14 ms·
Foreign hackers breached a US nuclear weapons plant via SharePoint flaws
- deleted 1y ago[deleted]
- deleted 1y ago[deleted]
- gnabgib 1y ago.. still 3 months ago CVE-2025-53770 (809 points, 447 comments) https://news.ycombinator.com/item?id=44629710 https://news.ycombinator.com/item?id=44629710 US Nuclear Weapons Agency Breached in Microsoft SharePoint Hack (18 points) https://news.ycombinator.com/item?id=44654869 https://news.ycombinator.com/item?id=44654869
- reenorap 1y agoThere needs to be a law that all nuclear and nuclear-adjacent facilities have no connection to the Internet. The fact it's allowed is unbelievable.
- fujigawa 1y agoIt's believable when the industry has pivoted to pushing SaaS garbage in every place imaginable to the point that on-prem solutions don't exist anymore. Do you expect them to not use email either? Remember, the industry told us we're in a 'zero trust' world now. The network perimeter is an anachronism. OTOH you know damn well they keep the important stuff airgapped, in which case the title (and your predictable reaction) is just fanning the flames. It could very well be they 'breached' the receptionist's PC she uses to browse Facebook to pass the time.
- IAmBroom 1y agoI have some sad news for you, about the realities of "airgapped security" IRL. It starts with military officers using the hallway photocopiers for secure documents, and ends with TS docs stored in a Florida hotel's restroom.
- ninalanyon 1y agoEmail is much easier to secure. > receptionist's PC she uses to browse Facebook to pass the time. Why does 'her' PC have access to the internet?
- tcoff91 1y agoWasn't the internet literally created by the military for military comms? The decentralized routing was in part to ensure that comms could survive some areas being taken out by nuclear weapons.
- SoftTalker 1y agoAs the effect of yesterday's AWS event demonstrates, the major Amazon, Microsoft, and Google data centers are surely top tier targets in every adversary's war plans. The decentralized internet is less of a reality today than it was years ago.
- diggan 1y agoDon't we have more internet submarine cables and less single points of failure in our internet infrastructure today than years ago? If so, shouldn't that make it easier to route around failures? The web though I agree isn't very decentralized.
- SoftTalker 1y agoMaybe yes in that regard. But in the past, most organizations ran their own mail and web servers. Software supporting the business ran on-prem. Now they use Google or Azure or AWS. So business and civilian usage, at least, seem more vulnerable now.
- HippyTed 1y agoWe sacrificed resillience for effeciency. Now things are much more fragile and liable to exploitation.
- Root_Denied 1y agoConsidering that the AWS outage took out a lot of lines of communication (email, video, chat systems) for both commercial and government entities, I'd say that US-East-1 is a pretty big single point of failure. Even if it didn't result in infrastructure impact directly, if there was some kind of infrastructure issue and you had delayed or unavailable communications, how would you know? How quickly could a response be mounted? There's some parts of the infrastructure that could damage themselves irreparably in the time it would take to to fix the outage or get comms routed through a backup channel - like parts of the electrical grid or water treatment plants. An attacker (read: nation-state actor) wouldn't even need to take down US-East-1, it could just take advantage of the outage. I assume (hope?) there's some kind of backup comms plan or infra in place for critical events, but I don't actually know.
- azalemeth 1y agoWhile we're at it "and not use Microsoft products". Literally every time a story like this surfaces...
- dimitrios1 1y agoThat's more of a form of survivorship bias. Microsoft continued to maintain its lockdown on government IT and infrastructure through the decades, over the alternatives.
- Razengan 1y agoI don't think any Microsoft Surfaces were involved in this..
- BeetleB 1y ago> While we're at it "and not use Microsoft products". I'm not sure if Oracle would be better.
- KaiserPro 1y agoI mean there were also rules about non-sanctioned network connections in the pentagon, or using only sanctioned apps to discuss secrets, but thats not really been enforced recently.
- jayd16 1y agoYou mean its a bad idea to slap a Starlink dish in the same building as the nuclear football?
