13 ms·

Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

• jmclnx 1y ago
  Another day another vulnerability with Microsoft. I wonder if this will incentivize the countries to move faster with Linux. Probably not since there are so many of these breaches people just ignore them. I miss the old days when a breach involved someone breaking into the computer room and grabbing as many mag tapes as they can carry and run :)
  • sivm 1y ago
    I operate under the assumption that open source projects are compromised by states. If you espouse unpopular ideas or are yourself a state don’t rely on it.
    • jmclnx 1y ago
      Lets pretend what you are saying is true, which it is not. Who would you want to access your data ? The State or the "underworld". Many countries have laws on how to access your data. The underworld, you may wake up dead. Granted there are countries that act like a Criminal Org., but if you live there you have more issues than your data. With proprietary software, it is a much larger chance that backdoors exist than in Open Source. Many of us heard of 1 issue where it was claimed a project had a Gov sponsored BH in it. They did a long audit and found that was false. Eventually Open Source backdoors will found in Open Systems. Proprietary you are SOL unless you do very expensive and very hard testing. Even then it is doubtful you will find a backdoor.
      • pessimizer 1y ago
        It is true. Denying trivial truths with the purpose of not giving an inch does not add to one's argument, it weakens it. Plenty of closed source products will happily backdoor their products on request, without a warrant, if they are confident they will never be found out. That's the point. Not that FOSS source is somehow inviolable to nation-states with virtually infinite resources, many of which sponsor or contribute to the finance of a huge percentage of the development of FOSS themselves. It's easier to find backdoors in FOSS if you're looking, because you're allowed to look. But somebody has to be looking.
    • temp0826 1y ago
      Interesting, I'd more likely assume the same for closed source projects as there is less transparency into the supply chain
    • fsflover 1y ago
      https://news.ycombinator.com/item?id=27897975 https://news.ycombinator.com/item?id=27897975
    • BobbyTables2 1y ago
      It’d be cheaper and quieter to compromise a few key employees in a private company…
  • SketchySeaBeast 1y ago
    Genuinely asking - is there a Linux alternative to Sharepoint? I couldn't care less if it was lit on metaphorical fire and dumped into the sea, but a lot of orgs using it extensively.
    • bangaladore 1y ago
      O365 is a poor amalgamation of like 18 different things. Quite frankly I hope there isn't a true "alternative" to it. The reason orgs use Sharepoint is they are forced to if they use Microsoft. One drive is sharepoint, teams is sharepoint, sharepoint sites is sharepoint, etc... I'm sure all those things have better alternatives, but Microsoft shoves them down your throat when you license with them.
      • SketchySeaBeast 1y ago
        But it's understandable why an org would prefer that to having to maintain and manage the 18 things, right? It's a hard sell. I'm not saying that wouldn't be better, but it makes sense why an org would be reluctant. Again, not a fan of Sharepoint myself, but from an org's viewpoint, moving to Linux raises more problems than it solves.
        • bangaladore 1y ago
          It's understandable, but it doesn't excuse how poorly everything actually works and how confusing it is to use and administrate. To some extent I think Microsoft is largely in the business of building solutions for problems that don't exist. Most orgs are probably perfectly fine with a document management system + desktop word application and then a commercial NAS for bulk storage / backups.
      • kuhsaft 1y ago
        > Sharepoint is a poor amalgamation of like 18 different things. You’ve got it backwards. Everything M365 is an amalgamation of Entra, SharePoint, and Exchange.
  • lenerdenator 1y ago
    Oh, don't worry, there's plenty of known, unpatched vulnerabilities in FOSS, too.
  • ho_schi 1y ago
    I wonder what drives people using Microsoft and then using more from this company. We didn’t knew it better, back then. We knew it better, now. But migrating is work. So we prefer to suffer! And harm others! This Linux and BSD people are so annoying with their desire for compatibility. They shall suffer, too! And when we buy everything from a Monopoly, we don’t need to think. Somehow. Part of the game is that you’ve always an excuse with Microsoft. You cannot made responsible? There is this quote about IBM: Nobody Ever Got Fired for Buying IBM. But I cannot remember stories about suffering from IBM forever.
    • dizlexic 1y ago
      From what I've seen in my industry? To pass all the liability to Microsoft. "If something happens, we used enterprise grade industry standard software. We did our due diligence." This outlook is basically why we can't innovate anymore. I had to recently sit through a meeting where our CTO quoted all the "blogs" he's been reading as a way to slap down my suggestion for an in-house project. It's all about CYA.
