> "We have no indication of this," company President Brad Smith told New York Times reporter Nicole Perlroth. Perlroth said the company stood by a statement it issued on Sunday saying it had no indication of a vulnerability in any Microsoft product or cloud service in its investigations of the hacking campaign."
I find that not applying electricity to computers makes them perform with flawless reliability. I had an old, dorm refrigerator-sized server as an end table for many years. It never failed.
Edit: Nobody else ever gave it instructions that went counter to mine, either. Security vulnerabilities are 100% non-exploitable without power. I should probably start an anti-APT business with that knowledge.
As I understand it from my readings here on HN, that will be a major undertaking, since the malicious software that Microsoft discovered in its systems is actually Windows 10.
I must be experiencing a real case of the Baader-Meinhof phenomenon. I hadn't noticed this attitude towards Rust until yesterday, and now I've seen it multiple times since then.
I cannot wait until we are able to afford to run our critical business infrastructure on our own computers (again).
I have a lot of trust in Microsoft & Amazon, but with the complexity of their organizations, there is no way they can provide the same kind of security assurances as if I were to have my own locked cage at some colo. Certainly, you could spin a fantastical tale about how AWS's 23+ layer physical security perimeter is superior to whatever is available at my local facilities. But, I have grown to classify this sort of stuff under the "what if 2 SHA256 hashes collide" category of fear-driven development.
I almost have to convince myself on a daily basis now that "everything is fine" with how we are currently using the cloud. The selling points for moving to the cloud are very powerful and I agree with most of them. But at the same time, the idea that you are locked into this same combined fate as everyone else leaves me with the constant sensation that I should have brought a parachute with me.
It's scary what was once called "spyware", "malware", "adware" or "other"-ware has become so commonplace and accepted.
You type in Windows 10 search and it sends your keystrokes to Microsoft, you log into Windows 10 OS (and they push hard for this during setup, they actively make it hard to use an "offline" profile) and it records your every interaction with that computer; with "full" telemetry it records every web page you visit, every app you launch, every app that has an error (you can download an app from MS store to see what telemetry W10 is sending to MS, it's quite illuminating)
These days, more and more of society expects you to have a smartphone and "apps"; "please can you scan a QR code to enter this restaurant". A supermarket has an app and offers in-store discounts on food, your data subsidizes the cost of what you purchase. Many offers are locked behind a social contract of "you give me data and I'll give you some money off". It's amusing to see how 'cheap' people are and how much data they are willing to freely give away in the name of a very very small discount (the data is worth much more than the savings you are getting).
An always online, always connected fully digital society is prone to attacks, hacks and disturbances. We've seen hospitals held to ransom and have paid bitcoins to get critical machines working again, something that shouldn't even be possible, yet one person who opens $phishingEmail.exe can bring down an entire network.
Our life is essentially in the hands of crudely built machines, with absolutely no security against basic human errors - and we trust these with the very foundation of society. One day we will witness a truly devastating hack, a disturbance unlike anything we've known previously, and it'll likely be as devastating as the Beirut explosion. It's not an if, but a when.
I want to return to a time without cars or computers, even just for a brief period (the lockdown was so nice this year. the hum of the birds and not the thunder of engines was a blessing).
I believe it'll happen as soon as on-premise hosting is given a marketing-friendly name. Like "cloudless". Host your containers in a cloudless habitat, at a fraction of the cost!
It will be hailed as a hallmark of innovation. Any voices claiming that such a thing has always been possible will be tutted.
Why do we think that 'our own servers' gives us 'better security'?
I think this is the illusion of control.
"security assurances as if I were to have my own locked cage at some colo."
'Locked cage' - is not going to help us secure it from the kind of intrusion we are afraid of.
Scale means more layers of vms, more redundancy, more sophisticated security teams etc..
Physically, Fort Knox has never been robbed, whereas any mom and pop shop can be.
I'm really surprised the US Military has not been working with the FAANGS to produce a new OS that is fundamentally more secure and containerized, including a networking stack with identity built right in, and of course, working on easy solutions for the user side of the equation as well to thwart social attacks. And maybe possibly systems architecture groupings to bifurcate systems from one another.
Security resources are sparse and large companies pay lots of money and hire them away. So attempting to defend by yourself could leave you more vulnerable. Probably a middle ground is the best- to benefit from expertise on both sides.
I’d love to trust Microsoft. They have a lot of talented people working on a lot of cool things.
But, they voluntarily collaborated with the US Government to spy on their users at home and abroad, and those people are still in charge, as far as I know.
btw, one attack vector was that on premise is connected to azure ad and the on premise installation already had malware and the malware stealed security tokens.
I find it extremely ironic. I’m currently finishing “Countdown to Zero Day” and some people are saying that NOBUS (nobody but us) doctrine reduces the attack surface considerably. Some other people highlight this mentality as extremely dangerous from a defense standpoint.