- boringg 1y agoWhich breach was that again?
- JumpCrisscross 1y ago> needs to be a law that all nuclear and nuclear-adjacent facilities have no connection to the Internet Why the special treatment for nuclear? Do you really think redlining a dam or storm-levee system would be less damaging? Also, turning off internet connections means less-capable remote shut shut-off. Less-responsive power plants. Fewer eyes on telemetry. We should be mindful of what is and isn't connected to the internet, and how it's firewalled and--if necessary--air gapped. That doesn't mean sprinting straight for the end zone.
- doublerabbit 1y ago> Also, turning off internet connections means less-capable remote shut shut-off. Why does it have to be remote what's wrong with it being in-house? Besides a shut-off should never be able to be triggered remotely. The same goes for digital emergency shut off buttons; all should be physical. > Less-responsive power plants. What? How is remote any more responsive than physical workers being in-house? If power-plants operated efficiently back in the 50's without internet, they should be able to now without internet.
- JumpCrisscross 1y ago> Why does it have to be remote what's wrong with it being in-house? Nothing wrong with it being in house. But having a back-up is never bad. > How is remote any more responsive than physical workers being in-house? If the on-site workers are incapacitated. It's a remote (hehe) risk. But so is foreign hackers doing anything with our nukes. > If power-plants operated efficiently back in the 50's without internet, they should be able to now without internet If you're fine paying 50s power prices again, sure, I'm sure a power company would happily run their plants retro style.
- ferguess_k 1y agoI heard that once you put up a website on the public internet, it would immediately gets attacked by all kinds of scanners or other worse things. Not sure if it's true as I'm not a web guy.
- SoftTalker 1y agoEvery public IPv4 address is port scanned multiple times a day.
- ta1243 1y agoWhich really isn't a problem, unless you're being scanned so much your bandwidth is being overwhelmed. Certainly not the case for me, despite having port 80 and 443 open
- tgv 1y agoI have a server that has a slow (5s) response to unknown pages, returns it as 200, and makes the next failing request even slower (for unauthenticated users). That seems to keep the number of requests limited. Perhaps I should just drop the connection after a certain number of requests. BTW, quite a few of these port scanners are companies that offer to scan your ports for vulnerabilities. Temu pen testing, so to speak.
- 1970-01-01 1y agoWasn't it literally designed for that specific task? As a robust C&C system during nuclear war? The fact that we're doing it wrong doesn't mean we need to pull the plug on everything. How else do you survive WWIII? https://ieeexplore.ieee.org/document/5432117 https://ieeexplore.ieee.org/document/5432117
- groby_b 1y agoYou don't. Internet or not.
- 1718627440 1y agoThat only works, if the nodes still operate just fine, without the Internet.
- hypeatei 1y ago> needs to be a law that all nuclear and nuclear-adjacent facilities have no connection to the Internet You want to make everything about a nuclear facility bespoke and subject to air-gapped drift? What about the guard booth that verifies peoples access, the receptionist who schedules meetings, and the janitor who wants to watch YouTube on his break? It seems unrealistic to lump everything that goes on at a nuclear facility under this umbrella.
- reenorap 1y agoOpening up the internet to a nuclear facility so that the janitor can watch Youtube seems preposterous. People can afford to do things slower for the sake of security. Having things typed out, verifying security via phone calls, etc like it's the 1970s seems reasonable to me. Does it really matter if things aren't fully optimized for speed and convenience in nuclear facilities?
- hypeatei 1y ago> really matter if things aren't fully optimized for speed and convenience in nuclear facilities For hiring and retaining people, yes. It's understood that the "guts" of what's happening at these facilities needs to be locked down to the max. But, for supporting roles you need to be able to bring people in off the street without 1) a bunch of specialized training on your bespoke way of doing things, and 2) making your employees less attractive on the job market. Just my opinion, though. Maybe I'm completely off base but it doesn't seem like a good idea to me long-term.