      • pphysch 1y ago
        Surely there's an untapped market for infosec liability insurance. Pay the CYA bill, let the engineers build/choose something that actually works. Win-win.
      • phil21 1y ago
        I call it the liabilty fairy. It's why school boards don't do anything useful, among many many other things in our society. It's an endemic disease. Most of the time it's extremely exaggerated, but it's trotted out and used as a CYA excuse almost immediately by most in the executive/managerial class. Both due to outright laziness and incompetence, and also as just a... why take any personal risk whatsoever making actual decisions with any impact if I can keep my cushy job and career rolling by being as milquetoast as possible. Never mind you get the big bucks to make such important and controversial decisions at great personal (career) risk when some inevitably go wrong. Everyone forgot that part. Such roles should be hard, difficult, and risky.
    • 1y ago
  • hulitu 1y ago
    > I wonder if this will incentivize the countries to move faster with Linux. Countries are run by politicians. The ability of a politician to remember something is inverse proportional to the sum of money landed in its account.
  • formerly_proven 1y ago
    As far as I can tell there's two vulnerabilities bundled up here. One is an unauthenticated command injection (!) vulnerability to steal some keys and the other is of course yet another serialization-based RCE in a safe language, mediated by signed cookies (signed with the keys stolen in step 1). I don't understand how often this design has to blow up in people's faces until they stop doing this and use something dumb and safe instead.
  • vpShane 1y ago
    > I wonder if this will incentivize the countries to move faster with Linux. I hope so. We're seeing it now though. Germany, Norway. Not saying there won't be CVEs when they move, but at least there's freedom and openness already available to switch to.
• PicassoCTs 1y ago
  [flagged]
  • bongodongobob 1y ago
    [flagged]
    • lenerdenator 1y ago
      [flagged]
• shrubble 1y ago
  Wasn’t Microsoft just recently using Chinese people living in China to administer DOD servers? I would guess they use Sharepoint inside the DOD?
  • polarbear67 1y ago
    Link: https://www.reuters.com/world/us/microsoft-stop-using-engineers-china-tech-support-us-military-hegseth-orders-2025-07-18/ https://www.reuters.com/world/us/microsoft-stop-using-engine...
    • gkanai 1y ago
      That is... crazy. Would the CCP allow their cloud infra to be administrated by US staff in the US? Never.
      • kevin_thibedeau 1y ago
        The US doesn't either. Someone didn't comply with existing law here. I've been on a program where uncleared people from another business unit were used as internal labor loan for export controlled work. One of them was belatedly discovered to be a Canadian citizen and they were retasked the next day. There are strict rules in this domain. It's just that nobody gives a fuck about paying for an IT cost center to do things securely. Chalk up another win for outsourcing and moving to the cloud for cost savings.
  • theteapot 1y ago
    Says this in the article: > A programming flaw in its cloud services also allowed China-backed hackers to steal email from federal officials. On Friday, Microsoft said it would stop using China-based engineers to support Defense Department cloud-computing programs after a report by investigative outlet ProPublica revealed the practice, prompting Defense Secretary Pete Hegseth to order a review of Pentagon cloud deals.
    • paulwilsondev 1y ago
• timewizard 1y ago
  Why didn't they just rewrite it in Rust?
  • theteapot 1y ago
    They should've just Linux.
  • tialaramex 1y ago
    IIRC Microsoft is rewriting some of these backend services in Rust, although not because it will increase security but because it lets them get better perf than existing solutions without the safety tradeoff they'd have suffered to go to C++ which would have been their option 15-20 years ago. I don't know whether Sharepoint was on that list.
    • mynameisash 1y ago
      You also can get better velocity than with other languages due to the compile-time checks.
    • p_ing 1y ago
      SharePoint is primarily written in C# [.NET Framework 4.8] and leverages ASP.NET; there would be no reason to rewrite the majority in another language. There is some C++ in SharePoint Search (and a few other components here and there). IIS which SharePoint runs atop of is written in presumably primarily C. You can decompile most of SharePoint if you ever need to peek at the code. That's a huge advantage to figure out how it works.
      • tialaramex 1y ago
        [flagged]
        • deleted 1y ago
          [deleted]
• tombert 1y ago
  At the risk of massive downvotes, I have to admit that a small part of me wants this so that maybe corporations stop using Sharepoint as soon as possible. Seriously, I haven't used it since 2017, but every time I used it then it was the worst part of my day. I used to have a shirt that said SHarepoIT Happens that I would wear to work, and it seemed like the one thing I could get my coworkers agree on was that Sharepoint is terrible and we'd rather use anything else.
