Oh no, a scathing report, that is the government's most powerful tool against businesses. Surely something will come of this.
this post was submitted on 03 Apr 2024
164 points (98.8% liked)
News
23259 readers
2794 users here now
Welcome to the News community!
Rules:
1. Be civil
Attack the argument, not the person. No racism/sexism/bigotry. Good faith argumentation only. This includes accusing another user of being a bot or paid actor. Trolling is uncivil and is grounds for removal and/or a community ban. Do not respond to rule-breaking content; report it and move on.
2. All posts should contain a source (url) that is as reliable and unbiased as possible and must only contain one link.
Obvious right or left wing sources will be removed at the mods discretion. We have an actively updated blocklist, which you can see here: https://lemmy.world/post/2246130 if you feel like any website is missing, contact the mods. Supporting links can be added in comments or posted seperately but not to the post body.
3. No bots, spam or self-promotion.
Only approved bots, which follow the guidelines for bots set by the instance, are allowed.
4. Post titles should be the same as the article used as source.
Posts which titles don’t match the source won’t be removed, but the autoMod will notify you, and if your title misrepresents the original article, the post will be deleted. If the site changed their headline, the bot might still contact you, just ignore it, we won’t delete your post.
5. Only recent news is allowed.
Posts must be news from the most recent 30 days.
6. All posts must be news articles.
No opinion pieces, Listicles, editorials or celebrity gossip is allowed. All posts will be judged on a case-by-case basis.
7. No duplicate posts.
If a source you used was already posted by someone else, the autoMod will leave a message. Please remove your post if the autoMod is correct. If the post that matches your post is very old, we refer you to rule 5.
8. Misinformation is prohibited.
Misinformation / propaganda is strictly prohibited. Any comment or post containing or linking to misinformation will be removed. If you feel that your post has been removed in error, credible sources must be provided.
9. No link shorteners.
The auto mod will contact you if a link shortener is detected, please delete your post if they are right.
10. Don't copy entire article in your post body
For copyright reasons, you are not allowed to copy an entire article into your post body. This is an instance wide rule, that is strictly enforced in this community.
founded 1 year ago
MODERATORS
As I predicted back in 2023 and here it is on the 2nd Paragraph of the 3rd page.
"In fact, when combined with another flaw in Microsoft’s authentication system, the key permitted Storm-0558 to gain full access to essentially any Exchange Online account anywhere in the world."
The attackers weren't just in GovCloud, they had access to ALL of it and Microsoft STILL doesn't know how the attackers obtained a copy of their Private Crypto Key.
JFC what a bunch of bozos.
Angry letters always have the biggest impact.
Its like that exercise where you
- Write angry letter
- send it
- they put it in the drawer (garbage) and don't read it
I thought US Gov had their own email systems. When did they start moving officials' mailboxes to Microsoft?
During my time contracting in the FedGov, they went "all in" on Microsoft products. From email to Teams to other products, they were becoming a Microsoft shop top to bottom. This was fine for products which were fully mature. For all the jokes about it, Microsoft email is actually pretty good. Azure AD is fine, as long as you have a team of sysadmins to unfuck permissions issues. Permissions will get fucked, as there is a dearth of tools for mapping them. But, that's been a perennial problem with AD permissions well back to the NT 4.0 days (maybe longer, I was dealing with Novell before that). And there isn't much better for centralized user management than AD, though third party PAM tools do help here, a lot. Their security tools were (and still are) shit on toast from a usage perspective. Seriously, the only reason people choose MS Defender anything is because "no one ever got fired for choosing ~IBM~ Microsoft".
The main problem is that Microsoft is a "for profit" company. This means that there will always be tension between Security and Profit. So, it's unsurprising that they have a lax security culture. Security isn't profitable. The appearance of security is, and I have little doubt Microsoft will be able to roll out all kinds of documentation showing that they were "compliant" with all the required security controls. This means exactly dick, as it's easy to have insecure systems be "fully compliant" and then do exactly fuck all to actually secure the systems. "Compliant" is a baseline and only proves that you're not going to get hacked within the first ten minutes of plugging a network cable in. Actually securing the system means a lot of people, processes and efforts finding and fixing holes not covered by the baselines and watching the network for anomalies. That's really expensive and makes ITs job a pain a lot of times. It also makes no money, as it doesn't do much to enhance the appearance of security, so it tends to get ignored and eventually cut. The end result is exactly what we have here today, a major hack which didn't get picked up on for weeks.
Govcloud
China has scared the US into abandoning neoliberalism, rethinking globalization, and becoming more isolationist and protectionist. I think China has also convinced the Federal government that more state involvement in the economy is necessary. Perhaps this will move the US in the direction of a more state directed market economy, much like, well, China. It's fascinating how much influence our "enemies" can have on us.
Sorry... you think neoliberalism is a good thing?
Who did you vote for in the Republican primary?
No, I don't support neoliberalism. The point of my comment wasn't to lament the death of neoliberalism, it was to point out how remarkable it is that China got Washington to turn against its own policies. The US has been trying to push the "Washington consensus" on the rest of the world for nearly half a century, only to do a total 180 now that they realize their policies might be a threat to their own national security. I find it very ironic.
If, as I think you're saying, there was a thought that engaging with China in the free market would create more democratic-like conditions there but the US Gov'ts involvement in the open-market of email services (Micro$oft) has had the opposite effect and possibly taught them to not hand over everything to the free market for problems exactly like this, then, yeah, that's ironic.
However - and this should not be glossed over - any organization be it private, state, federal, nonprofit - whatever - who doesn't maintain their own email servers and connectivity is essentially abandoning its security posture to other companies.
That's standard practice of course, and one of Micro$oft's big selling points: "we'll handle everything, just sign here". But of course they're average at it, and they can't be everywhere at once. Most people are average-to-awful at it, because computer security is amazingly complicated once you dig into any given aspect of it. Not letting Micro$oft off the hook - they absolutely made bad trade-offs and opened the government up to Chinese hackers - just that anyone who thinks you can just contract someone else to do your information security and all is well is really not making a good decision.
We've outsourced everything and the stupid electronic agreements that say what the conditions are don't mean a damned thing. What, is Micro$oft going to pay a fine equal to ten minutes of their profits?
And here's the point - it was always the case. We argued against signing everything over to Micro$oft for decades and here we are. It's never been any different. No one should be surprised at all. We were always going to end up here, sooner or later.
I don't know that I agree with their conclusions, but I don't see them saying what you're implying. Including in their post history.
Maybe they don't know what neoliberalism is then (and possibly not you either):
Neoliberalism is contemporarily used to refer to market-oriented reform policies such as "eliminating price controls, deregulating capital markets, lowering trade barriers" and reducing, especially through privatization and austerity, state influence in the economy.
They only spoke to trends. No endorsement of an ideology.
You inferred, then implied in your question. It's a classic miscommunication, but it creates hostility and can seem like operating in bad faith.
In life's great big does-this-matter-heaps-a-tron... Not a lot. But I'd hope lemmy can avoid the reddit instinct to be contrary or begin by assuming a person is wrong.
Lol at US officials using ms mail. Who comes up with those ideas?
I'm not sure other countries are much brighter in that regard though.
Business people who don't understand computers. They still run everything and still make these bad decisions. It's still crazy.
If only it were that easy, we're talking about govt departments here. It's because they've either been brainwashed into it, or the executive profiting from this somehow.
There's a lot of stupid rules about what you should and shouldn't use in gov, and some of the barriers to the should list are very expensive. It's frustrating as hell to know there's a great tool for a job, but not being able to use it because they haven't got some accreditation.
e: clarified individual profit, before it read like the department profits.