- aerostable_slug 1y agoIRL the way we do it is separating the business network (Youtube, finance people, HR, etc.) from the operational network (relays and sensors). You use data diodes to send business-critical data from the operational network to the business network. Also, the Kansas City Plant is like a watchmaker's factory, not a power plant. They make widgets and gewgaws, not literally split atoms.
- 0_____0 1y agoBeing airgapped didn't help Iran avoid Stuxnet.
- sgjohnson 1y agoThat also had a HUMINT element.
- aspenmayer 1y agoIt’s possible that the (un)timely demise of the individual involved also had a HUMINT element as well. https://en.wikipedia.org/wiki/Operation_Olympic_Games#History https://en.wikipedia.org/wiki/Operation_Olympic_Games#Histor... > Dutch engineer Erik van Sabben allegedly infiltrated the Natanz nuclear facility on behalf of Dutch intelligence and installed equipment infected with Stuxnet. He died two weeks after the Stuxnet attack at age 36 in an apparent single-vehicle motorcycle accident in Dubai. https://en.wikipedia.org/wiki/Erik_van_Sabben https://en.wikipedia.org/wiki/Erik_van_Sabben
- bell-cot 1y agoNo, but it made the attacker's job 10000X more difficult.
- the_af 1y agoDefense in depth is still valuable.
- aspenmayer 1y agoTo be fair, it didn’t help the rest of us avoid Stuxnet, either. https://en.wikipedia.org/wiki/Operation_Olympic_Games#History https://en.wikipedia.org/wiki/Operation_Olympic_Games#Histor... > A programming error later caused the worm to spread to computers outside of Natanz. When an engineer "left Natanz and connected [his] computer to the Internet, the American- and Israeli-made bug failed to recognize that its environment had changed." The code replicated on the Internet and was subsequently exposed for public dissemination. IT security firms Symantec and Kaspersky Lab have since examined Stuxnet. It is unclear whether the United States or Israel introduced the programming error. Also bearing mention is Flame, which is often left out when Stuxnet comes up, but which was allegedly part of the wider operation. https://en.wikipedia.org/wiki/Operation_Olympic_Games#Significance https://en.wikipedia.org/wiki/Operation_Olympic_Games#Signif... > The Washington Post reported that Flame malware was also part of Olympic Games. https://www.washingtonpost.com/world/national-security/us-israel-developed-computer-virus-to-slow-iranian-nuclear-efforts-officials-say/2012/06/19/gJQA6xBPoV_story.html https://www.washingtonpost.com/world/national-security/us-is... | https://web.archive.org/web/20220322045917/https://www.washingtonpost.com/world/national-security/us-israel-developed-computer-virus-to-slow-iranian-nuclear-efforts-officials-say/2012/06/19/gJQA6xBPoV_story.html https://web.archive.org/web/20220322045917/https://www.washi... | https://archive.is/6hRl7 https://archive.is/6hRl7 > “We are now 100 percent sure that the Stuxnet and Flame groups worked together,” said Roel Schouwenberg, a Boston-based senior researcher with Kaspersky Lab. > The firm also determined that the Flame malware predates Stuxnet. “It looks like the Flame platform was used as a kickstarter of sorts to get the Stuxnet project going,” Schouwenberg said. https://en.wikipedia.org/wiki/Flame_(malware) https://en.wikipedia.org/wiki/Flame_(malware)
- wslh 1y agoMicrosoft could have been sold this with a special "nuclear license".
- porridgeraisin 1y agoFine, keep it on the internet. But SharePoint, seriously? A 15 year old version of nginx pointed to the ~/.ssh folder is more secure.