  • CommenterPerson 1y ago
    I upvoted you .. share the same sentiment.
  • neuroelectron 1y ago
    My boss spent over a year trying to get me to setup Sharepoint. About 6 months into this, I finally looked into it and what it provided and said no. Eventually he hired a second tech and he set it up "in an afternoon." Good for him. Nobody ever used it. He also stole my high speed USB drive.
    • threetonesun 1y ago
      While Sharepoint might some day die, it will only be replaced by another piece of software that gets launched for nobody to ever use.
      • dylan604 1y ago
        Clearly Sharepoint is being used. Otherwise, this would not be a news story. So if every single Sharepoint user switched to another piece of software, it would be more than nobody using it.
        • doubled112 1y ago
          I think you missed the joke here, being that Sharepoint is installed in many of orgs, but never used after installation. I have worked at an org that did the same. We already had Confluence. Somebody decided we needed Sharepoint. We licensed and installed it. Six months later we migrated the handful of documents and files and decommissioned it.
• sega_sai 1y ago
  It is instructive that we are seeing the results of DOGE's work: "The process took six hours Saturday night — much longer than it otherwise would have, because the threat-intelligence and incident-response teams have been cut by 65 percent as CISA slashed funding, Rose said."
  • ToucanLoucan 1y ago
    I'm not sure which part pisses me off more: that tons of professionals lost their jobs and will likely not work in public service again because of it, or that through all that, they barely found any actual waste at all. A fucking farce.
    • to11mtm 1y ago
      This is what happens when Chesterton's fence is ignored...
      • tough 1y ago
        not just ignored but purposefully burnt down
        • hn_acc1 1y ago
          Chesterton's fence, his dad's moat and his grandpa's bunker..
    • azemetre 1y ago
      You're assuming their purpose was to find waste, it was not. Their purpose was to be the Chicago boys in DC.
      • caconym_ 1y ago
        Seems like generally it ended up being a surveillance play, in practice if not original intent. For example, Dog coin has been reported to be passing data taken from other agencies directly to ICE^[1] for law enforcement applications, and there was that other matter of logins apparently from Russia using accounts the Dog coin personnel demanded agencies create on their internal systems with (auditable) logging disabled^[2]. And probably more that I'm forgetting. One does wonder whether this was all part of Musk's vision, or more thanks to the scum he hired to staff Dog coin and/or other lawless opportunists in the Trump administration. [1] https://www.washingtonpost.com/immigration/2025/04/16/medicare-data-deportation-ice-doge-trump/ https://www.washingtonpost.com/immigration/2025/04/16/medica... [2] https://www.reuters.com/technology/cybersecurity/whistleblower-org-says-doge-may-have-caused-significant-cyber-breach-us-labor-2025-04-15/ https://www.reuters.com/technology/cybersecurity/whistleblow...
• CommenterPerson 1y ago
  Wondering if this was a self goal to, you know, get people to use this enshittified product on the cloud?
  • Jtsummers 1y ago
    There are basically two things at play here: MS's hosted version of SharePoint. It's apparently unimpacted by this current round of attacks. DOD (since it's been brought up by other commenters) makes significant use of this. People hosting SharePoint instances themselves. Some on-prem, some with rented computers. These are the impacted ones. It's not about "the cloud", it's about hosted SharePoint having weaknesses that were exploited and many organizations apparently leaving their SharePoint instances accessible over the open internet. These hosted instances are also probably old and unpatched which doesn't help things. Some (many?) units within DOD make use of this, but definitely not all.
    • fakedang 1y ago
      [flagged]
      • Jtsummers 1y ago
        "Our product is remarkably insecure, let's convince everyone of this by sponsoring an attack so they go and buy our other product." I mean, there are definitely stupid people everywhere, but I'd hope MS leadership isn't that stupid.
        • dylan604 1y ago
          I mean, dumber things have happened. Governments have destroyed their own government buildings to blame on the opposition and gain sympathy for their causes.
