Slashdot Mirror
Microsoft Admits To Being Hacked Too
colinneagle writes "Once upon a time, Microsoft claimed that falling prey to social engineering tactics and then being hacked was a 'rookie mistake.' But now is the time for companies to jump on the bandwagon, to admit they were targeted by cyberattacks and successfully infiltrated. The stage is so crowded with 'giants' at this point, that there are fewer 'bad press' repercussions than if only one major company had admitted to being breached. Microsoft now admitted, hey we were hacked too. 'As reported by Facebook and Apple, Microsoft can confirm that we also recently experienced a similar security intrusion,' wrote Matt Thomlinson, General Manager of Microsoft's Trustworthy Computing Security. Unlike the New York Times and the Wall Street Journal there was no mention of Chinese hackers."
...an hour later and you're losing data again!
For profit corporations security problems are always attacked by the latest "terrorist state", however it's just a lie which diddles away in the mind of those who do not understand tcpip and networking well enough to see right through the bs.
Microsoft wants to join in because OSX is in the spotlight. Other companies have already admitted infiltration with the hack, so this gives them an opportunity to shine a bright light on OSX' security issues away from their own for a brief minute.
The Macs at the Mac Business Unit were affected.
FTFA:
It wasn't just the Macs. This was an attack on the Oracle java browser plugin, not an attack on a specific platform.
Troll less, recoiledsnake.kthxbai.
Something tells me that had these "some" actually been Macs, they (Microsoft) would have mentioned it. But then I have a suspicious nature when it comes to press releases.
I thought Macs were immune to being hacked?
Not sure where you got that. The claim is that Macs don't get virus', and don't need virus protection unless you have PC's on your subnet or interact with PC's, in which case, to protect the Windows machines, you may have to cripple Macs with AV software. It's actually quite anathema. If only Windows wasn't broken...
The Macs at the Mac Business Unit were affected.
FTFA:
It wasn't just the Macs. This was an attack on the Oracle java browser plugin, not an attack on a specific platform.
Troll less, recoiledsnake.kthxbai.
That can imply that Macs are being used elsewhere in Microsoft apart from the Mac Business Unit. The malware was hosted on an iPhone dev site, and Microsoft has a lot of iPhone app development going on with Bing, Photosynth, Xbox etc. which are not part of the Mac Business Unit.
The computers hacked at Facebook were Macs. (Facebook devs pretty much use Macs exclusively). The ones at Apple were pretty obviously Macs. So the implied assumption in the absence of concrete information is that it was pretty much all Macs even at Microsoft targeted by this particular hack(although the exploit itself was cross platform).
"including some in our Mac business unit"
That doesn't necessarily mean they were macs, it just means they were computers in the Mac business unit. Still, they may have been macs.
Also notice how none of their Linux pcs got hacked?
Kind of ironic that at a time when the federal government is wanting a bigger part of Fortune 500 technology departments, that some of the top companies in the world who've recently met at the White House, are now claiming they were hacked. With all these companies being hacked, our only hope is federal goverment stepping in and securing everything.
My sig of choice is Marlboro
The U.S. government has recently been saber-rattling about the NSA/DOD/whoever taking on the role of protecting vital national computer interests, particularly against the hacking efforts of China. And now, very atypically and with very little rationale for publicly admitting as much, a number of major technology/web companies have started admitting they've been hacked, allegedly from China.
So, was the U.S. government recognizing a real trend ahead of time, or maybe they had non-public information regarding these activities? Or are the companies being pressured to help create a story that will justify a government takeover of the network security infrastructure?
I distrust coincidences and the timing of these initiatives and disclosures smells a bit odd to me. Expect congressional inquiries into the "growing cybersecurity threat" to be covered on C-SPAN within the next few weeks.
Cyrano de Maniac
You know how it goes. Old people who knew how things ran left and new people came in that really didn't know the systems. So things happen. *cough* Sinofsky *cough* Larson-Green *cough* Just kidding...
went on a bug hunt.
I got to the chocolate box before you, that's why the hard ones have teeth marks.
I think the point of this story is.
You are already hacked. Doubly so if you use Java in the browser or anything else that's had any number of security flaws in the past year.
Make sure your IDS is up and running and stick it between your developers and your servers.
Oh, and make your developers run their updates. They have to be the worst at ignoring the java, adobe, and microsoft warnings from the task bar.
Microsoft wants to join in because OSX is in the spotlight.
Wait, so you're saying that Apple getting hacked made it cool, so now Microsoft is admitting to being hacked so they can be cool too?
Dude, Apple being cool by being hacked ..... I don't think the Fanboys are THAT far gone!
"During our investigation, we found a small number of computers, including some in our Mac business unit, that were infected by malicious software using techniques similar to those documented by other organizations."
Let's disect this, shall we?