- bink 1y agoFrom the article: > OT cybersecurity specialists interviewed by CSO say that KCNSC’s production systems are likely air-gapped or otherwise isolated from corporate IT networks, significantly reducing the risk of direct crossover. Nevertheless, they caution against assuming such isolation guarantees safety. This was also not a nuclear facility, however. The article says it makes "non-nuclear components". In my experience auditing critical infrastructure, most facilities are "air gapped". I put that in quotes because while you can't browse the Internet from the control network(s), there are ways to exfiltrate data. The managers, engineers, regulators, and vendors need to know what is going on in real-time. Back in the day this could've been a serial port connecting two systems for a one-way feed. Now I imagine it's something far more sophisticated and probably more susceptible to abuse. As an example, you might have a collection of turbines manufactured by GE and GE needs to have real-time data coming from them for safety monitoring and maintenance. The turbines might have one connection for control traffic and another for monitoring. How to secure these vendor connections was always a debate. Btw, there are strong cybersecurity regulations around critical infrastructure. CIP-005-07 covers security perimeters. You can view them here: https://www.nerc.com/pa/Stand/Reliability%20Standards%20Complete%20Set/RSCompleteSet.pdf https://www.nerc.com/pa/Stand/Reliability%20Standards%20Comp...
- Veserv 1y agoAh yes, "likely air-gapped", what a high-confidence statement. Any competently designed air-gap must be precisely auditable and demonstrably, positively air-gapped. The only world where "likely" is a reasonable word is in reference to possible physical taps or a precise enumeration of physical access points that went unaudited, but have reliably followed safe access control/configuration procedures. Anything else is plain incompetence.
- nathanmcrae 1y agoHow do you go about positively demonstrating such a system is air-gapped?
- fintler 1y ago
- dylan604 1y agoIt is funny to read this kind of comment knowing at the same time this kind of stuff was happening while the launch codes were 0000000 or some such non-secure code. At same time, the computers in the nuclear launch facilities were still using 5.25" floppies. I did wonder how often they were loading updates from those, if ever.
- HippyTed 1y agoJust wait until these places get flooded with vibe coded stuff that even those deploying it have little understanding. What could go wrong!? Sleep well.
- schnitzelstoat 1y agoThe nuclear systems are air-gapped. So this is already the case.
- ubermonkey 1y agoA flaw? In Sharepoint? I'm shocked. Shocked, I tell you.
- synapsomorphy 1y agoSharepoint is one of the worst, most bug-ridden softwares I've worked with. It has a bug with Solidworks (3D design suite) that sporadically makes files completely un-openable unless you go in and change some metadata. They are aware of this, doesn't seem to be any limitation preventing them from fixing it, and it has sat unfixed for years. Microsoft's cloud storage as a whole is an insane tangle where you never know where you'll find something you're looking for or whether it will work. Some things work only in browser, some only in the app, zero enumeration of these things anywhere. Completely unsurprised and I'm sure there are many more vulnerabilities ripe for the picking.
- bArray 1y agoMicrosoft Word online deletes text in Firefox Linux (maybe others too) for at least two years now [1]. The one thing you want a text editor to do is be able to write text into a document, and somehow this bug goes unfixed. You would think it would be priority #1 for paying customers of Business Office 365 - and yet nothing. It ended up being easier just to switch to paid Overleaf and teach our non-tech members how to write LaTeX and/or use the built-in editor. The documents are beautiful, Overleaf doesn't miss a beat and we are very happy with their solution. Microsoft should be ashamed - I don't know how anybody would ever consider using them for any serious production work. [1] https://learn.microsoft.com/en-us/answers/questions/5216132/how-can-i-stop-the-web-version-of-word-from-deleti https://learn.microsoft.com/en-us/answers/questions/5216132/...
- rs186 1y agoNot defending Microsoft in any way but my guess of what's happening: * Too few people use Firefox to access Office online, they don't care * Your organization is too small for them to care
- bee_rider 1y agoFirefox is the only browser other than Chrome (and derivatives) on their OS. The web is supposed to be multi-platform. I guess it isn’t that surprising that modern MS is happy to just live in Google’s ecosystem though.
- OutOfHere 1y agoWhoever puts a nuclear fission facility on the internet should be put behind bars.
- deleted 1y ago[deleted]
- GuB-42 1y agoIt is not a nuclear fission facility, it is "a plant that produces the vast majority of critical non-nuclear components for US nuclear weapons". The also targeted the IT side, not the operational side, which, according to the article is likely to be airgapped. Even sensitive production facilities need some internet access, people work there and like everyone else, they need food, office supplies, toilet paper, etc... they can't be cut off the rest of the world completely.
- deleted 1y ago[deleted]
- OutOfHere 1y agoSomething tells me they also use it to order operational side materials, including nuclear gear and materials, from the IT side. To expose this on the internet screams of idiocy.
- GuB-42 1y agoHow are they supposed to contact their suppliers without email? Even for phone calls, they are probably using some kind of VoIP. For sensitive communication, they most likely encrypt and sign their messages on the airgapped side before moving it to the internet facing side and sending it using regular email. Not having internet access at all is like not having your building connected to public roads. That makes it harder (but not impossible) for bad guys to come, but it is so much of a hassle that almost no one does that. Instead, they use gates and checkpoints. Same idea for internet access. They have internet access, but they have security systems, from traditional firewalls and VPNs to airgaps. Security is about letting the good guys in while keeping the bad guys out, the latter is meaningless without the former. That's why security is hard, if is was just about blocking everything, it would be easy, but nothing would be done.
- zelphirkalt 1y agoHahaha, how stupid must anyone be to deploy SharePoint anywhere near anything of national security relevance! How can it still be a thing, that anyone entrusted with such sensitive matter dates to even touch MS products of the kind of SharePoint? That includes the complete MS Office 365 disaster suite, MS Teams and Edge. Sounds like they need to seriously redesign their security policies.
- givemeethekeys 1y agoBut, look at everything we get for free! /s
- count 1y agoI have some reaallllly bad news for you on that front.
- belter 1y agoWait until you hear about the guy storing Top Secret Nuclear documents in the public toilet of his resort....
- timeon 1y agoOr the one that invites journalist to Signal group during combat mission.
- belter 1y agoDown voting like it never happened... https://upload.wikimedia.org/wikipedia/commons/5/52/Classified_documents_at_Mar-A-Lago_1000-6.jpg https://upload.wikimedia.org/wikipedia/commons/5/52/Classifi...
- bcrosby95 1y agoIn general you'll get downvoted if you're talking about any politician or political party. You are allowed to shit on (or advocate for) the government doing stuff tho.
- 1y ago
- bhewes 1y agoAs a company that supports OT systems we hate seeing level 5 in the Purdue model with direct write access to level 1 and 0.
- cj 1y agoLink describing the acronyms in the above comment: https://www.paloaltonetworks.com/cyberpedia/what-is-the-purdue-model-for-ics-security https://www.paloaltonetworks.com/cyberpedia/what-is-the-purd...
- bhewes 1y agoThanks CJ, I live with that chart, but forget maybe most don't. And to add 4 to level 2-0 can also be an attack vector, but seeing straight 5 to 1-0 happens more then people want to admit even with the "firewalls"
- stefantalpalaru 1y ago[dead]
- photochemsyn 1y agoThe timeline here is interesting. Microsoft releases info and instructions for mitigation on July 19, and a more complete report on July 22nd, here's a copy of that: https://archive.ph/plNZU https://archive.ph/plNZU Then according to this report, 'sometime in August' the exploit is used against the Honeywell-managed nuclear facility, since it wasn't patched, if I read correctly? So it really could have been anyone, and it's hardly just Russia and China who have a record of conducting nuclear espionage in the USA using their nation-state cybercapabilities (Israel?). As the article notes: > "The transition from zero-day to N-day status, they say, opened a window for secondary actors to exploit systems that had not yet applied the patches." Also this sounds like basically everything that goes into modern nuclear weapons, including the design blueprints. Incredible levels of incompetence here. > "Located in Missouri, the KCNSC manufactures non-nuclear mechanical, electronic, and engineered material components used in US nuclear defense systems."
- AJRF 1y agoDoes this kind of thing happen to China + Russia? I don't see news about that much - but to be fair, I am not looking for it.