          • Jtsummers 1y ago
            Yes, false flags. That's usually used to motivate people to go attack someone or to garner sympathy or support for a cause. MS's products being subject to attacks because they have numerous vulnerabilities does not encourage anyone to go out and buy other MS products. You sink one of your own naval vessels (or it sinks due to an accident and you take advantage of the situation) and blame it on an enemy. That enemy is now the target of your military and your population approves. A shipbuilder hires someone to poke a hole in 1000 of their ships that are so badly designed and manufactured that it only takes a rubber ducky bouncing off the hull to sink them does not encourage anyone to go back to that shipbuilder. False flags (particularly of the "let's kill or maim hundreds of our own people and other innocent people" variety) push into evil territory. They aren't dumb on their own, they're calculated risks predicated on the willingness of the masses to fall in line after a catastrophe. Deliberately hurting your own customers by using weaknesses in your own systems in order to motivate them to go buy your other products or services is dumb.
• adhamsalama 1y ago
  [flagged]
  • dang 1y ago
    Could you please stop posting unsubstantive comments and flamebait? You've unfortunately been doing it repeatedly. It's not what this site is for, and destroys what it is for. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
• 1970-01-01 1y ago
  It's not right to victim blame but it's also not wrong. Akin to investing lots of money in a stock. If you took the risks of maintaining a public SharePoint server in 2025, here's your very bad day.
  • jasonvorhe 1y ago
    It's perfectly fine to victim blame corporations that keep kneecapping themselves. That's a hill I'm willing to day on.
• exabrial 1y ago
  [flagged]
  • zanecodes 1y ago
    CrowdStrike is not made or owned by Microsoft.
    • alephnerd 1y ago
      Giving OP the benefit of the doubt, there were issues with how the Windows kernel had little guardrails and restrictions. That said, that was the EU's fault, as the EU in 2009 forced Microsoft to fully expose their OS internals to outside vendors during an anti-trust settlement, and with little ability to enforce vendor standards: ""Microsoft shall make available to interested undertakings Interoperability Information that enables non-Microsoft server Software Products to interoperate with Windows Server Operating System on an equal footing with other Microsoft Server Software Products. "Microsoft shall ensure on an ongoing basis and in a Timely Manner that the APIs in the Windows Client PC Operating System and the Windows Server Operating System that are called on by Microsoft Security Software Products are documented and available for use by third-party security software products that run on the Windows Client PC Operating System and/or the Windows Server Operating System. These APIs will be documented on the Microsoft Developer Network, unless open publication would create security risks. In such circumstances, Microsoft will provide third-party security vendors with access to such APIs pursuant to a royalty-free license and on fair, reasonable and non-discriminatory terms." [0] This meant that by offering Microsoft Defender for Endpoint, Microsoft needs to give similar access to the underlying kernel to competing vendors like CRWD and S1. [0] - https://news.microsoft.com/download/archived/presskits/eu-msft/docs/MicrosoftInteroperabilityUndertaking16Dec2009.doc https://news.microsoft.com/download/archived/presskits/eu-ms...
      • zanecodes 1y ago
        Well, I hate Microsoft as much as the next person, but I'm not sure "writing a buggy kernel module can crash the kernel" is much of an indictment of Windows in particular...
• charles_f 1y ago
  > CISA advises vulnerable organizations [...] to disconnect affected products from the public-facing Internet until an official patch is available. It's interesting to me that you'd go the hassle of hosting your own SharePoint on prem, but leave it internet facing. I would have assumed a the Venn diagram of these organizations to be entirely contained in orgs forcing you to use a VPN.
  • jauntywundrkind 1y ago
    Oh CISA... What a pity that CISA has been purged down of effective useful people and turned into another sad selected-for-political-compliance-only force. Arizona recently got attacked from Iranian hackers & didn't even bother trying to get help from CISA. https://archive.is/2025.07.19-143305/https://www.azcentral.com/story/news/politics/elections/2025/07/19/iran-hacked-arizona-secretary-of-state-election-candidate-website/85265280007/ https://archive.is/2025.07.19-143305/https://www.azcentral.c... CISA is so so vital. Investigating incredibly wide ranging attacks like this, or the Salt Typhoon attack are vital for this nation. But the show is being run by a bunch of people who value political dogma far above anything else. https://www.techdirt.com/tag/cisa/ https://www.techdirt.com/tag/cisa/
    • blurbleblurble 1y ago
      It almost seems like the goal is to hurt people
      • sneak 1y ago
        [flagged]
        • rachofsunshine 1y ago
          There's some truth to this in that all organizations ultimately have their own perpetuation as a goal...but this is also a little like saying "well, there are a lot of complicated macroeconomic drivers of theft" while you're stealing somebody's purse. The harms here are not the result of some broad faceless force so distributed and ethereal as to avoid accountability. The people performing them know exactly what they are doing. They're choosing to do it, when no systemic factor forces them to. If they wanted to not harm people, they could do so at zero or even negative harm to themselves. Systems-level thinking is a useful tool, but it can make you miss the trees for the forest when a single concrete human being in front of you is just a bad person.
