342
submitted 8 months ago* (last edited 8 months ago) by dominiquec@lemmy.world to c/technology@lemmy.world
all 48 comments
sorted by: hot top controversial new old
[-] douglasg14b@lemmy.world 78 points 8 months ago

Nation state cybersecurity threats are a big deal, and heavily targeting Microsoft is definitely part of a larger game plan by Russia.

If Microsoft is struggling, imagine how helpless "smaller" corporations (Even 10/100's of billion $ corps) would be.

I'm interested in how this plays out, and the kinds of postmortems we'll get from this. Will we see any shift in security culture and best practices?

[-] nexusband@lemmy.world 41 points 8 months ago* (last edited 8 months ago)

Smaller corporations have it easier, IF they took IT Security serious. For the simple fact, that there are just a lot less entry points and way less whack amole playing.

And Microsoft never took security as serious as they should have.

Edith: And I highly doubt, we'll see a substantial change on Microsoft's side. 1.: There's less Money to be made. 2.: In some ways, their hands are tied because of the still ongoing Patriot Act/USA Freedom Act (which is a bullshit name) or rather the safe harbor stuff.

[-] flambonkscious@sh.itjust.works 2 points 8 months ago

I don't think we'll get the post mortems you ate imagining.

Microsoft has typically been extremely vague - famously vague, even - about any details.

[-] Treczoks@lemmy.world 44 points 8 months ago

Can we now call Microsoft software compromised?

[-] SamsonSeinfelder@feddit.de 35 points 8 months ago* (last edited 8 months ago)
[-] kautau@lemmy.world 17 points 8 months ago

🌕🧑‍🚀🔫🧑‍🚀

[-] hohoho@lemmy.world 6 points 8 months ago

🧀👨‍🚀🔫👨‍🚀

[-] GBU_28@lemm.ee 26 points 8 months ago

If I ran a software utility that the US gov used and had an intrusion I couldn't mitigate and resolve, I would be blacklisted and out of business.

[-] WhatAmLemmy@lemmy.world 22 points 8 months ago* (last edited 8 months ago)

Have you tried being too big to fail, to the extent your own financial success is considered a matter of "national security"?

[-] corsicanguppy@lemmy.ca 3 points 8 months ago

Is it iso9001 that says "don't have a single supplier for stuff"?

[-] Random_internet_user@lemmy.today 15 points 8 months ago
[-] TheRealKuni@lemmy.world 14 points 8 months ago

Linux anyone ?

I don’t want to sound dismissive, this is a genuine question and not an attack on Linux.

Other than security by obscurity, how is it possible that an operating system whose entire source code is available to hackers to peruse at will could be more secure than a closed source one?

[-] TheGrandNagus@lemmy.world 32 points 8 months ago

Security by obscurity doesn't work. Microsoft software has always been closed source and it has never prevented hackers making exploits.

Open source software allows hundreds of thousands of people to comb over the code and find/fix vulnerabilities much easier.

It's also true that because of the way Linux is developed, security flaws in Linux are patched much faster than in other projects, with Linux patching issues in an average of 25 days compared to Microsoft's 83 days. And the gap is widening, recently Linux has got that down to 15 days.

There's a reason companies go with Linux for servers that handle sensitive information or are business-critical. And there's a reason why the best encryption algorithms are all open source.

[-] eskimofry@lemmy.world 21 points 8 months ago

Code being in the open allows the whole world to participate and fix the problems quicker than closed source binary.

[-] mlg@lemmy.world 17 points 8 months ago

Because if a vuln gets found or exploited, it gets immediately patched, often with some big backing by OEMs that run on Linux.

Open source also reduces the likelihood of exploitable bugs going unnoticed because everyone can see and play with the source code by themselves.

There is a risk of malicious merge requests, but so far that hasn't been a problem besides a university getting banned for pointing out the issue with a live test without telling the devs.

Much of linux is also designed to be hardened by default because it's used on so much infara. SELinux by itself is a great example because it was essentially created by RedHat and now is a major standard for MAC.

Windows on the other hand needs Microsoft alone to solve the problem. No one can patch it themselves, and there's no guarantee the patches will work, which has happened several times. I believe print spooler basically had to be disabled because there was no good solution due to implementation.

