4 ms·
> that eventually in the right succession result in catastrophic failure. With a caveat that when it comes to security the eventual succession doesn't come as
by rdtsc 3y ago
> that eventually in the right succession result in catastrophic failure.
With a caveat that when it comes to security the eventual succession doesn't come as a random process but will be actively targeted and exploited. The attackers are not random processes flipping coins, rather they can flip a coin that often lands on "heads", in their favor.
The post-mortem results are presented as if events happened as a random set of unfortunate circumstances: the attacker just happened to work for Microsoft, there just happened to be a race condition, and then a crash randomly happened, and then the attacker just happened to find the crash dump somewhere. We should consider even starting with the initial "race condition" bug, that it might have been inserted deliberately. The crash could have been triggered deliberately. An attacker may have been expecting the crash dump to appear in a particular place to grab it. The attacker may have had accomplices.
- ddalex 3y agoThe other frightening possibility is that the attack surface targeted by persistent threat actors is so large that a breach becomes certain (the law of large numbers): when you have so many accounts owned that one of them will have the right access rights; when you have so many dumps one of them will have the key; etc ...
- hulitu 3y ago> the attack surface targeted by persistent threat actors is so large that a breach becomes certain I thought a good security rule was to reduce the attack surface. But ok, we are talking about ... Microsoft. /s
- MichaelZuo 3y agoThis is why for certain things the minimum requirement should not be 99% certain or 99.9% certain, but 99.9999% certain.
- cathalc 3y ago>The post-mortem results are presented as if events happened as a random set of unfortunate circumstances: Public RCAs are nothing more than carefully curated PR stunts to calm customers. You can be sure the internal RCA is a lot more damning.
- rawling 3y ago> The post-mortem results are presented as if events happened as a random set of unfortunate circumstances: the attacker just happened to work for Microsoft Does it say that? > the Storm-0558 actor was able to successfully compromise a Microsoft engineer’s corporate account
- rdtsc 3y agoAh you’re right thanks for the correction.