SoylentNews is people
SoylentNews
from the negligent-cybersecurity-practices dept.
Microsoft has once again come under blistering criticism for the security practices of Azure and its other cloud offerings, with the CEO of security firm Tenable saying Microsoft is "grossly irresponsible" and mired in a "culture of toxic obfuscation."
The comments from Amit Yoran, chairman and CEO of Tenable, come six days after Sen. Ron Wyden (D-Ore.) blasted Microsoft for what he said were "negligent cybersecurity practices" that enabled hackers backed by the Chinese government to steal hundreds of thousands of emails from cloud customers, including officials in the US Departments of State and Commerce. Microsoft has yet to provide key details about the mysterious breach, which involved the hackers obtaining an extraordinarily powerful encryption key granting access to a variety of its other cloud services. The company has taken pains ever since to obscure its infrastructure's role in the mass breach.
Arthur T Knackerbracket has processed the following story:
Yoran has more to add to the senator’s arguments, writing in his post that Microsoft has demonstrated a “repeated pattern of negligent cybersecurity practices,” enabling Chinese hackers to spy on the US government. He also revealed Tenable’s discovery of an additional cybersecurity flaw in Microsoft Azure and says the company took too long to address it.
Tenable initially discovered the flaw in March and found that it could give bad actors access to a company’s sensitive data, including a bank. Yoran claims Microsoft took “more than 90 days to implement a partial fix” after Tenable notified the company, adding that the fix only applies to “new applications loaded in the service.” According to Yoran, the bank and all the other organizations “that had launched the service prior to the fix” are still affected by the flaw — and are likely unaware of that risk.
Yoran says Microsoft plans to fix the issue by the end of September but calls the delayed response “grossly irresponsible, if not blatantly negligent.” He also points to data from Google’s Project Zero, which indicates that Microsoft products have made up 42.5 percent of all discovered zero-day vulnerabilities since 2014.
“What you hear from Microsoft is ‘just trust us,’ but what you get back is very little transparency and a culture of toxic obfuscation,” Yoran writes. “How can a CISO, board of directors or executive team believe that Microsoft will do the right thing given the fact patterns and current behaviors?”
(Score: 5, Insightful) by Gaaark on Saturday August 05 2023, @01:45PM (13 children)
You can only blame MS for so much: at some point there is personal responsibility. Everyone knows MS sucks at everything they do, and Windows is, at best, a gaming platform.
Own up and reverse the trend. What is the TCO now?
Get off MS products. Cold turkey. It's not hard; it just takes being fed up enough.
Or, which will happen because people are weak, go as per usual.
--- Please remind me if I haven't been civil to you: I'm channeling MDC. I have always been here. ---Gaaark 2.0 --
(Score: 5, Insightful) by Runaway1956 on Saturday August 05 2023, @03:11PM (2 children)
I can't argue your additional points, but I think you can't heap enough blame upon Microsoft. Perhaps I could be more forgiving of their monopolistic history, if they actually offered a superior product. Perhaps. But, the fact is, MS has a long history of putting competitors out of business, some, or even all, of whom offered better products, with better security. A complete view of Microsoft's history condemns them as unfit to do business in this, or any other country. Seriously, how many times have they put a competitor out of business (or bought the competitor out in some cases) only to offer a crippled, less secure version of their own making? Embrace, extend, extinguish. They tried that with Java, unsuccessfully.
But, the rest of your post is on target. Given MS history, decision makers who decide to invest in MS products are just too damned stupid to be decision makers.
“I have become friends with many school shooters” - Tampon Tim Walz
(Score: 5, Insightful) by RS3 on Saturday August 05 2023, @03:37PM
That is the core problem.
Far too many critical technical decisions are made by business-types. It has haunted me all of my professional life. Being problem-solvers who are pretty much always up for a challenge, we technical-types accept the challenge (sometimes reluctantly) of making things work, staying on top of patches, updates, best security practices, etc. I often comment, cynically, that MS has created a huge number of jobs, that if they ever made a truly secure product, many IT workers would be laid off.
I'll give them credit for two things: their software development tools, example code, developer network, helps, APIs, etc., are pretty good. I don't happen to like them, but obviously tons of people do. I'll argue it's a bit of a "pile-on" / follow the crowd / they never really tried anything else.