The amount of Windows OS specific exploits vs Linux specific exploits kind of shows the results of closed source vs open source.

The worst vuln I can think of for Linux is dirty cow which is a local priv esc on basically Linux kernels 2.x-4.x which was a big deal when it was discovered because of the range of versions

Meanwhile windows had eternal blue, a whole remote code execution that existed on every version of windows since win95 that the NSA kept for probably a decade before it was leaked.

[-] redfox@infosec.pub 7 points 8 months ago

Imagine for a moment that the business world transitioned to Linux, and now there's enormous incentive for all adversaries from state sponsored to financially motivated criminals to spend all their time hunting through linux source code.

  • Do you think the ideas above stand up? (I'm not saying they dont)

  • Would linux vulnerabilities be found at a higher rate? I wonder if they aren't now because there aren't as many eyes on them. Sure there's corporate side project efforts and volunteers, just curious how that stacks up against the amount of research happening to break Windows systems.

  • NSA would definitely want to keep some linux exploits around if their adversaries were using linux instead of windows. I think the result would be the same regarding eternal blue.

[-] TheGrandNagus@lemmy.world 5 points 8 months ago

Linux is already used everywhere, from servers to satellites to phones to infrastructure. There's already a huge incentive to find exploits, moreso than Windows devices.

I do think more desktop-oriented exploits would be found if more people used Linux desktop, but I think that's more down to distro fragmentation and not every distro maker being as competent as others, or not having the manpower to keep up with development, as opposed to there intrinsically being danger in people seeing source code.

NSA would definitely want to keep some linux exploits around

And they'd be spotted in the source code and patched. If the code is proprietary, you can never trust that there aren't backdoors.

[-] Natanael@slrpnk.net 5 points 8 months ago

Linux is currently having parts of the kernel rewritten in memory safe languages like Rust, eliminating entire classes of exploits. Wayland is being developed with a far more secure architecture than the old X.org window manager. One important reason why they can do this is because the whole industry follows and stuff like drivers can be updated at the same time to keep everything working, and it doesn't even need to be the original developer patching it.

Microsoft's opacity makes it near impossible for them to do the same thing, so much of their security improvements are essentially hacked in on top of old code to not break compatibility. Instead of eliminating bug classes they rely on tons of techniques to make them harder to exploit instead - yet not impossible.

[-] Macros@feddit.de 5 points 8 months ago

The point is, they already did. 99% of webservers run Linux. They are all out in the open and hackers love to get their hand on them as they are likely to have mailservers on them and they have a public IP so they can always be reached.

And most of them do not get hacked. And those that do mostly get hacked due to bad passwords or bad website code. I administer one and see the thousands of attacks running up against it daily (most are just attempts to log in with basic credentials). And of course I see the daily influx of updates from Linux.

If a new security flaw is seen, its often quite difficult to use. And with Linux somebody makes a patch before simple tool for hackers are out. With Microsoft products you wait till the next patch day, in the best case critical exploited bugs are patched in days. Also security flaws in closed source products are often easier to exploit and tools to use them are available fast. (Such flaws are often already discovered in open source products by third eyes and testers before they make it to production systems.)

Of course there are exceptions to the rule, like heartbleed. This was an easy to exploit flaw in an often used Linux service and it caused a big turmoil because many where to slow to patch their systems.

Also of course if Linux gets more popular on the desktop more software will be an attractive target for malicious actors and some software may get popular before many people take a look at the source code. But the situation will still be much better compared to closed source systems.

(Also of course more closed source software will be made for Linux then)

[-] Random_internet_user@lemmy.today 4 points 8 months ago

If that happeninux will also recieve more contributions and donations from that structers also linux devs also doesn't have to worry about building blobs, ads, tracking, making UI prettierso they can worry about real stuff and aolve those issues . The security of linux isn't because of the low amount of users its simply because it is what it is an OS build and used by nerds who whether you like it or not are some of the most tech savy people you can find and they have their heart in it because they are not doing it for corpos or salary . Also linux is the OS used by most (and best ) hackers and proggrammers and often recieve contributions from (only sometimes from the hackers but as the linux users are naturally paranoid they often review code and PR for vulnabilities instead of the need to add extra features cause jomo)

Also spelling, grammer etc.

