5 ms·

State actor blamed for cyberattack on B.C. government systems

45 points by allannienhuis 2y ago

deleted 2y ago
[deleted]
qp11 2y ago
Microsoft is looking like the next Boeing for anyone paying attention to the attacks in the last couple years. End result of limitless greed. No TikTok or Snowden required, just the fantastic Microsoft software stack. They can't even protect themselves - https://www.crn.com/news/security/2024/microsoft-says-senior-executives-hacked-by-russian-group https://www.crn.com/news/security/2024/microsoft-says-senior...
- nox101 2y ago
  Is that really fair? We had the xz thing recently, that was open source. I'm not saying MS isn't the worst. But there are plenty of linux exploits. An expert IT person might keep that up to date but your average business, government agency, hospital is not up to it.
  - ahiknsr 2y ago
    https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review_of_the_Summer_2023_MEO_Intrusion_Final_508c.pdf https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review... > The Board concludes that Microsoft’s security culture was inadequate. The Board reaches this conclusion based on: > Microsoft’s failure to detect the compromise of its cryptographic crown jewels on its own, relying instead on a customer to reach out to identify anomalies the customer had observed > Microsoft’s failure to detect a compromise of an employee’s laptop from a recently acquired company prior to allowing it to connect to Microsoft’s corporate network in 2021
    - nox101 2y ago
      I'm not sure what your point is except when it's Windows their is a single company to blame vs when it's linux there are only random contributors from all over https://www.google.com/search?q=site%3Acisa.gov+linux+security+exploit https://www.google.com/search?q=site%3Acisa.gov+linux+securi...
      - ahiknsr 2y ago
        Do you not understand the difference between Microsoft and Windows?
        nox101 2y ago
        I'm comparing two OSes and pointing out when one OS has issues there's a single source to point a finger at. When the other OS has just as many or similar issues there is no one to point a finger at. So if you total up the finger pointing, MS will appear to be doing worse than they are. Where as if you total up the issues instead of the blame, they're doing probably no worse than average, maybe better. If we're talking services, it's similar. 100 companies, 50 using MS, 50 using random non-MS software. 10 breakins in each category. MS gets the finger pointed at them 10 times. 50 random non-MS companies each get the finger pointed at them just 1 out of 5. But both MS and Non-MS have the same amount of issues in this hypothetical example, but one looks worse, even if they're not. In fact there could be 5 breakins with MS and 15 with non. But MS would have a finger pointed at them 5 times and 15 of the 50 random companies would each have a finger pointed at them only once. Yet, if you added up the numbers you'd be safer with MS (5 failures out of 50) instead of random non-MS (15 failures out of 50). I'm not saying that's how it is. I'm saying it's plausible.
        hmmm-i-wonder 2y ago
        I'm not sure your point here. MS as a company is severely compromised culturally is the root of this discussion, which impacts its products, and you're splitting hairs specific product comparisons. This isn't specifically about "windows" its about a combination of security issues a single company has had and how that will impact all their products. To compare "Microsoft" the company to individual competitors of its services doesn't serve anything here. Google, Amazon, Apple are its competitors in the relevant space (cloud/services/software) with similar size and scale would make for better comparisons if you must and OS is really one small part of the pie
  - prmoustache 2y ago
    1.Being a public domain library, likely used in many other proprietary products, I doubt the xz library would have targetted linux systems only. It may have been the first target because Linux provided a very large blast radius but it might just have been the beginning of a broader rootkit. So I wouldn't call the xz incident as linux specific. 2. I don't know why you oppose Microsoft, a provider of online services in the cloud with Linux, a small piece of software or an OS family depending on your definition. This is apples vs oranges comparison.
  - Hamuko 2y ago
    Ironically enough the xz backdoor was discovered by a Microsoft employee too.
  - josefx 2y ago
    The xz thing never managed to hit production versions of the affected distros. You had to use testing or similar pre production releases to get hit by it.
- sofixa 2y ago
  Azure's security is a joke. They're the only major cloud provider with cross-tenant security vulnerabilities, and they've had like 10 of them in the past years. Some of the absolutely trivial to exploit, indicating security isn't taken seriously.
- deleted 2y ago
  [deleted]
nox101 2y ago
I'm actually curious, if there is anyone here that's actually an expert on this stuff can you explain (1) How do you tell a state actor from just hackers looking to make money? (2) Is this a solvable problem? I can't imagine most state agencies, hospitals, doctors offices, small businesses, being able to afford good experienced IT staff. I can't imagine outsourcing it to nearly any company and trusting that company. Exceptions might be Google or Apple but neither company provides more than email/docs/spreadsheets. They don't supply bookkeeping, appointments, medical record management, etc... and AFAICT, all the suppliers for those kinds of services have terrible security practices. And, even if Apple and Google could do a good job there's still social engineering.
- 7373737373 2y ago
  These companies can work on building and then actually distributing more secure operating systems. This won't fix problems like social engineering, but it will prevent/harden a ton of other attack vectors. Since it allows much more fine grained control over data and resource access than contemporary popular systems, https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security and the concept of "hollowing out the attack surface with the https://en.wikipedia.org/wiki/Principle_of_least_privilege https://en.wikipedia.org/wiki/Principle_of_least_privilege" can't be mentioned often enough. Some specific projects to mention are https://en.wikipedia.org/wiki/Fuchsia_(operating_system) https://en.wikipedia.org/wiki/Fuchsia_(operating_system) ,https://en.wikipedia.org/wiki/Genode https://en.wikipedia.org/wiki/Genode and https://en.wikipedia.org/wiki/Qubes_OS https://en.wikipedia.org/wiki/Qubes_OS If these don't make it to the mainstream, it is the responsibility of FAANG companies that at least the concepts/mechanisms contained in them do, in other systems. To provide the world with a secure computing substrate.
- throwaway290 2y ago
  > 1) How do you tell a state actor from just hackers looking to make money? Why do you think those governments are not just trying to make money? You should check how much crypto DPRK made from ransomware. Krebs and others wrote about it
  - 2y ago
aaron695 2y ago
[dead]
oldpersonintx 2y ago
[dead]
deleted 2y ago
[deleted]

