SolarWinds hacking campaign puts Microsoft in hot seat | Hacker News Reader

SolarWinds hacking campaign puts Microsoft in hot seat

apnews.com

43 pointsmikece22 comments

They shouldn't blame Microsoft. They should blame themselves for using microsoft

I am not really following the article, somehow I mostly see ads. Not sure if it's some content is missing for me.

If you install a piece of software which does monitoring of your IT infrastructure in your servers, and that software has malware in it which collects info it shouldn't, wouldn't you have the same issue regardless of what OS you are using?

It's absurd that I have to block hundreds of unwanted, expensive (on mobile data) requests.

The page is nearly unreadable without it. https://i.imgur.com/DlCy3J4.png Several paragraphs of text. WTF?

> But it [Microsoft] also seeks to deflect blame, saying it is customers who do not always make security a priority.

> ...Microsoft was itself compromised by the SolarWinds intruders

Microsoft need to take responsibility for the security of their products. Vulnerabilities need to be fixed not sent to other companies for add-on virus scanners to detect.

Applications shouldn’t be able to run amok with admin passwords. I’d guess a more sandboxed bespoke permission is needed (do you give application x permission to access this part of the file system)

Windows is a mess. I don't expect it to be any secure in the following years.

It is unlikely that non-admin permissions were able to stop the attack. the amount of 0-day EOP's within windows is ridiculous, truly unbelievable.

Modern Windows is more secure by default than most GNU/Linux distributions.

The only Linux distribution that beats it is Android, with LinuxSE, seccomp, userspace drivers (Treble), hardned access to native code, one user per app and sandbox enabled by default.

Respectable linux distros(not just android!) use SE, sandboxing etc.

Windows lags far behind OS's like Android, iOS and even ChromeOS when it comes to security.

Pity that CVE database proves otherwise.

Where are the driver validation tools with a Z3 theorem prover for Linux drivers?

Where is the SAL static analysis for C and C++ kernel code like Windows has since XP SP2?

Where is the majority of userspace code implemented in managed languages like .NET?

You can clearly see that from data. looking at 0-day disclose, black market exploit prices and attacks in the wild.

0-day exploits for both iOS and Android are 3 times as costly as windows.

You're looking at linux as it is but linux as it is not what you should compare it to. Android\iOS or even something like Red Hat should be the comparison point.

I see it from CVE database.

Naturally I look at GNU/Linux, that is what average Joe gets on their computers.

iOS is not Linux thus not even part of this conversation.

Also Android\iOS in general as a platform is more secure, Android\iOS are far more restrictive when it comes to users. narrowing the attack surface for casual users.

For instance, rooting in order to install custom drivers\software is very difficult.

A single place to download content(App store) which provide tremendous control over content. detection of rogue apps, removal once they turn rogue, check assurance.

Seamless updates through a single pane of glass.(App Store again)

Pity that almost no one uses them as desktop platforms.

Windows store and Windows Sandbox is way more advanced than any GNU/Linux offering, including kernel and hardware sandoxing with help of hardware protections.

Still waiting for snap and flatpak to finally fix their security holes.

The Windows sandbox infrastructure may well be more advanced than seccomp in the sense of being more complicated, but I would argue that makes it worse, not better. There are many sandbox escapes based on the insane complexity of Windows integrity levels. In contrast, there have been maybe 5 known Linux kernel bugs allowing a breakout from a strict seccomp policy in the last few years.

What hardware vendor does sell GNU/Linux systems already pre-configured with such policies?

What hardware vendor sells the Windows sandbox preconfigured with policies?

Chromium and Firefox configure the Windows sandbox and seccomp on Windows and Linux respectively. I would argue that seccomp is better.

On the other hand, Windows has its app sandbox and Linux has snap and flatpak. I don’t think any of them are amazing.

I work on a use case that leverages Samsung DeX and secondary displays with keyboard/mouse. Applications are refactored to run on native Android, or accessed on HTML5 sites. What Win32 is left is accessed on VDI.

The solution supports MFA step-up auth to login to device, local print, proxy's traffic, per app vpn. Endpoint threat detection products for Android have more capabilities than ever. You can specify approved IP addresses, countries that traffic can communicate with. You can provide a list of approved WiFi BSSID.

With these mobile security SDK's embedded in native Android apps, functionality with the apps can be limited based on threat infractions.

E.g. - if the device magically became rooted while authenticated in android native app, or connects to rogue BSSID; the app performs whatever actions (terminates vpn to intranet, logs threat event on public facing endpoint, force re-authenticate with MFA.)

Great, in what shop can someone buy it?

Where can someone buy Samsung DeX? I believe it is natively supported on all Samsung devices. E.g. - it is possible to buy a Samsung Tab S7 at a retail store, use a secondary display with built in USB-C PDP, and then bluetooth keyboard/mouse for interaction.

If you are looking to replicate the setup with MFA, proxy, per-app vpn and more; VMware's Workspace ONE product lineup will, along with Zimperium's mobile security SDK. While we can't rewrite all your apps from Win32 to Android for you, we can help you rewrite them to use OIDC and auth with a IDP of your choice.

Full disclosure; I work at VMware.

Personally, I think the power savings along is impressive. A tablet consumes a fraction of the power of a thin client running VDI or mATX desktop. Users get a device that feels modern, mobile-by-default and cutting edge. The business gets to realize electricity savings. At the same time, the business gets to redesign apps and services to run on mobile, so they can get rid of tech debt in win32 app design choices.

So a specialized setup, no different than typical IT setups that most Windows shops already have in place with AD, policy groups and hardware assisted sandboxing.

And completely out of reach as the typical setup most people buy for their homes.

> Risks in Microsoft’s foreign dealings also came into relief when the Biden administration imposed sanctions Thursday on a half-dozen Russian IT companies it said support Kremlin hacking. Most prominent was Positive Technologies, which was among more than 80 companies that Microsoft has supplied with early access to data on vulnerabilities detected in its products. Following the sanctions announcement, Microsoft said Positive Tech was no longer in the program and removed its name from a list of participants on its website.

What?! Microsoft gave vulnerability data to a Russian company that hacked the USA? Why was that company even in this program to begin with?

Isn't it obvious? Tech has a clear blind spot for geopolitics. Saying anything critical of China or Russia, even if well-founded, is a great way to get downvotes and be stamped as propaganda or parroting propaganda. It's representative for how these companies and their employees view these issues.

So it's funny and depressing to see a comment here questioning why a Russian company was allowed to join a program like this after a massive hack by Russian entities, when Russian efforts in this sphere are more than well-documented.

It is a, presumably successful, billion dollar cyber security company, that did lots of legitimate work too.

As were talking about state intelligence agencies, I would guess several of the other 80 companies are also leaking information, either through the company or employees.

Reply on news.ycombinator.com