- enkonta 1y agoThey may also be less likely to admit it or allow any reporting on it
- ThinkBeat 1y agoyes. but it doesn't get covered by western media. much like how NATO airplanes violating Russian airspace is not reported about either.
- mmooss 1y ago> much like how NATO airplanes violating Russian airspace is not reported about either. How do you know it's happening?
- tryauuum 1y agoYes, recently some russian airline was hacked, they also used microsoft mail servers
- nakamoto_damacy 1y agoMicrosoft is a national security threat but no one cares because they automate genocide.
- nakamoto_damacy 1y ago[flagged]
- 36280132928226 1y ago[flagged]
- connorgurney 1y agoWhat a worthwhile contribution to the thread, though an ironic one, considering that you're echoing the very same sentiment - albeit reversed - that the person to whom you're replying did.
- mrguyorama 1y agoWhen I try to access sharepoint files in my browser, the site goes through 37 redirects (thanks single sign on) shows all the files, then despite me very obviously being fully authenticated, it pops up a modal that says "sign in to see files", and I click "Cancel" and then I get to actually interact with the files. What? Gee, who would have guessed this isn't secure.
- darepublic 1y agoThat guy who jumped the office chair will be the end of us all
- zkmon 1y agoThe jump was amazing though! At his age.
- stackskipton 1y agoAs usual with all these types of posts, people go "HA HA, MICRO$OFT SUCKS" without understanding business practices that keep them afloat. Don't use Exchange? Cool, what should we use instead? Does it support 15 people all the way up to 150000 people? I used to run Exchange cluster for 70k people, is there other mail software out there complete with non-shared disk redundancy? Where the users connect to single endpoint and software figures it out from there? Sharepoint with another 2 RCEs. Not shocked, the software is terrible. However, it's only software that will stand up under load and let us shard it easily. All open-source software is one of those, runs fine in Homelab, likely falls down under load. Few Open Source Developers want to work on this stuff which I get because it's tedious work interfacing with computer illiterate end users. I'd rather chug sewage then do this work for free. Finally, it's somewhat backwards compatible. Most businesses are filled with ancient software that no one has worked on in 20 years. That Excel document with Macros from 1997. With some registry changes degrading security posture, still works. I doubt you will find Office software with level of backwards compatibility unless they are using Microsoft Office level of compatibility. Microsoft has real gordian knot here and few solutions besides "Backwards compatibility is OVER. Upgrade to modern or GTFO". Meanwhile, I get hit up by $ThreeJobsAgo over some Exchange Web Services solution I slapped together for them in Python they wanted me to upgrade to GraphAPI since Microsoft turned off Exchange Web Services in Office365.
- bad_haircut72 1y agoI mean this is nuclear wepons were talking about, who cares about features vs security? They could run the department on snail mail if they tried
- nerdponx 1y ago> Few Open Source Developers want to work on this stuff which I get because it's tedious work interfacing with computer illiterate end users. I'd rather chug sewage then do this work for free. Or the government could pay people to work on said open source software, providing a benefit to the public along the way. The US government started something like this called "18F" under the Obama administration. It was so effective at making software that was useful to the American public that Trump promptly shut it down 2 months into his second term, in no small part because they had the temerity to develop free-to-use tax filing software. See https://handbook.tts.gsa.gov/18f/history-and-values/ https://handbook.tts.gsa.gov/18f/history-and-values/ https://web.archive.org/web/20250000000000*/https://handbook.tts.gsa.gov/18f/history-and-values/ https://web.archive.org/web/20250000000000*/https://handbook... https://archive.is/CIXG1 https://archive.is/CIXG1 and https://www.lawfaremedia.org/article/learning-from-the-legacy-of-18f https://www.lawfaremedia.org/article/learning-from-the-legac... https://web.archive.org/web/20250000000000*/https://www.lawfaremedia.org/article/learning-from-the-legacy-of-18f https://web.archive.org/web/20250000000000*/https://www.lawf... https://archive.is/fmaf6 https://archive.is/fmaf6
- MikeNotThePope 1y agoReminds me of https://howfuckedismydatabase.com/mssql/ https://howfuckedismydatabase.com/mssql/.