45 points by allannienhuis 2y ago

deleted 2y ago

[deleted]

qp11 2y ago

Microsoft is looking like the next Boeing for anyone paying attention to the attacks in the last couple years. End result of limitless greed. No TikTok or Snowden required, just the fantastic Microsoft software stack. They can't even protect themselves - https://www.crn.com/news/security/2024/microsoft-says-senior-executives-hacked-by-russian-group https://www.crn.com/news/security/2024/microsoft-says-senior...

nox101 2y ago
Is that really fair? We had the xz thing recently, that was open source. I'm not saying MS isn't the worst. But there are plenty of linux exploits. An expert IT person might keep that up to date but your average business, government agency, hospital is not up to it.
- ahiknsr 2y ago
  https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review_of_the_Summer_2023_MEO_Intrusion_Final_508c.pdf https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review... > The Board concludes that Microsoft’s security culture was inadequate. The Board reaches this conclusion based on: > Microsoft’s failure to detect the compromise of its cryptographic crown jewels on its own, relying instead on a customer to reach out to identify anomalies the customer had observed > Microsoft’s failure to detect a compromise of an employee’s laptop from a recently acquired company prior to allowing it to connect to Microsoft’s corporate network in 2021
  - nox101 2y ago
    I'm not sure what your point is except when it's Windows their is a single company to blame vs when it's linux there are only random contributors from all over https://www.google.com/search?q=site%3Acisa.gov+linux+security+exploit https://www.google.com/search?q=site%3Acisa.gov+linux+securi...
    - ahiknsr 2y ago
      Do you not understand the difference between Microsoft and Windows?
      - nox101 2y ago
        I'm comparing two OSes and pointing out when one OS has issues there's a single source to point a finger at. When the other OS has just as many or similar issues there is no one to point a finger at. So if you total up the finger pointing, MS will appear to be doing worse than they are. Where as if you total up the issues instead of the blame, they're doing probably no worse than average, maybe better. If we're talking services, it's similar. 100 companies, 50 using MS, 50 using random non-MS software. 10 breakins in each category. MS gets the finger pointed at them 10 times. 50 random non-MS companies each get the finger pointed at them just 1 out of 5. But both MS and Non-MS have the same amount of issues in this hypothetical example, but one looks worse, even if they're not. In fact there could be 5 breakins with MS and 15 with non. But MS would have a finger pointed at them 5 times and 15 of the 50 random companies would each have a finger pointed at them only once. Yet, if you added up the numbers you'd be safer with MS (5 failures out of 50) instead of random non-MS (15 failures out of 50). I'm not saying that's how it is. I'm saying it's plausible.
        hmmm-i-wonder 2y ago
        I'm not sure your point here. MS as a company is severely compromised culturally is the root of this discussion, which impacts its products, and you're splitting hairs specific product comparisons. This isn't specifically about "windows" its about a combination of security issues a single company has had and how that will impact all their products. To compare "Microsoft" the company to individual competitors of its services doesn't serve anything here. Google, Amazon, Apple are its competitors in the relevant space (cloud/services/software) with similar size and scale would make for better comparisons if you must and OS is really one small part of the pie
