product design, or backups. The thing is, we did have a great security team, it's just that expecting them to have local knowledge of every single line of code is obviously unfair to them, and the idea that you can "do security" on any product just by applying a fixed set of rules somewhere way down the pipeline is to grossly misunderstand how vulns happen and work. Every single IC can and must be on the lookout for vulns. They're vulns. They are literally made out of eyeballs pointed elsewhere. Security is like hygiene: everyone has to wash their own hands after they go, it makes no sense to think that everyone can save time by having a Department of Hand Sanitization.
  - physicles 3y ago
    That’s unfortunate. When I was on windows phone in the late 2000s, every new feature got a round of threat modeling. Each team (pm/test/dev) were responsible for building the threat model themselves, but the threat model was reviewed by another security team. What the hell happened? Is annual security training still a thing?
    - 1attice 3y ago
      There's still annual security training, but it's tapas-model. So basically you have to take N courses by <date>. If you're interested in lockpicking, but your job is in the cloud, you could still meet the requirement by watching a video about lockpicking. (If such a video was offered.) No one follows up, except to ensure that you took enough courses by the given date. Note: My time at this company overlapped heavily with Covid WFH, so things may have been looser/weirder than normal. And regarding threat modelling: I literally have no idea; I was just an IC. All I know is, there were several occasions where delivery cadence was selected for, and in my opinion, on at least some of those occasions, security should have been selected for instead. One charitable explanation is that they'd just threat-modelled my part of the product and decided there weren't any threats there, so there was no need to ease up on the gas pedal. But some threats are subtle, and where you least expect them.
    - Arnavion 3y ago
      >Each team (pm/test/dev) were responsible for building the threat model themselves, but the threat model was reviewed by another security team. That still happens. >Is annual security training still a thing? Yes it is.

ChatGTP 3y ago

Honestly, no one really cares...people will just continue to consume their products as usual. So long as Microsoft has something interesting to offer consumers and business, security will be the last thing people care about. Microsoft has had absolutely terrible security since I've had a computer and it's been heavily criticized the whole time. None of this has stopped their meteoric rise to extreme profitability.

tormeh 3y ago
I've realized this about security as well. Unless insurance companies demand higher premiums for choosing Azure, or Azure fails to get certain certifications, then all is well as far as decision-makers are concerned. And this is not even that irrational. Most security issues go unexploited for most companies. Caring about security is IMO a bad business move on average.
- ChatGTP 3y ago
  After the last Circle CI breach, we were all really annoyed about the way it was handled, IMO It was dishonest and lacked the required transparency for such a breech, we were all quite annoyed and ready to move on, but we've just plugged on using the product like nothing happened. GitHub was similar, they published their freaking private keys accidently, which should raise some major red flags, we're all just going about our business with GitHub. I was down voted hard and fast for my original comment but I'd like to see someone actually disprove my point. I've been in this game way too long to know that almost no security issue matters in the eyes of consumers so long as the company offers decent products and has a great marketing team. I'm ideologically opposed to this lack of inaction and I think you're right, you'd need some type of financial disincentive to change people... Social media itself is a type of privacy breech and people actually openly engage with it.
  - noirbot 3y ago
    Isn't the issue that, if you switch away from a service after an incident, it doesn't necessarily mean that the alternative is going to necessarily be better? GitHub clearly did things poorly, but is Gitlab or Bitbucket better? Or have they just not happened to have messed up publicly yet/recently? Is swapping away just playing musical chairs at high cost to your dev team having to constantly migrate until you've run out of services to migrate to? I don't say this to imply that everyone is equally bad, but to question if is obviously as illogical as you seem to think it is to stick with a company that's had a major security debacle. What certification can you get from another CI vendor about their security procedures that CircleCI wouldn't have given you 2 years ago, or your internal Jenkins team wouldn't have offered?

m463 3y ago

Hasn't microsoft been villainized for poor security since windows first launched? I think this is because of their business model, which is to respond quickly to the market with features, not stability, security or polish. That said, their intrusive data collection is a nightmare.

ilyt 3y ago
"Villanized" ? It's not villanizification if it's truty..
- LargeTomato 3y ago
  The villanizificationery of Microsoft is out of control.
  - inconceivable 3y ago
    i agree, the villainizificationeryzationalism is beyond the pale. truty epical in proportionation.
a-dub 3y ago
i was under the impression that they had made massive investments and really turned that around ... or is that ironically only windows? (or just a mistaken impression?)
- blibble 3y ago
  the same attitude is still there the product only has to be just good enough to get some pointy haired boss to approve the purchase (and he never has to use the software)
- btilly 3y ago
  They did make massive investments in the mid-2000s on Windows security, and really did turn a lot of things around. But it is a big place. And not everyone gets the memo.
- 3y ago

whalesalad 3y ago

I can’t imagine choosing Azure and the Microsoft stack for building systems. It’s incomprehensible to me.

tormeh 3y ago
It makes sense on an individual level. No one gets fired for buying Microsoft. Maybe they should be, but they won't.
- blibble 3y ago
  plenty of people have been fired for buying Microsoft Elon Musk was one of them (at what became Paypal)
  - FireBeyond 3y ago
    Musk was fired for digging in and spending months insisting a working MVP written in Java on Solaris be rewritten in Classic ASP on Windows because he knew the latter and not the former, not because of any intrinsic failing of the latter.
intelVISA 3y ago
It's a form of self-harm at this point..?
Gigachad 3y ago
I worked at a place that used Azure and was told "When Microsoft has a problem, customers understand, its like a natural disaster, can't be avoided. When AWS has a problem customers say 'Huh, what's AWS, fix it now'" I can't remember any outages in the few years I worked there though.
xnyan 3y ago
Our company signed a huge 5 year deal with microsoft for azure services just today. We evaluated all major providers for more than a year, Microsoft offered the best terms by far, and we were able to meet all of our needs using it just as well as with AWS or GCP. Honest question, why was the decision wrong? It does not matter to me eather way, I’m just an engineer that was brought in to consult on some aspects of the contract.

OhMeadhbh 3y ago

Many years ago in 2003(?) I interviewed for the role of Security Architect for the Office group (the guys who made Excel, Word, Power Point and (I think) Access.) My resume was reasonably good: I had spent the early 90s doing cryptography at Nortel, RSA (back when they were an engineering company) and Certicom. But I was a software engineer and in the late 90s doing Security Architecture for IBM and "several government agencies you might have heard of." I was REALLY ready to leave DHS at the time so was kind of motivated to bring what I learned about writing secure software to industry. About this time there was a "security stand-down" going down at MSFT in part because several federal customers LITERALLY had to solicit an ACT OF CONGRESS in order to continue to use Win2K (or an early version of XP) with all it's known security flaws. Do not ask me about the version of Win2K in nuclear submarines. (Really. Don't ask me. That was someone else's project. I really don't know anything about it other than the rumors that were swirling around BlackHat.) So here I am, coming in as some guy who's hip to secure software development and tools and how to convince devs to do the right thing re: security even though they're under a deadline. My third interview of the day was this guy who supposedly wrote Excel and was the "third highest ranking coder in all of MSFT" (not Simonyi, I would have recognized him.) And his first question was "So... how's your QA skills?" This isn't what I'm thinking I'm interviewing for, so I say "Pardon?" and he replies... "This security thing is bullshit. Bill's going to eventually realize it's bullshit and in a couple months we'll go back to writing software the same way we used to. So I'm going to have to find a job for you and I'm thinking QA; that's the same thing as security." I did not get that job. I believe Michael Howard or Dave Leblanc got it. They went on to write a pretty decent book about secure product development and if you're a microsoft shop and have heard of the Secure Development Lifecycle, it's largely because of Michael and Dave. (Don't worry, I was fine. I went on to work at Handspring and PalmSource and a bunch of enterprisey dev shops that were hip to the idea of developing secure code. And my life was probably filled with fewer headaches than anyone at MSFT.) But... I remembered that interaction. Microsoft keeps saying "oh yeah! we're big on security!" And in many ways they are. MSVC (or DevStudio or .NET whizbang or whatever they call it now) have several very cool fuzzing and analysis tools. I've heard the Azure group is better about security than they were, though that's rather a low bar. I feel for them since they have a metric boat-load of legacy code and a development methodology that sort of guarantees failure. They are also the strangest and most conceited group of developers I've met (with the possible exception of Amazon or Facebook or Netflix.) Come to think of it... what the heck is it about these FAANG companies? I bet I'm just meeting the duds. There have GOT to be decent developers in there somewhere. They're all HUGE dev organizations and I appreciate how difficult it is to get that many developers pointing in the same direction at the same time. But at the end of the day, MSFT has a culture that really doesn't care about security. Or at least that's my take on it. I'm sure there are plenty of places in Redmond where people care about writing code that isn't buggy or vulnerable. But it's 20 years later and it still hasn't spread far enough. So it goes.

falsandtru 3y ago

> He also faulted Microsoft for waiting five years to refresh the signing key abused in the attacks Too long.

falsandtru 3y ago
I'm really surprised that anyone downvoted this comment.

insanitybit 3y ago

TBH the issues that I've seen with Azure are pretty shocking. Like "I don't believe anyone did a basic pentest against that system even once" levels of shocking. That's insane for a company the size of Microsoft. These vulns are cross tenancy violations, which, again, is insane. That's as bad as it gets for the cloud. > This incident demonstrates the evolving challenges of cybersecurity in the face of sophisticated attacks. The insane thing is that some of these vulns are as easy to discover as just running nmap. I'm sort of shocked that people haven't run into them accidentally. Hardly sophisticated. I'm not trusting Azure with shit.

deleted 3y ago
[deleted]
midoridensha 3y ago
>That's insane for a company the size of Microsoft. Why? Why does company size have anything at all to do with the security of their product? Microsoft has been making shoddy, horribly insecure products for decades now. Do you need me to list all the email viruses and other such things that were running rampant in the 90s and 2000s? What's truly insane is that people keep expecting Microsoft to do better, and then being disappointed when they don't. The common saying is "the definition of insanity is doing the same thing and expecting a different result", and that's exactly what most people do in regards to Microsoft and product quality or security.
- insanitybit 3y ago
  > Why? Why does company size have anything at all to do with the security of their product? Because they have a massive security team. Size has a lot to do with security. > What's truly insane is that people keep expecting Microsoft to do better, and then being disappointed when they don't. Microsoft has done a ton of impressive security work when it comes to Windows, they've really stepped up their game. They've invested quite heavily.
  - devwastaken 3y ago

nerdjon 3y ago

Something that bothers me a bit more about this, I feel like I have not really heard about many of these issues while thinking that I have been doing a decent job of staying on top of things like this by paying attention to hacker news. Does Azure things just not filter up as much as I would expect or did I just happen to miss them? It isn't like Azure is just ignored in the industry, time and time again I see it billed as the "non amazon aws" for companies that don't want to support AWS due to Amazon. I feel like I hear more about GCloud issues than I do Azure issues which is concerning given how little GCloud is used even compared to Azure.

luckydata 3y ago
GCloud is probably used MORE than Azure. Microsoft has a lot of stuff that's not cloud in their revenue to make it look bigger. Leaked numbers show GCloud revenue are actually about even with Azure. https://www.cnbc.com/2022/12/21/google-leaked-doc-microsoft-azure-losing-money-on-29-bln-in-revenue.html https://www.cnbc.com/2022/12/21/google-leaked-doc-microsoft-...
- jzebedee 3y ago
  This doesn't come close to the actual market share you'll find in the likes of Gartner or others. The cloud landscape has long been AWS, Azure, and GCloud as a distant third.
  - luckydata 3y ago
    did you read the article?
    - jzebedee 3y ago
      Yes, and it amounts to a puff piece for GCloud. "We don't think we're as far behind as everyone else does" is not a compelling argument. Google is only too happy to believe Gartner rankings when it's in their favor [1]. [1] https://cloud.google.com/blog/products/infrastructure/google-a-leader-in-gartner-magic-quadrant-for-cloud-infrastructure-and-platform-services https://cloud.google.com/blog/products/infrastructure/google...

1vuio0pswjnm7 3y ago

https://traffic.megaphone.fm/RFEI6083180368.mp3?updated=1690839584 https://traffic.megaphone.fm/RFEI6083180368.mp3?updated=1690... Listening to the cybersecurity person interviewed here play down the significance, one is left to possibly believe cybersecurity folks rely on Microsoft to keep them employed. According to this podcast, the only reason the government discovered this breach is because they were paying Microsoft for the "privilege" to see who was accessing their email. Most customers were not paying thus would never have discovered similar unwanted access. If charging for this transparency is a "business model", as the podcast suggests, and there were only a relatively small number of "customers", it really makes one wonder. How much money were they making from this "business model".

excalibur 3y ago

Noticed that, did you?

jrm4 3y ago

Well that's about 20 years late, but okay :)

Animats 3y ago

Amit Yoran, right again. He was once head of computer security for Homeland Security, and become unpopular for pointing out that Microsoft was the problem.

Eisenstein 3y ago

> The senator went on to pin blame on Microsoft for the recent mass breach of the Departments of State and Commerce and the other Azure customers. Specific failings, Wyden said, included Microsoft having “a single skeleton key that, when inevitably stolen, could be used to forge access to different customers’ private communications.” > "Microsoft’s engineers should never have deployed systems that violated such basic cybersecurity principles" I hope someone quotes this line back when they inevitably introduce a 'we want a backdoor to encryption' legislation.

philsnow 3y ago
What does "forge access" even mean? I would have said "gain access". Although, even worse, the private key could likely have been used to actually forge communications from those parties.

jquast 3y ago

How much of Azure infrastructure is managed by Windows? Are they using their own operating systems, hardware devices, drivers, firmware blobs and tools, or are they struggling like everyone else to glue all that FOSS together securely?

Too 3y ago
Some of it uses this https://en.m.wikipedia.org/wiki/CBL-Mariner https://en.m.wikipedia.org/wiki/CBL-Mariner. The rest is likely a crazy mix of Windows, Linux and other home built tools.
- yencabulator 3y ago
  CBL is a mix of Linux and Microsoft home built tools.
jiggawatts 3y ago
It’s a mix. A lot of their PaaS services are Microsoft Service Fabric under the hood, running on Windows Server. This is vaguely like Kubernetes but worse. So for example they can’t do zone affinity for traffic routing, so all of their zone-redundant traffic ping-pongs between data centres like crazy. If you use just a couple of layers of their services like private endpoints and app gateway, you can expect to see 15ms response times.
- aoetalks 3y ago
  You can do zone affinity with service fabric. It’s difficult, but not impossible.
  - jiggawatts 3y ago
    Granted, but none of the Azure services do that. It’s like the difference between someone that is illiterate and someone that never reads anything.

cookiengineer 3y ago

Honestly I don't understand how any company can rely on Microsoft for security, and how they can get away with blaming their customers so often. You can literally kerberoast Azure AD by default, and that's a known to be used in the wild attack vector since 2014. In a cloud service. Today. Spammers literally rent Azure VMs because they know that the IP range of azure is not processed by Outlooks/Exchanges email filters. So often researchers did the right thing and disclosed everything correctly just to get Microsoft to say "oh yeah here is another RCE, but we don't give a damn. Oh, and there is no patch either." It's just so ridiculous. There's even unfixed RCEs of VBA from the Office 2013 days which still work, because the mentality of never touch a running software creeped into how Office is built (which is: have a literal copy of all outdated Office versions for the sake of compatibility). And then people wonder why "Hackers" always say that Microsoft is insecure and why ISO27001 is now a google dork to find easy to hack victims.

dhab 3y ago
I am compiling these as a case against adoption of Microsoft Can anyone provide references for these proving their current existence?

deleted 3y ago

[deleted]

warrenm 3y ago

Wonder how this headline and article jives with Azure achieving FedRAMP statuses, DoD IL5, and other security certifications? If Azure is as bad as this article makes them sound, does that mean most major security certifications are also as pointless they look from the outside? Like the pointless ISO 9001 certification - which only states "we have a process; here's the process; we follow the process; we don't deviate from the process"?

yencabulator 3y ago
As someone who's worked on obtaining Common Criteria and FIPS certifications, I fully believe security certifications have little to do with security. Especially if you don't carefully read the definition of Security Target therein; that part is very much like the arbitrary process in your ISO 9001 mention.

johnea 3y ago

Nice to see the legislators catching up to decades old news: https://www.pressenterprise.com/2015/06/10/cartoons-broken-windows-and-us-cybersecurity/ https://www.pressenterprise.com/2015/06/10/cartoons-broken-w...