SolarWinds hacking campaign puts Microsoft in hot seat

https://apnews.com/article/politics-malware-national-security-email-software-f51e53523312b87121146de8fd7c0020

by mikece • 5 years ago

43 22 5 years ago

Risks in Microsoft’s foreign dealings also came into relief when the Biden administration imposed sanctions Thursday on a half-dozen Russian IT companies it said support Kremlin hacking. Most prominent was Positive Technologies, which was among more than 80 companies that Microsoft has supplied with early access to data on vulnerabilities detected in its products. Following the sanctions announcement, Microsoft said Positive Tech was no longer in the program and removed its name from a list of participants on its website.

What?! Microsoft gave vulnerability data to a Russian company that hacked the USA? Why was that company even in this program to begin with?

Hiopl• 5 years ago

Isn't it obvious? Tech has a clear blind spot for geopolitics. Saying anything critical of China or Russia, even if well-founded, is a great way to get downvotes and be stamped as propaganda or parroting propaganda. It's representative for how these companies and their employees view these issues.

So it's funny and depressing to see a comment here questioning why a Russian company was allowed to join a program like this after a massive hack by Russian entities, when Russian efforts in this sphere are more than well-documented.

helsinkiandrew2• 5 years ago

It is a, presumably successful, billion dollar cyber security company, that did lots of legitimate work too.

As were talking about state intelligence agencies, I would guess several of the other 80 companies are also leaking information, either through the company or employees.

helsinkiandrew2• 5 years ago

But it [Microsoft] also seeks to deflect blame, saying it is customers who do not always make security a priority.
...Microsoft was itself compromised by the SolarWinds intruders

Microsoft need to take responsibility for the security of their products. Vulnerabilities need to be fixed not sent to other companies for add-on virus scanners to detect.

Applications shouldn’t be able to run amok with admin passwords. I’d guess a more sandboxed bespoke permission is needed (do you give application x permission to access this part of the file system)

CyberRage4• 5 years ago

Windows is a mess. I don't expect it to be any secure in the following years.

It is unlikely that non-admin permissions were able to stop the attack. the amount of 0-day EOP's within windows is ridiculous, truly unbelievable.

pjmlp7• 5 years ago

Modern Windows is more secure by default than most GNU/Linux distributions.

The only Linux distribution that beats it is Android, with LinuxSE, seccomp, userspace drivers (Treble), hardned access to native code, one user per app and sandbox enabled by default.

grumpyautist• 5 years ago

They shouldn't blame Microsoft. They should blame themselves for using microsoft

tuwtuwtuwtuw• 5 years ago

I am not really following the article, somehow I mostly see ads. Not sure if it's some content is missing for me.

If you install a piece of software which does monitoring of your IT infrastructure in your servers, and that software has malware in it which collects info it shouldn't, wouldn't you have the same issue regardless of what OS you are using?

ev1• 5 years ago

It's absurd that I have to block hundreds of unwanted, expensive (on mobile data) requests.

The page is nearly unreadable without it. https://i.imgur.com/DlCy3J4.png Several paragraphs of text. WTF?

SolarWinds hacking campaign puts Microsoft in hot seat

Related Stories