- int_19h 1y agoMSSQL is one of the few Microsoft products I would consider to be genuinely decent. Like, there's a lot of idiosyncratic stuff there (but then that's also true for Oracle), yet the feature set and stability are good.
- crmd 1y agoOne of the first things I do after getting an inquiry from a recruiter or friend referral is lookup the MX record for the company’s email domain. It is an anonymous one-command check to see if they’re a Microsoft shop. If they are, it’s enormous personal red flag. MSFT is very popular so I’m only speaking about my own experience, but I have learned over the course of 20 years that an MSFT IT stack is highly correlated with me hating the engineering culture of an organization. I know I am excluding a lot of companies with great engineering culture where I would thrive and who just happen to use Outlook/Sharepoint/Teams, etc. but it has had such better predictive power of rotten tech culture than any line of questioning I have come up with during interviews that I still use it. I don’t mean any disrespect to MSFT-centric engineers out there - it’s not you it’s me.
- unethical_ban 1y agoCompanies that don't use Outlook? All five of them? I've seen companies with varying levels of MS product integration but Outlook is pretty foundational. Now, if a company says they use SharePoint or Teams to store their documentation, run to the hills. Wikis or bust.
- nneonneo 1y agoGod, Teams is absolutely miserable. Video calling on Teams makes you appreciate just how well Zoom works. Teams macOS client? Crashes on startup, even after clearing all of my user data. Teams iOS client? You can join a call by a link, but you can't see the call UI because it's behind the login window. Teams on Firefox? No video support for years, and most recently just glitches out and shows an empty page when trying to join. Teams on Chrome? Tried joining a meeting, and was told by the organizers that they couldn't admit me because the button wasn't doing anything. I've had all four of these things happen within the last month, and it's made me want to tear my hair out. I get that none of these are "Microsoft Edge/native Windows client", but they could at least pretend to care about other platforms...
- sigmoid10 1y agoOver the years I have used teams on Windows, Mac, iOS, Android and various Linux distros (where I was limited to Chrome and Firefox due to lack of an official client). While it is certainly not the greatest tool in the world, I have never encountered issues like these.
- alexpotato 1y agoSo I once brought down an alerting system using Excel (btw, this story is more about unintended consequences instead of MSFT) - I own an alerting system - For log based alerts, it looks for a keyword e.g. "alert_log" - I make a spreadsheet to track data about alerts and call one of the sheets "alert_log" - Alert system starts going crazy: using tons of CPU, number of alerts processed goes through the roof but not a lot of alerts generated - Turns out that I was using the cloud version of Excel so any text entered transited the firewall - Firewall logs store the text "alert_log" - Alert system thinks it's an alert BUT it's not a real alert so triggers an alert processing alert - That second alert contains the text from the firewall log and so cycle begins In other words, systems can operate in weird ways and then cause things to happen you didn't anticipate. It's why things like audits, red teaming and defense in depth all matter.
- unethical_ban 1y agoAs a firewall engineer I have to tell people to make sure to disable traffic logs for syslogs from the firewall for this reason.
- _whiteCaps_ 1y agoReminds me of the time I set up tcpdump to log network traffic on a troublesome server. To save disk space I sent it over SSH to my laptop. Oops!
- lenerdenator 1y agoSide gripe: I'm sitting here with a very performant computer running its native web browser. It's ridiculous that I kept losing my place in that article because the page kept getting shifted to fit yet another damn ad (there were at least three in-view at all times as I was looking at it) onto the screen. Either make the ads fast and don't load the page until they're all there, or better yet, admit that online content isn't a way to make your private equity group even more obscenely rich, and cut back on the monetization that you put on it.
- AtNightWeCode 1y agoNo, they did not breach anything through SharePoint. The flaw is that IDIOTS exposed these servers to the Internet. I am very pro holding vendors accountable but this is just stupid. "Pro-tip" btw. SharePoint installations often have the pw sharepoint, sharepoint123, sharepoint-123 and so on in various casing and delimiters.
- deleted 1y ago[deleted]
- highfrequencyy 1y agothey breached it* meaning that they had access to their "Welcome !" page in sharepoint lol.
- exabrial 1y agoSay it ain’t so. Another Microsoft security problem? Inconceivable!
- tedggh 1y agoIf it is that bad why don’t we see it being exploited at scale? I work with many Fortune 500 companies and I would say 9/10 use SharePoint. Also some deployments are much better than others, so I would rather say many implementations of SharePoint are shit but if done right it’s actually pretty solid. There’s really no better alternative unless you want to maintain 5-10 separate tools owned by multiple vendors. I also don’t get the hate for Teams. I use Zoom, Slack even Discord for work and don’t have strong feelings for Teams. I can take calls, join meetings from my calendar, record them and summarize them with Copilot. I don’t need anything else and Teams does that just fine. I do like Discord ability to share multiple screens and jump into a channel to collaborate, particularly useful when debugging or pair programming.
- dijit 1y agoMost people treat Sharepoint for what it is, and only expose it internally. With Microsoft pushing o365 the “new” Sharepoint is SaaS instead, so Microsoft is exposing it to the internet on your behalf, but then they make a lot of effort to patch it and use WAFs on your behalf instead.
- nsm1232 1y ago[dead]
- nsm1232 1y ago[dead]
- wiredbox 1y agoNewsflash; nation state, or state sponsored hackers will gain access one way or another. The vector here just happens to be Sharepoint, but could've easily been something else, like a good old social engineering attack.
- ninalanyon 1y agoReducing the attack surface by not using cloud services would still help.
- ninalanyon 1y agoWhy is a weapons plant using any cloud services?
- zastai0day 1y agoLooking at the comments, it seems like everyone is just busy arguing about Microsoft versus other companies. Does anyone actually care about how this SharePoint vulnerability was exploited? If Microsoft had just contacted ZAST.AI earlier, I believe this security incident wouldn't even have happened.
- schnitzelstoat 1y agoIt seems like it was a minor incident affecting only a few systems and the real nuclear systems are airgapped anyway, so they were never at risk. Sensationalism gets more clicks though I guess.
- mikewarot 1y agoHow is this anything more than an Operating System issue? You should be able to run anything you want without risking the system. Systems that are both usable and secure were developed in the 1970s and 80s.
- buyucu 1y agoIf you use a Microsoft product for anything security sensitive, you only have yourself to blame when it inevitably goes wrong.
- MetroWind 1y agoIt's SharePoint. shrug~
- phs318u 1y agoFor the Outlook haters out there here's my 2c of anecdata. At home I use BetterBird, at work Outlook, and I used to use Apple Mail/Calendar on my phone. I access multiple mailboxes: Microsoft 365, Google Workplace and Apple iCloud. 1. There is no planet on which BetterBird/Thunderbird is better than Outlook as a mail client. None. 2. I hate having my mail and calendar apps separated, so on the phone moved from Apple Mail+Calendar to the Outlook iOS app. Been using it for a couple of years. Can't imagine going back. In my experience, the Outlook client provides features I want in a way that is usable across multiple clients. While I use BetterBird on my personal linux laptop (mainly for sync, so I always have a local copy of my mailboxes), I also use the web Outlook client (much more usable). On Linux I've also used Evolution - not a massive usability difference with the FooBird. If anyone can recommend a combined mail + calendar client for Linux that is polished and power-user functional, and can work well with differing mailbox providers, I'd love to give it a try.
- gizzlon 1y agoThunderbird is a good email client, and much better IMO than all web clients. Haven't used Outlook propper on Windows for a long time. But I did not like it, and I seriously doubt I would like it today. Have you used Thunderbird without Exchange? Is the calender functionality you don't like? (haven't used it)
- rurban 1y ago> The Department was minimally impacted due to its widespread use of the Microsoft M365 cloud and very capable cybersecurity systems. Are they completely disillusional? They nuclear arsenal is running on Microsoft M365?