Ten years after Stuxnet/Flame saga, USA is experiencing a same kind of attack and their stated preparedness has not improved from the levels stated in that book.
It’s fascinating.
Edit: No. I’m not enjoying this. There’s no schadenfreude.
Almost everyone has lost personal information to such hacks at some point or the other. Critical infrastructure (e.g. hospital systems) has been held for ransom. National elections have been swayed by state-sponsored actors. Companies have lost plenty of IP to foreign competitors and governments.
They are already weaponized, and have been for a while. The time to start taking information security seriously was 15 years ago.
What makes you say this? I thought it was a common rumor that the NSA had backdoors in everything. Wouldn't Mutually Assured Destruction make an attack irrational, just as it deters nuclear attacks?
This is precisely the reason why I'm against moving everything to the cloud. Find your way into AWS or Azure and you will have everything on a silver platter.
Honestly, this is a weird fucking hack. The update went out signed by Solar Winds. Somehow, they got this payload into the build-chain their developers use.
On Friday last week, SWI was trading around 23.5. Today it closed around 14.2, so it looks like the big money investors are betting on SolarWinds-the-business being toast. Even if it does survive, if it doesn't somehow stage a miracle recovery very quickly, the current senior leadership are surely done as soon as they've finished being ritually sacrificed so their replacements don't get saddled with too much of the fallout.
As another potentially interesting data point, SWI still appears to have a P/E close to 120 even now. Given that traditional value investors might consider something closer to 20 to be reasonable for an established business and the huge ratios of many big tech stocks only make sense if you think they're going to continue the dramatic growth some of them have enjoyed for a while, there could still be a long way for stocks in SWI to fall even if they do eventually stabilise.
I don’t even know where to begin you can put in a 1000 firewalls or anti malware or greater defense systems , but apparently nothing would have stopped this?
I have been searching and it looks like this is specific to Microsoft Systems, though other systems may have helped spread it. From a couple of articles I found, the issue was in file SolarWinds.Orion.Core.BusinessLayer.dll
The reason I looked was because I never saw anything stating what OS are directly impacted, all they talked about was how bad it was.
I now understand why Microsoft is pushing so many articles about this issue (outside of the fact it looks like it is a big problem for lots of companies/gov/people).
[+] [-] ipsum2|5 years ago|reply
From yesterday:
> "We have no indication of this," company President Brad Smith told New York Times reporter Nicole Perlroth. Perlroth said the company stood by a statement it issued on Sunday saying it had no indication of a vulnerability in any Microsoft product or cloud service in its investigations of the hacking campaign."
[+] [-] justincormack|5 years ago|reply
[+] [-] unknown|5 years ago|reply
[deleted]
[+] [-] octoberfranklin|5 years ago|reply
[+] [-] bregma|5 years ago|reply
[+] [-] EvanAnderson|5 years ago|reply
Edit: Nobody else ever gave it instructions that went counter to mine, either. Security vulnerabilities are 100% non-exploitable without power. I should probably start an anti-APT business with that knowledge.
[+] [-] kazinator|5 years ago|reply
[+] [-] DataCrayon|5 years ago|reply
[+] [-] dboreham|5 years ago|reply
[+] [-] young_unixer|5 years ago|reply
The language could be C, C++, Rust, Zig. But the design is more important than the language.
Of course, no one with enough resources to do this cares enough to do it.
[+] [-] ASalazarMX|5 years ago|reply
[+] [-] unknown|5 years ago|reply
[deleted]
[+] [-] SCUSKU|5 years ago|reply
[+] [-] dvfjsdhgfv|5 years ago|reply
[+] [-] Torwald|5 years ago|reply
[+] [-] bob1029|5 years ago|reply
I have a lot of trust in Microsoft & Amazon, but with the complexity of their organizations, there is no way they can provide the same kind of security assurances as if I were to have my own locked cage at some colo. Certainly, you could spin a fantastical tale about how AWS's 23+ layer physical security perimeter is superior to whatever is available at my local facilities. But, I have grown to classify this sort of stuff under the "what if 2 SHA256 hashes collide" category of fear-driven development.
I almost have to convince myself on a daily basis now that "everything is fine" with how we are currently using the cloud. The selling points for moving to the cloud are very powerful and I agree with most of them. But at the same time, the idea that you are locked into this same combined fate as everyone else leaves me with the constant sensation that I should have brought a parachute with me.