• ThinkBeat 1y ago
  I have spent far too much of my life on SharePoint. Having it internet facing has never been a good idea. Not really what it is meant for, though the promo verbiage on that has changed over different versions. Some folks wanted SharePoint as their "web server", I would set that installation up entirely separted from all other instances they may have on the network.
  • miffy900 1y ago
    Actually it wasn't too long ago, in the early-2010's, that Microsoft was promoting SharePoint for internet sites; I think at one point some Europoean car manufacturer (BMW? Ferrari?) had their global marketing site on SharePoint. Of course that didn't last long, as Microsoft licensed it at a crazy price ($40k per site or something like that).
    • 010101010101 1y ago
      I worked on a couple of public facing SharePoint 2010 sites for large, well known companies before while it was in RC and immediately after - MS had a big marketing push to get people to build more than Intranet portals on it at the time. It seems like that died off entirely once Office 365 came around, and it was never a good idea in the first place, but it was definitely a thing.
      • xcrunner529 1y ago
        2013 literally came with a tool to built a theme from your html and css and other features for hosting web sites.
    • tecleandor 1y ago
      And it probably needed a very hefty bunch of servers, even after caching, if you needed just a little bit of dynamic content or interaction with the site.
    • yabones 1y ago
      Well, they would have had to purchase one Client Access License per potential device or user that would access the website. Since there's about 5-6 billion people with internet access, and a CAL is about $50 a pop, that would be roughly two hundred and fifty billion dollars to fully and correctly license a public server.
• vultour 1y ago
  How did Principal Engineer Copilot not prevent this?!
  • dylan604 1y ago
    This vuln might have existed before Copilot received that title bump. It could have been introduced while Copilot was just an intern
    • svaha1728 1y ago
      It's safe to say at this point. The more Microsoft relies on Copilot to solve its security problems, the more problems Microsoft will have.
      • dylan604 1y ago
        Sounds like job security for Copilot!
        • grumbelbart2 1y ago
          You're joking, but many of the code bases I saw that were produced by/with AI-support are not maintainable by any sane human. The more you go AI, the less you can turn back.
  • amelius 1y ago
    Because the hackers used Copilot too, and one side has to win ... (?)
  • codemystery 1y ago
    [flagged]
  • illusive4080 1y ago
    Question, is this just a joke about AI taking over our jobs, or did someone at Microsoft call Copilot a Principal Engineer?
• pyuser583 1y ago
  I've heard many Pentagon employees claim that if someone wanted to take out the US military, all they'd have to do is kill Sharepoint. It's the go-to warm-up joke whenever someone in the military gives a speech.
  • firesteelrain 1y ago
    We had a lot of SharePoint back in the day
  • esseph 1y ago
    If somebody deleted PowerPoint the US Army would fall to its knees
    • pyuser583 1y ago
      Ah yeah power point not share point sorry.
• Arubis 1y ago
  [flagged]
• bodhi_mind 1y ago
  My real-time security alert feed picked this up before the major news outlets: https://zerodaypublishing.com/feed https://zerodaypublishing.com/feed
  • dotty- 1y ago
    that's cool, do you support an RSS feed?
    • bodhi_mind 1y ago
      Not yet, but I’m planning to roll one out later this week! Are you in cybersecurity or just tracking vulnerabilities for fun/work?
      • dannyphantom 1y ago
        I work both cybersec + fun/research, LOVE this resource and lucky to have come across it here. Subscribed via email & looking forward to RSS. Thanks for sharing it here!
        • bodhi_mind 1y ago
          Thanks so much, that really means a lot! I'm actively upgrading the feed right now: more vendors, faster signal (closer to real-time), and smarter triage to cut through the noise. I’m also shaping a Pro tier and would love your input. Some of the things I’m working on: Full access to all alerts (not just critical) Fine-grained filtering (vendor, product, CVSS score, tags) Delivery via webhooks, Slack, Teams, pagerduty, Splunk, other SIEMs A “Time Machine” view so you can preview what you would’ve received had you been subscribed earlier Would love to know what you’d want in a tool like this. Anything missing that would help your day-to-day in cybersec or research?
  • ropable 1y ago
    This looks like quite an interesting service. Second the request for an RSS feed.
• poemxo 1y ago
  We need more Red Hat and less Microsoft in the on-prem enterprise business. These exploitable vulnerabilities are unacceptable when your customers are the likes of DoD. No one considers Google anything less than an impenetrable fortress, but when it's some government entity responsible for keeping American lives safe it's like "ah yeah they probably have a vulnerable on-prem Sharepoint that could easily be pwned." So why is this? Why do Microsoft products enjoy a monopoly on the server in these sectors when more secure (Linux-based) options are far cheaper and widely deployed already? Isn't security the number one priority in those spaces?
  • LoganDark 1y ago
    Could be that Microsoft can navigate all the regulatory bullshit that surrounds anything government. I don't know of anyone doing that for anything Linux.
    • dralley 1y ago
      There's tons of Red Hat in federal IT, that's not the issue. It's just that Microsoft dominates the client-facing software business, and Red Hat has minimal presence there so while you might see RHEL desktops at e.g. NASA you're unlikely to see them anywhere else, and there's no real open source equivalent of SharePoint or Office out there. Maybe [0] will be one, eventually, but it would take a long long time to replicate the functionality if it were to ever happen. Best case scenario is that the EU were to fund an open source solution. [0] https://www.techradar.com/pro/mozilla-launching-thundermail-email-service-to-take-on-gmail-microsoft-365 https://www.techradar.com/pro/mozilla-launching-thundermail-...
      • LoganDark 1y ago
        Huh, I didn't know Red Hat did any government stuff.
      • hollander 1y ago
        > Schleswig-Holstein, one of Germany’s 16 states, on Wednesday confirmed plans to move tens of thousands of systems from Microsoft Windows to Linux. The announcement follows previously established plans to migrate the state government off Microsoft Office in favor of open source LibreOffice. https://arstechnica.com/information-technology/2024/04/german-state-gov-ditching-windows-for-linux-30k-workers-migrating/ https://arstechnica.com/information-technology/2024/04/germa...
• deleted 1y ago
  [deleted]
• xyst 1y ago
  If I am ever on the board of a company, I will always vote no confidence in the dipshit CTO or founder that willingly install/mandate use of Microsoft junk in the company. As a corporate drone that has accidentally opened various Microsoft office suite links inside of Teams. My dislike for anything Microsoft continues to grow. Am I surprised that sharepoint has vulnerabilities? Hell no.
  • osn9363739 1y ago
    What would you replace it with? Once an org gets to a certain size, they need something like sharepoint, and would they be any more secure?
    • betaby 1y ago
      > they need something like sharepoint Or probably they don't.
    • fragmede 1y ago
      Google Workspace. Yes.
    • yeasku 1y ago
      In the places I work is either Sharepoint or Alfresco. I dont know what is worse.
  • sarora27 1y ago
    Once worked at a place in 2017 with a dipshit CIO. Guy spent his entire time trying to evangelize Teams as the reason to switch to Microsoft. He ended up leaving 11 months into the gig and we were more than happy to stay on Slack. It feels like Microsoft has a (bad) deal with every 3rd rate IT leader where the IT leader eschews Microsoft's BS in exchange for being "unfireable" because "who else knows how all the Microsoft stuff works?"
• jwnin 1y ago
  SharePoint is a great way to share data with third parties. You may even know some of them.
  • thisOtterBeGood 1y ago
    Excellent :D
  • rapnie 1y ago
    Share to any Point
• man4 1y ago
  [dead]
• horns4lyfe 1y ago
  Why is the US even using Microsoft? They’re in effect an Indian company now
• oneplane 1y ago
  Meanwhile, Citrix has been on fire causing much worse things (you can just grab any session you want and become anyone who's already logged in). Who needs to break into SharePoint when you're becoming someone who's already got access... including to everything else (not just SharePoint) It's patchable, but it's been two times in a row now, and patching is always slow and incomplete.
  • dfex 1y ago
    I wonder how widely this affected all 3 of Citrix customers?
    • acidburnNSA 1y ago
      Big customers though, like the VA and NIH
• newsclues 1y ago
  There is a war going on. It’s not just tanks in the Donbas, it’s a global intelligence and cybersecurity conflict.
• cindyllm 1y ago
  [dead]
• paulwilsondev 1y ago
  [flagged]
  • tomhow 1y ago
    We've banned this account for repeatedly posting troll comments.
• paulwilsondev 1y ago
  even with GCC-High???
• s-mon 1y ago
  Something to understand about the word “leak” is that it implies at some point it was keeping things in. Microsoft security is so underfunded and garbage, it is fundamentally making technology as a whole unsafe. Example: if Kroger or whatever your supermarket of choice distributed meat that was infected they would get sued to bits. Microsoft distributes thousands of malicious NPM dependencies and underfund the NPM security team - if there is such a thing - resulting in an entire industry of supplychain security companies to exist. No other registry has the issue of malicious packages as badly as NPM since Microsoft acquired Github. Microsoft just does not know how to handle security, which is why so many security companies exist to fill their gaps. I don’t trust their security practices one bit tbh.
• bitwize 1y ago
  Drat, and here I was telling myself that I'd much rather use SharePoint than Atlassian Confluence.
• BLKNSLVR 1y ago
  With the chaos of the current administration has there ever been a better time? (other than maybe tomorrow)
  • paulddraper 1y ago
    I was concerned there wouldn’t be a political take
  • ipnon 1y ago
    I tell you in good faith: the chaotic response would have been to not notice, not disclose, not fix, and then go to the press claiming everything is fine, and accusing anyone saying otherwise of having a nefarious agenda.
• Sateeshm 1y ago
  I got a 502 Bad Gateway for all our onprem SP sites for a few minutes last night, which is very unusual. Wondering if this had something to do with that.
• evrennetwork 1y ago
  [flagged]
• WhereIsTheTruth 1y ago
  Haha, Microsoft, the source of all the leaks, it's always Microsoft, quick, let's give Microsoft even more government contracts! They truly are the best!
• BrandiATMuhkuh 1y ago
  I was just building a SharePoint integration for some enterprise customers (I do RAG on their data) and I find it brutal, that now, I have access to all their SharePoint data for all SharePoint sites. Even the ones I don't want to index. And I even use user login over admin/service key login. AFAIK, the Oauth claims of SharePoint don't allow specifying particular projects only. (BTW: same counts for platforms like ACC/BIM360)
• Black616Angel 1y ago
  > “Anybody who’s got a hosted SharePoint server has got a problem,” said Adam Meyers, senior vice president with CrowdStrike, a cybersecurity firm. “It’s a significant vulnerability.’’ Senior VP at CrowdStrike, so a professional in destroying large amounts of systems. > cybersecurity firm Sure, might as well call it that.
• buyucu 1y ago
  I don't understand why anyone uses SharePoint. The product is extremely low quality. I have never met a happy SharePoint user. Now we also learn that it's insecure as well as having a horrible user experience.
  • mindwok 1y ago
    It’s similar to Salesforce, Dynamics etc, they rarely achieve what they promise - the entire business is making executives feel like they’re transforming the business without taking on any risk.
• deleted 1y ago
  [deleted]
• DyslexicAtheist 1y ago
  The root cause might less be whether an entity uses Linux or Windows but whether they use cloud or on-prem. No matter how skilled, the on-prem stuff getting maintained by IT/SOC (often external contractors) are unlikely to deliver the same level of diligence as one of the big cloud vendors. Things are so complex we have critical bugs everywhere that can not be patched without major breakage. So what does a diligent org do? they make a risk-assessment to explain things away for legal & compliance purposes. check your SCA/SBOM in any/most stacks if you think this is untrue ...
• sebstefan 1y ago
  Damn maybe this hack could help me find fucking anything in there.
• quaestio 1y ago
  Is it possible that prior staff at companies like Microsoft may have injected backdoor vulnerabilities? How is this auditable?
  • lifeinthevoid 1y ago
    Strange question, why would it be impossible?
• sanskarix 1y ago
  It’s kind of wild how we end up here over and over, a big government breach, angry headlines, but the tech never seems to change (imo). If you work in IT, this whole SharePoint story is probably a deja vu, A few real-world points that stood out to me: - SharePoint (and a lot of other MS stuff) didn’t win because it was bulletproof, just because it was bundled “FREE” and nobody got fired for rolling it out in the 2000s. Once you’re deep into the Microsoft ecosystem, the cost and pain of replaccing is huge! - Security honestly feels like a service for a lot of giants. When someone asks if it’s the number one priority, the answer from experiencem, is “no.” Cost, compliance available support, and how easy it is to blame a vendor if things fail tend to matter more. - When people say Linux would be more secure in these environments, maybe. But if Linux or Red Hat took over everywhere, you can bet it would become the juiciest target immediately. Right now, Windows gets a lot of attention because it’s everywhere. And obviously, attackers like to go where the odds of a big payoff are highest. - A lot of giants aren’t making decisions based only on security or technical merit. It’s about familiarity, employee training costs, consulting partners, and “safe” bets. If you pick Microsoft and get breached, it’s an industry problem. If you pick something niche and get breached... it’s 100% your fault. - Resistance to change is real. Swapping out platforms isn’t just a technical lift. Management, end users, even IT staff get pretty set in their ways. Honestly, unless there’s enough public backlash or a relgulation hammer, I don’t see the inertia breaking any time soon. For most companies, “patch and carry on” still beats “burn it all down and start fresh.”