- prmoustache 2y ago
  1.Being a public domain library, likely used in many other proprietary products, I doubt the xz library would have targetted linux systems only. It may have been the first target because Linux provided a very large blast radius but it might just have been the beginning of a broader rootkit. So I wouldn't call the xz incident as linux specific. 2. I don't know why you oppose Microsoft, a provider of online services in the cloud with Linux, a small piece of software or an OS family depending on your definition. This is apples vs oranges comparison.
- Hamuko 2y ago
  Ironically enough the xz backdoor was discovered by a Microsoft employee too.
- josefx 2y ago
  The xz thing never managed to hit production versions of the affected distros. You had to use testing or similar pre production releases to get hit by it.
sofixa 2y ago
Azure's security is a joke. They're the only major cloud provider with cross-tenant security vulnerabilities, and they've had like 10 of them in the past years. Some of the absolutely trivial to exploit, indicating security isn't taken seriously.
deleted 2y ago
[deleted]

nox101 2y ago

I'm actually curious, if there is anyone here that's actually an expert on this stuff can you explain (1) How do you tell a state actor from just hackers looking to make money? (2) Is this a solvable problem? I can't imagine most state agencies, hospitals, doctors offices, small businesses, being able to afford good experienced IT staff. I can't imagine outsourcing it to nearly any company and trusting that company. Exceptions might be Google or Apple but neither company provides more than email/docs/spreadsheets. They don't supply bookkeeping, appointments, medical record management, etc... and AFAICT, all the suppliers for those kinds of services have terrible security practices. And, even if Apple and Google could do a good job there's still social engineering.

7373737373 2y ago
These companies can work on building and then actually distributing more secure operating systems. This won't fix problems like social engineering, but it will prevent/harden a ton of other attack vectors. Since it allows much more fine grained control over data and resource access than contemporary popular systems, https://en.wikipedia.org/wiki/Capability-based_security https://en.wikipedia.org/wiki/Capability-based_security and the concept of "hollowing out the attack surface with the https://en.wikipedia.org/wiki/Principle_of_least_privilege https://en.wikipedia.org/wiki/Principle_of_least_privilege" can't be mentioned often enough. Some specific projects to mention are https://en.wikipedia.org/wiki/Fuchsia_(operating_system) https://en.wikipedia.org/wiki/Fuchsia_(operating_system) ,https://en.wikipedia.org/wiki/Genode https://en.wikipedia.org/wiki/Genode and https://en.wikipedia.org/wiki/Qubes_OS https://en.wikipedia.org/wiki/Qubes_OS If these don't make it to the mainstream, it is the responsibility of FAANG companies that at least the concepts/mechanisms contained in them do, in other systems. To provide the world with a secure computing substrate.
throwaway290 2y ago
> 1) How do you tell a state actor from just hackers looking to make money? Why do you think those governments are not just trying to make money? You should check how much crypto DPRK made from ransomware. Krebs and others wrote about it
- 2y ago

aaron695 2y ago

[dead]

oldpersonintx 2y ago

[dead]

deleted 2y ago

[deleted]