[+] [-] aboringusername|5 years ago|reply
You type in Windows 10 search and it sends your keystrokes to Microsoft, you log into Windows 10 OS (and they push hard for this during setup, they actively make it hard to use an "offline" profile) and it records your every interaction with that computer; with "full" telemetry it records every web page you visit, every app you launch, every app that has an error (you can download an app from MS store to see what telemetry W10 is sending to MS, it's quite illuminating)
These days, more and more of society expects you to have a smartphone and "apps"; "please can you scan a QR code to enter this restaurant". A supermarket has an app and offers in-store discounts on food, your data subsidizes the cost of what you purchase. Many offers are locked behind a social contract of "you give me data and I'll give you some money off". It's amusing to see how 'cheap' people are and how much data they are willing to freely give away in the name of a very very small discount (the data is worth much more than the savings you are getting).
An always online, always connected fully digital society is prone to attacks, hacks and disturbances. We've seen hospitals held to ransom and have paid bitcoins to get critical machines working again, something that shouldn't even be possible, yet one person who opens $phishingEmail.exe can bring down an entire network.
Our life is essentially in the hands of crudely built machines, with absolutely no security against basic human errors - and we trust these with the very foundation of society. One day we will witness a truly devastating hack, a disturbance unlike anything we've known previously, and it'll likely be as devastating as the Beirut explosion. It's not an if, but a when.
I want to return to a time without cars or computers, even just for a brief period (the lockdown was so nice this year. the hum of the birds and not the thunder of engines was a blessing).
[+] [-] politelemon|5 years ago|reply
It will be hailed as a hallmark of innovation. Any voices claiming that such a thing has always been possible will be tutted.
[+] [-] jariel|5 years ago|reply
I think this is the illusion of control.
"security assurances as if I were to have my own locked cage at some colo."
'Locked cage' - is not going to help us secure it from the kind of intrusion we are afraid of.
Scale means more layers of vms, more redundancy, more sophisticated security teams etc..
Physically, Fort Knox has never been robbed, whereas any mom and pop shop can be.
I'm really surprised the US Military has not been working with the FAANGS to produce a new OS that is fundamentally more secure and containerized, including a networking stack with identity built right in, and of course, working on easy solutions for the user side of the equation as well to thwart social attacks. And maybe possibly systems architecture groupings to bifurcate systems from one another.
[+] [-] youeseh|5 years ago|reply
[+] [-] kerng|5 years ago|reply
[+] [-] yunesj|5 years ago|reply
I’d love to trust Microsoft. They have a lot of talented people working on a lot of cool things.
But, they voluntarily collaborated with the US Government to spy on their users at home and abroad, and those people are still in charge, as far as I know.
[+] [-] unknown|5 years ago|reply
[deleted]
[+] [-] merb|5 years ago|reply
[+] [-] cblconfederate|5 years ago|reply
[+] [-] bayindirh|5 years ago|reply
Ten years after Stuxnet/Flame saga, USA is experiencing a same kind of attack and their stated preparedness has not improved from the levels stated in that book.
It’s fascinating.
Edit: No. I’m not enjoying this. There’s no schadenfreude.
[+] [-] joenathanone|5 years ago|reply
[+] [-] paxys|5 years ago|reply
They are already weaponized, and have been for a while. The time to start taking information security seriously was 15 years ago.
[+] [-] TheAdamAndChe|5 years ago|reply
[+] [-] textech|5 years ago|reply
[+] [-] vsareto|5 years ago|reply
[+] [-] djsumdog|5 years ago|reply
Honestly, this is a weird fucking hack. The update went out signed by Solar Winds. Somehow, they got this payload into the build-chain their developers use.
[+] [-] dboreham|5 years ago|reply
[+] [-] Silhouette|5 years ago|reply
As another potentially interesting data point, SWI still appears to have a P/E close to 120 even now. Given that traditional value investors might consider something closer to 20 to be reasonable for an established business and the huge ratios of many big tech stocks only make sense if you think they're going to continue the dramatic growth some of them have enjoyed for a while, there could still be a long way for stocks in SWI to fall even if they do eventually stabilise.
[+] [-] maxerickson|5 years ago|reply
[+] [-] jen729w|5 years ago|reply
Not any more.
[+] [-] insert_coin|5 years ago|reply
[+] [-] pedro2|5 years ago|reply
[+] [-] nix23|5 years ago|reply
[+] [-] desireco42|5 years ago|reply
[+] [-] yogthos|5 years ago|reply
[+] [-] tpmx|5 years ago|reply
[+] [-] totaldude87|5 years ago|reply
May be a stricter password policy and git scan?
[+] [-] jmclnx|5 years ago|reply
The reason I looked was because I never saw anything stating what OS are directly impacted, all they talked about was how bad it was.
I now understand why Microsoft is pushing so many articles about this issue (outside of the fact it looks like it is a big problem for lots of companies/gov/people).
[+] [-] legulere|5 years ago|reply
[+] [-] wintorez|5 years ago|reply
[+] [-] msoucy|5 years ago|reply
[+] [-] nfoz|5 years ago|reply
[+] [-] meow_mix|5 years ago|reply
[+] [-] arminiusreturns|5 years ago|reply