  • jon-wood 1y ago
    While I agree with you on most points, security is never the number one priority. If it were we'd all destroy our computers, never write anything down, and simply accept the collapse of society. Security is always weighed against many other priorities such as authorised users being able to access data, and ease of use. A unique 128 character password for each document would have high security, but be widely considered unacceptable even in a system handling classified material.
    • kibwen 1y ago
      > If it were we'd all destroy our computers, never write anything down, and simply accept the collapse of society. No, this is the same sort of defeatism that prevents us from making progress on security. We could engineer usable systems where actual security is a priority, and not just security theater. We don't because nobody in a position to change anything actually gives a shit.
• jacquesm 1y ago
  If Sharepoint was an animal it would be a Duck-billed Platypus. I never understood why it got the degree of use that it did, even as a free product it was always best avoided. Everything seemed to be tacked on at a different angle from the normal one with broken interfaces in between.
• T3RMINATED 1y ago
  [dead]
• gigantaure 1y ago
  this is barely one year after the CSRB recommended: "...Microsoft leadership should consider directing internal Microsoft teams to deprioritize feature developments across the company’s cloud infrastructure and product suite until substantial security improvements have been made in order to preclude competition for resources. In all instances, security risks should be fully and appropriately assessed and addressed before new features are deployed." These recommendations followed a review of MS practices following the Exchange online compromise. I highly doubt anything changed at MS since then. source: https://www.cisa.gov/sites/default/files/2025-03/CSRBReviewOfTheSummer2023MEOIntrusion508.pdf https://www.cisa.gov/sites/default/files/2025-03/CSRBReviewO...
• ycuser2025 1y ago
  i am sure nothing to do with this: https://www.tomshardware.com/tech-industry/cyber-security/microsoft-to-stop-using-engineers-in-china-to-work-on-u-s-defense-computer-systems-in-wake-of-investigative-report-fears-of-exploitation-by-foreign-intelligence-services-spurs-immediate-change https://www.tomshardware.com/tech-industry/cyber-security/mi...
• o140445 1y ago
  [dead]
• aspenmayer 1y ago
  https://archive.is/LVrQQ https://archive.is/LVrQQ Related: ToolShell Mass Exploitation (CVE-2025-53770) - https://research.eye.security/sharepoint-under-siege/ https://research.eye.security/sharepoint-under-siege/ | https://news.ycombinator.com/item?id=44629133 https://news.ycombinator.com/item?id=44629133
• deleted 1y ago
  [deleted]
• slantedview 1y ago
  Is it a coincidence that this was reported on the same day it was also reported that the FBI was storing the Epstein files on a Sharepoint server [1]? https://www.muellershewrote.com/p/the-epstein-cover-up-at-the-fbi https://www.muellershewrote.com/p/the-epstein-cover-up-at-th...
  • sugarpimpdorsey 1y ago
    [flagged]
  • aspenmayer 1y ago
    I was not sure if this was mere speculation on your part, but I think you might be onto something here. https://www.muellershewrote.com/p/the-epstein-cover-up-at-the-fbi https://www.muellershewrote.com/p/the-epstein-cover-up-at-th... | https://archive.is/RZqU0 https://archive.is/RZqU0 > The process of reviewing the Epstein and Maxwell files was chaotic, and the orders were constantly changing - sometimes daily. One person I spoke to on the condition of anonymity said that many agents spent more time waiting for new instructions than they did processing files. But here’s what caught my attention: the files were stored on a shared drive that anyone in the division could access. Normally, access is only granted to those working on a project, but because of the hurried nature of the exercise, the usual permission restrictions were not in place. Additionally, the internal SharePoint site the bureau ended up using to distribute the files toward the end did not have the usual restricted permissions. This left the Epstein and Maxwell files open to viewing by a much larger group of people than previously thought.
    • dylan604 1y ago
      So how does this work for someone to know what server to use the exploit? Do companies make their Sharepoint servers accessible to WWW? Do hackers need to use this on a network they've already pwnd? Finding out the FBI put something like this on a server open to the WWW would be classic. That much larger group just got a wee bit larger than they previously thought on their previously thought number.
      • 1y ago