"A small number of computers" of OS type undisclosed, therefore it included Windows machines or else MS would have specifically called out the faults of others to safe face and made it clear that none were running it's flagship operating system.
"including some in our Mac business unit" of OS type undisclosed, therefore it included Windows machines or else they would have called out OSX by name.
For all we know there were 78 machines compromised (a small number compared to the number of machines at all of Microsoft, and of those only 2 were in the Mac business unit. the statement reads as true but deflects the maximum amount of blame away by implying that it's a Mac issue. .
Warning: Teh poster of this messaeg is lysdexic
Isn't Insightful what people get for making jokes? It always seemed that way.
Than to admit to certificate management incompetence.
Yes none of their Linux PC got hacked.
I don't know about you, but the rest of us realized that was all sarcasm and that saying anything was immune was stupid.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
It's kind of funny to think that folks would be trying to hack government agencies, private companies, public utilites, etc and see no value in hacking the OS software vendor with the most marketshare. Seems like a perfect spot for a bot plant. Via Windows Update they'd even have a mass distribution mechanism at their disposal on a global scale.
I got into a bit of a flame war back and forth with a guy when the Java vulnerability first appeared. He said it would only affect PCs since viruses don't work on Mac or Linux. I called bs he responded with "they use different filesystems, learn something before spewing off at the mouth." To which I replied: 1) this is a browser based attack and 2) do you think a hacker can't figure out /home/bob rather than \Users\bob? My God the things people come up with. All three platforms now have a request for elevation kind of mechanism that is supposed to protect you. The problem is for 90% of users a UNC prompt or its mac/linux equivalent pops up and they click ok. To most users the fingers go in the ears as soon as you try to explain the risks and what is happening and they just ask "So what do I need to click to continue?" This is more a mental problem then a technological one and I don't see any likely solution. Sandboxing like Win 8 Modern can help where you at least in theory make no app able to see each other directly or even the whole of the filesystem but there are just too many use cases where being able to browse all the filesystem, one app needs to get something from anothers space etc that are needed.
It wasn't just the Macs. This was an attack on the Oracle java browser plugin, not an attack on a specific platform.
Troll less, recoiledsnake.kthxbai.
Yes, it was just the macs. The attack vector was a Java vulnerability, but the payload is always OS specific. Some attacks have been known to serve different payload after sensing the OS. But not this one. This payload was Mac specific, and Mac computers were the only one affected.
Coincidentally, the Java vulnerability exploited in the attack had been patched by Oracle several weeks before. But the vulnerability was still in the Apple maintained Java 6 (Apple still maintains their own Java 6 until EOLed - Oracle has only committed to maintain Java 7 on OS X).
This is all Macs and all Apple.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
The claim is that Macs don't get virus'
Which is obviously BS, because that's what just happened to Facebook, Twitter, Microsoft, and Apple. Macs got infected via Java. The payload was targeted for OSX.
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
Or a less evil way of thinking about it is that MS didn't want to say "yeah we have the problem too" without pointing out that it isn't just them having the problem but it is Apple products too. Keep in mind every time a company discloses things they lose control over how it will be presented. If their statement doesn't include that it is Apple hardware/software too (or at least implies that it might have been) what might end up as the head line is "MS hacked" with no mention of Apple at all leaving MS looking like crap and a lot of people that don't give to turds about OS X saying "man when will MS learn". It could be evil (might even likely be evil) trying to deflect the blame but it can be the opposite too making sure you don't get tainted with all the blame for something that is a common problem.
Sadly, another false interpretation of the state of affairs.
Windows historically was a victim of both their poor security practices and their own success. They've actually done a lot in the Vista and up days to mitigate the need for users to 'run as administrator' to essenitally get anything done and acheive a fundamental security model roughly on par with modern Unix and Unix-like systems.
They are left with being a victim of their own success, malware authors target platforms of high popularity. Frankly, any system designed to empower the user has a damn near impossible time trying to distinguish behavior the user truly desired and intended from behavior the user was tricked into authorizing on behalf of a malware vendor (either saying yes to UAC/sudo prompt or just having their own account data compromised without even bothering to do things to the 'system' software). iOS takes the approach of forbidding any interpreted languages capable of loading more payloads and a whitelist of allowed applications to run, with the natural consequence of severely limiting what power users can 'legitimately' do with their device. In the Windows ecosystem, a tedious code blacklist approach has been adopted to try to mitigate things (aka 'anti-virus'). Formerly, anti-virus on OSX and Linux was about protecting windows systems from getting malware propogated to them, increasingly it is about blacklisting content that actually could run on OSX and Linux.
XML is like violence. If it doesn't solve the problem, use more.
The problem is for 90% of users a UNC prompt or its mac/linux equivalent pops up and they click ok. To most users the fingers go in the ears as soon as you try to explain the risks and what is happening and they just ask "So what do I need to click to continue?"
If common tasks didn't require the user to answer these pop-ups, then they would see them as "unusual" and wouldn't be as likely to just "click to continue".
There are quite a few control panel settings in Windows 7 that require answering a UAC prompt just to see the settings. Any software that tries to make a network connection and isn't on the Windows firewall "approved" list generates a UAC prompt. Then there are some settings (like "Adjust Visual Effects" in the "Perfomance Information and Tools" control panel page) that shouldn't require UAC at all, as they are merely personal preferences that are no different from desktop wallpaper as far as security or system stability is concerned.
The malware on android (which is not the same as Linux) is from side-loading apps that people download to their phones from who-knows-where and installs them themselves. It's not the result of some drive-by download or OS exploit.
Oh sure. Everything that has been said about Macs and Linux still stands.
Now we all knew Java was riddled with holes. That too still stands.
Macs and Linux just happen to be able to run Java.
It also depends on how the "don't get viruses" comment is made.
A few years back my (then) girlfriend was in need of a new laptop, so we opted to cast a wide net which included a local Apple store and during the sales pitch the 'genius' had said "and these can't get PC viruses".
While technically true (when not running Windows)... I found it a rather deceitful way to try to brag about their security as I could have listed a few recent cases were Macs were in fact hacked... such as them being the first thing taken in most Pwn2Own contests... instead I bit my tongue and bought her a Samsung at Best Buy the next week.
Help Brendan pay off his student loans
If by "sideloading from who-knows-where and installs themselves" you mean "downloading from approved app channels (Google Play Store)"... http://arstechnica.com/security/2012/07/more-malware-found-hosted-in-google-android-market/
Unlike porn, which yada yada rimshot hey-ooh!
If the update causes the business to shutdown, then the business may go out of business before the "some extra work to fix bugs" can be completed against some third party proprietary application that the busness cannot fix....
So no. bosses that don't want push updates because "it can break our systems" are correct. Pushing the update could put the company out of business.
who'd a thought.
I don't know how many of you noticed in the last few weeks that the usual round of default password scans had a few Microsoft IPs in them. I have several event logs with MS IPs scanning my network with default logins. I didn't think much of it, thought maybe it was a spoof--- but hey, it looks like it really was from inside of MS's network. Crazy shit, and how ironic is it that they got their Macs?
640k ought to be enough for anyone.
Good points on a lot of it. I can get the UAC for network connection though. If you download a office suite say and it tries to connect to the internet you might be suspicious. I think it is a good idea for users to know what applications use the network especially since a lot/most people have metered internet connections so you are paying for that traffic.
Visual settings: agreed and should be per login based (not sure if they are or not). Apple has a better solution here for preferences: show the preferences and make the user click on the lock to unlock the particular setting for changes. users don't accidentally change things, settings that you need to know even if you aren't an administrator can be shown etc. Heck I have work PCs I can't double click on the time on the desktop to see the calendar because I don't have sufficient privileges to change the time. It is assumed that you want to change the time when you can have other reasons for wanting to see the calendar (or the second hand on the clock for example). Generally unless things are changing don't prompt the user.
what's with the sickness of posting a Microsoft article nearly every day? Does MS own /. ?
NUuuuuuuKE EmmmmmmM !! Noooowwww !!
Apple still maintains their own Java 6 until EOLed
FYI, Java 6 EOLed now, Feb. 2013, no longer supported by Apple
This payload was Mac specific, and Mac computers were the only one affected.
Well, that's not what TFA says, nor any article I've read about it... but what possible reason would you have for making shit up?
no... you just have a loose relationship with the definitions of words. All virus is malware, not all malware is virus. There are no known virus on Macs. Only malware I've heard of is Trojan Horses, which require the user to enter admin creds... historically, far more easy to detect and thwart even if you do come across one of the proof of concepts... unlike other, OS's based on Digital Equipment Corporation's NT kernel.
such as them being the first thing taken in most Pwn2Own contests
As it always goes with these contests where hardware is the prize: the most desired hardware is the first to fall. Thus, it's surprising that Windows was hacked at all in these contests. This has nothing to do with virus or even malware. Any system can be hacked. But OS X has been free of virus, with only proof of concept Trojan horses, or compromised by a vulnerability in third party software, such as java. You truely have to be completely irrational to think that OS X is just as insecure as Windows. You can spend many hours setting up protections on Windows, and still have a really good chance of being compromised, and spend zero hours protecting your Mac, and your Mac getting compromised is still quite exceptional.
Apparently the trouble is you don't know what a computer virus is, or isn't. A computer virus is a computer program that can replicate itself and spread from one computer to another. There are no virus on Macs with OS X that can affect OS X... nor on AIX, or FreeBSD, nor Linux. The only computer virus that exist today affect Windows. The only reason to run AV on any *nix is to protect Windows.
There are no known virus on Macs.
Since that statement is easily disprovable with a single example, here's the word from Sophos from 2006, for OS X specifically. There's even a nice section labeled "Is Leap-A a virus or a Trojan?" to counter your next rebuttal. If you disagree with their assessment, argue with them, not me.
If you look at the Mac virus timeline on that page, you can see the first one in 1982, which predates the first IBM PC virus by 4 years. There have been several viruses written to target various Mac operating systems, and you can even credit Microsoft with a working cross-platform macro virus.
Only malware I've heard of is Trojan Horses
Then you aren't really in a position to make any definitive claims regarding the history of viruses on Macs, are you?
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
Okay so malware might be more appropriate. See for example: http://www.kernelthread.com/publications/security/vunix.html though (albeit a bit old). Vulnerabilities exist in UNIX and a large set of things can be expected to be on a lot of other systems (eg. Apache, Perl, bash etc), so find an open interface to something and a corresponding vulnerability and away you go. Malware doesn't have to rely on peer to peer replication: they effect a server and the visitors "do it to themselves" afterwards.
Also: the dude that coined the term for virus did his research on UNIX so viruses are clearly possible on UNIX if rare.
Why are the computers at Apple "obviously" Macs?
iTunes, QuickTime, Safari, and other Apple software is all available for Windows. Do you think Apple does all that Windows development without any Windows machines?
Someone else stated that if it was only Macs infected, Microsoft would have made sure to state that. They didn't state that *any* of the computers were Macs, despite the implication with the "Mac Business Unit" bit, so it's safe to say that at least some of them were runnimg Windows.
"City hall" in German is "Rathaus" Kinda explains a few things......
Who cares?
Apple got hacked, so Microsoft OBVIOUSLY had to copy them, it's a core tenet of their business plan.
What - none of the 5?
It must have been Chinese hackers, apparently they are the only ones with the capability to hack into major Corporates.
Ironic to tout the benefits of sandboxing in Windows 8... when Java was supposed to be sandboxed. Oops.
The reason I'll have to disagree with you is that the press release does not say it was Macs that were compromised. It said in the Mac business unit. For all we know, it was 100% Windows machines that were compromised, but the press release is carefully designed to throw blame and obfuscate the facts so that when the general press gets a hold of it, the damage is as minimized as possible.
Warning: Teh poster of this messaeg is lysdexic
I can get the UAC for network connection though. If you download a office suite say and it tries to connect to the internet you might be suspicious.
Since there is now a lot of legitimate software that requires a network connection to "phone home", it just gets to the point that a user will blindly click the "make this dialog go away" button without reading. In addition, all the dialog gives you is the program name, and malware can have names that seem legitimate, while I sometimes have to google an EXE or DLL to see if it is OK or not.
Also, Internet Explorer is whitelisted, so if the malware creates an IE instance (which doesn't require a visible window), then the user will never know. Between being annoyed by UAC for permissions to open the firewall plus the fact that the firewall isn't really useful against much of what a user should be concerned about (things like a keylogger phoning home where a POST to some random control server somewhere probably wouldn't raise a red flag in IE) makes UAC just more security theater...it's annoying, doesn't really protect you, but allows Microsoft to say "we did something".
Apple still maintains their own Java 6 until EOLed
FYI, Java 6 EOLed now, Feb. 2013, no longer supported by Apple
For your information: http://support.apple.com/kb/HT5666 :"Multiple vulnerabilities existed in Java 1.6.0_37, the most serious of which may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user. These issues were addressed by updating to Java version 1.6.0_41. For Mac OS X v10.6 systems, these issues were addressed in Java for Mac OS X v10.6 Update 13"
Apple patched this vulnerability on feb 19th 2013. After systems had been compromised. Macs which had been upgraded from previous versions where Java was installed *still* has Java installed. Apple obviously felt obliged (as in "egg on their heads obliged") to patch this one. OS X systems all over the world have been compromised because of Apples approach to security, especially Java security.
This payload was Mac specific, and Mac computers were the only one affected.
Well, that's not what TFA says, nor any article I've read about it... but what possible reason would you have for making shit up?
Oh? Try read this one (or just the excerpt):
http://news.yahoo.com/microsofts-macs-hacked-java-attack-045502922.html : "Even more significantly, it wasn't Microsoft's Windows computers that were hacked so much as it was Microsoft's Macs."
Glad I could help.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
Windows can run on Macs since Macs are just another brand of PC made by Apple, so no need to buy Dells or whatever. Or just have virtual machines, which would make it easier to rollback to a clean slate when testing the programs.
It's like a self help group for non-recovering corporate assholes.
"Hi, I'm Microsoft, and I was hacked"
everyone: "Hello, Microsoft"
Why are you all concerned aren't you using MickeySoft safe boot???? They must be......mustn't they????
Hey dipshit, your citation does not support your claim. Care to try again?