Also MS is known for "innovation". Whether by their own ideas or stealing / buying others', they have always tried to make computers useful to the average person. But that's part of the problem: pushing (unnecessary) gadgets and "features" out to the market without truly testing them. But that's not MS- most companies I've worked for had that attitude: a race to the market, we'll worry about problems later. Sigh.
(Score: 5, Interesting) by Common Joe on Saturday August 05 2023, @04:25PM
Assuming it is backed by the Chinese government, this should surprise no one, as any place the U.S. government resides with data is a prime candidate for being a target.
It would not surprise me if Microsoft has some kind of back door for the U.S. government. I agree we can't ever heap enough blame upon Microsoft, but I think there is also a U.S. government component too.
(Score: 2) by mcgrew on Saturday August 05 2023, @06:54PM (1 child)
That's like demanding personal responsibility from auto drivers without having any drivers' tests or rules of the road.
You can't damn everyone for their ignorance, nobody knows everything and most people don't know jack shit about computers.
Impeach Donald Palpatine and his sidekick Elon Vader
(Score: 0) by Anonymous Coward on Saturday August 05 2023, @10:41PM
Fetch. Execute.
That's all a computer can do.
It just follows orders. To the letter. Unless it is faulty.
Just like most of us who obediently follow orders.
The problem lies in not holding the makers of orders accountable.
(Score: 2) by mhajicek on Saturday August 05 2023, @08:00PM (6 children)
Windows is the ONLY option for professional level CADCAM. That ties a few hands.
The spacelike surfaces of time foliations can have a cusp at the surface of discontinuity. - P. Hajicek
(Score: 2) by Gaaark on Saturday August 05 2023, @08:19PM (5 children)
Does it HAVE to be connected to the internet? That's where the attack vector usually is.
--- Please remind me if I haven't been civil to you: I'm channeling MDC. I have always been here. ---Gaaark 2.0 --
(Score: 4, Interesting) by RS3 on Saturday August 05 2023, @10:44PM (4 children)
A friend of mine does a lot of work in Solid Works. Years ago you could install it on stand-alone computers. He said now it won't run unless it can "phone home to mommy". I'm not sure if you can unplug the 'net after it's started up.
All that said, everyone should be behind some kind of firewall. No Windows machine should ever be directly connected to the 'net with no firewall. Most router/gateways have built-in firewall, and are usually default with all 'net-side ports are closed.
But that doesn't stop someone from checking email on said machine, and maybe receiving malware in an email that automatically opens the attachment. Or visiting a website that has javascript malware.
(Score: 3, Funny) by Gaaark on Saturday August 05 2023, @11:51PM (3 children)
You and your friend and everyone you know should contact the software makers and tell them you want to run their software on linux.
--- Please remind me if I haven't been civil to you: I'm channeling MDC. I have always been here. ---Gaaark 2.0 --
(Score: 2) by RS3 on Sunday August 06 2023, @01:16AM
And then we'll place bets on how long they'll laugh at us?
Even if they did produce a Linux version, it'd still phone home.
Oh, and I don't use Solid Works, and hope I never have to. Not because of the aforementioned problem, but it's very very complex 3D CAD and that's not my jam. Jamb?
(Score: 2) by mhajicek on Sunday August 06 2023, @02:47AM
If you pay them less than $100,000/year for license maintenance, your not even a bug on their windshield.
The spacelike surfaces of time foliations can have a cusp at the surface of discontinuity. - P. Hajicek
(Score: 2) by Freeman on Monday August 07 2023, @04:07PM
Makes me kind of wonder, if you could run it via WINE.
Ah, so I guess the answer to that question is generally "No", because it is garbage. At least that's the rating it's generally getting on WINEHQ "Garbage."
https://appdb.winehq.org/objectManager.php?sClass=application&iId=318 [winehq.org]
It did accidentally get a Silver rating in 2008 and 2010. They fixed that later, though.
Joshua 1:9 "Be strong and of a good courage; be not afraid, neither be thou dismayed: for the Lord thy God is with thee"
(Score: 2) by DannyB on Tuesday August 08 2023, @02:41PM
It's like asking people to get off of Oracle.
Or asking them to get off of crack.
The only way to stop a bad guy with a can opener is a good guy with a can opener.