[-] TheRealKuni@lemmy.world 6 points 8 months ago

proggrammers

Also spelling, grammer [sic] etc.

There is a great t-shirt that says:

~~I’m a programar~~
~~I’m a programmar~~
~~I’m a programer~~
I write code

I love this shirt. So many programmers are awful at spelling. I do not, personally, suffer this malady, so I don’t own the shirt, but I still love it.

[-] Cort@lemmy.world 7 points 8 months ago

I do not, personally, suffer this malady

Um actually it's spelled m'lady. /s

[-] RGB3x3@lemmy.world 3 points 8 months ago* (last edited 8 months ago)
[-] Random_internet_user@lemmy.today 3 points 8 months ago

I proggram for hobby and i am really really bad at it like if a legitamate programmer sees my life's work in it they will beat me to death with bare hands bad . And the grammer and spellings is because english isn'ty first language.

[-] bruhduh@lemmy.world 3 points 8 months ago

Governments of Russia China India use Linux, nsa definitely keeping exploits active to keep tabs

[-] Natanael@slrpnk.net 14 points 8 months ago

Closed source doesn't prevent people from reverse engineering it to find exploits, it just makes it harder for others to contribute to fixing it

[-] Treczoks@lemmy.world 9 points 8 months ago

Because many eyes are there watching it. While not everyone is an active kernel hacker, many parties have an active interest in certain aspects of the kernel, and watch source code and patches closely.

[-] TheGrandNagus@lemmy.world 1 points 8 months ago

Yup. E.g. years ago Huawei tried to merge something in the kernel that had a glaring security hole, many speculated that it was a deliberate attempt to add an exploit to the kernel.

It was immediately spotted before it even got close to being merged, and of course it got rejected.

The likes of Google, Microsoft, RedHat/IBM, Intel, AMD, Chronos group, etc are always investigating what other companies are trying to implement into the kernel. They obviously won't stand for any dodgy stuff from another company being injected into the kernel.

Everything is highly scrutinised, not just by the kernel maintainers, but also by the contributors.

[-] corsicanguppy@lemmy.ca 2 points 8 months ago

ReactOS FTW.

[-] bykdd@lemmy.dbzer0.com 14 points 8 months ago

W10 EOL news and compromised news at the same time.

[-] sleepmode@lemmy.world 12 points 8 months ago

I've seen them owned by the RSS functionality. So many little hidey holes. I can't imagine how diverse their infrastructure is.

[-] autotldr@lemmings.world 10 points 8 months ago

This is the best summary I could come up with:


BOSTON (AP) — Microsoft said Friday it’s still trying to evict the elite Russian government hackers who broke into the email accounts of senior company executives in November and who it said have been trying to breach customer networks with stolen access data.

The hackers from Russia’s SVR foreign intelligence service used data obtained in the intrusion, which it disclosed in mid-January, to compromise some source-code repositories and internal systems, the software giant said in a blog and a regulatory filing.

A company spokesman would not characterize what source code was accessed and what capability the hackers gained to further compromise customer and Microsoft systems.

“The threat actor’s ongoing attack is characterized by a sustained, significant commitment of the threat actor’s resources, coordination, and focus,” Microsoft said Friday, adding that it could be using obtained data “to accumulate a picture of areas to attack and enhance its ability to do so.” Cybersecurity experts said Microsoft’s admission that the SVR hack had not been contained exposes the perils of the heavy reliance by government and business on the Redmond, Washington, company’s software monoculture — and the fact that so many of its customers are linked through its global cloud network.

When it initially announced the hack, Microsoft said the SVR unit broke into its corporate email system and accessed accounts of some senior executives as well as employees on its cybersecurity and legal teams.

Microsoft’s latest disclosure comes three months after a new U.S. Securities and Exchange Commission rule took effect that compels publicly traded companies to disclose breaches that could negatively impact their business.


The original article contains 551 words, the summary contains 264 words. Saved 52%. I'm a bot and I'm open source!

[-] profdc9@lemmy.world 0 points 8 months ago

Securing a general purpose operating system seems like the Dutch boy with his finger in the dike. It doesn't matter if its Windows, Linux, or Mac OS X. Lots of little leaks, not enough fingers to plug them.

this post was submitted on 09 Mar 2024
342 points (97.2% liked)

Technology

59674 readers
1878 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS