Slashdot Mirror
Microsoft Admits To Being Hacked Too
colinneagle writes "Once upon a time, Microsoft claimed that falling prey to social engineering tactics and then being hacked was a 'rookie mistake.' But now is the time for companies to jump on the bandwagon, to admit they were targeted by cyberattacks and successfully infiltrated. The stage is so crowded with 'giants' at this point, that there are fewer 'bad press' repercussions than if only one major company had admitted to being breached. Microsoft now admitted, hey we were hacked too. 'As reported by Facebook and Apple, Microsoft can confirm that we also recently experienced a similar security intrusion,' wrote Matt Thomlinson, General Manager of Microsoft's Trustworthy Computing Security. Unlike the New York Times and the Wall Street Journal there was no mention of Chinese hackers."
...an hour later and you're losing data again!
The Macs at the Mac Business Unit were affected.
FTFA:
It wasn't just the Macs. This was an attack on the Oracle java browser plugin, not an attack on a specific platform.
Troll less, recoiledsnake.kthxbai.
Something tells me that had these "some" actually been Macs, they (Microsoft) would have mentioned it. But then I have a suspicious nature when it comes to press releases.
The Macs at the Mac Business Unit were affected.
FTFA:
It wasn't just the Macs. This was an attack on the Oracle java browser plugin, not an attack on a specific platform.
Troll less, recoiledsnake.kthxbai.
That can imply that Macs are being used elsewhere in Microsoft apart from the Mac Business Unit. The malware was hosted on an iPhone dev site, and Microsoft has a lot of iPhone app development going on with Bing, Photosynth, Xbox etc. which are not part of the Mac Business Unit.
The computers hacked at Facebook were Macs. (Facebook devs pretty much use Macs exclusively). The ones at Apple were pretty obviously Macs. So the implied assumption in the absence of concrete information is that it was pretty much all Macs even at Microsoft targeted by this particular hack(although the exploit itself was cross platform).
Except that it has NOTHING to do with OS X security. This is all Oracle software that has the issue, software that Apple no longer distributes nor supports. If you don't run Oracle software, you won't be affected. Interestingly, even if you do have the software installed, and it isn't used after 31 days, OS X automatically disables it.
Again, this has zero to do with OS X security. This is all about end user installed software, provided and supported by Oracle.
The Admin and the Engineer
Kind of ironic that at a time when the federal government is wanting a bigger part of Fortune 500 technology departments, that some of the top companies in the world who've recently met at the White House, are now claiming they were hacked. With all these companies being hacked, our only hope is federal goverment stepping in and securing everything.
My sig of choice is Marlboro
The U.S. government has recently been saber-rattling about the NSA/DOD/whoever taking on the role of protecting vital national computer interests, particularly against the hacking efforts of China. And now, very atypically and with very little rationale for publicly admitting as much, a number of major technology/web companies have started admitting they've been hacked, allegedly from China.
So, was the U.S. government recognizing a real trend ahead of time, or maybe they had non-public information regarding these activities? Or are the companies being pressured to help create a story that will justify a government takeover of the network security infrastructure?
I distrust coincidences and the timing of these initiatives and disclosures smells a bit odd to me. Expect congressional inquiries into the "growing cybersecurity threat" to be covered on C-SPAN within the next few weeks.
Cyrano de Maniac
went on a bug hunt.
I got to the chocolate box before you, that's why the hard ones have teeth marks.
They want to look relevant. If they weren't hacked, it's because the hackers didn't think they were important.
I think the point of this story is.
You are already hacked. Doubly so if you use Java in the browser or anything else that's had any number of security flaws in the past year.
Make sure your IDS is up and running and stick it between your developers and your servers.
Oh, and make your developers run their updates. They have to be the worst at ignoring the java, adobe, and microsoft warnings from the task bar.
"During our investigation, we found a small number of computers, including some in our Mac business unit, that were infected by malicious software using techniques similar to those documented by other organizations."
Let's disect this, shall we?
"A small number of computers" of OS type undisclosed, therefore it included Windows machines or else MS would have specifically called out the faults of others to safe face and made it clear that none were running it's flagship operating system.
"including some in our Mac business unit" of OS type undisclosed, therefore it included Windows machines or else they would have called out OSX by name.
For all we know there were 78 machines compromised (a small number compared to the number of machines at all of Microsoft, and of those only 2 were in the Mac business unit. the statement reads as true but deflects the maximum amount of blame away by implying that it's a Mac issue. .
Warning: Teh poster of this messaeg is lysdexic
While your statement is completely true, perception is reality for a large segment of the population, unfortunately.
Except that it has NOTHING to do with OS X security.
No; bullshit. There is a whole load of security stuff that could have protected against that. The SELinux stuff that came from the NSA, that RedHat has been working on for years; that is present in Fedora; is exactly what could protect against this kind of user level stuff. There was a choice made by a number of computer manufacturers to put in ease of use without thinking through how to do that securely. Apple and Microsoft both, together, chose to push out alternative more secure solutions by trying to fool the users into thinking things could be easier. Without click to install there could never have been email viruses (did you youth know that we used to think these were an impossible joke). Even today, iOS, Android, Bada, BB(?) and Windows Phone come with fixed app permissions which don't allow you to reduce privilages. This is a choice of convenience over security, yet again.
Anyway; stupid article. I don't know if Microsoft did it for legal reasons, however no matter what, coming clean about a security breach is not something to be criticised. Well done Google, Apple and Microsoft. Shame on the ones who haven't yet discovered or admitted to it. Now you have admitted you have a problem start to give the users the ability to secure their own systems.
=~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
Than to admit to certificate management incompetence.
Yes none of their Linux PC got hacked.
I don't know about you, but the rest of us realized that was all sarcasm and that saying anything was immune was stupid.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
The core truth doesn't matter, it's all about appearances.
Put yourself in the shoes of a PHB (I know, i know... it's only temporary) - what would your take be?
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
I got into a bit of a flame war back and forth with a guy when the Java vulnerability first appeared. He said it would only affect PCs since viruses don't work on Mac or Linux. I called bs he responded with "they use different filesystems, learn something before spewing off at the mouth." To which I replied: 1) this is a browser based attack and 2) do you think a hacker can't figure out /home/bob rather than \Users\bob? My God the things people come up with. All three platforms now have a request for elevation kind of mechanism that is supposed to protect you. The problem is for 90% of users a UNC prompt or its mac/linux equivalent pops up and they click ok. To most users the fingers go in the ears as soon as you try to explain the risks and what is happening and they just ask "So what do I need to click to continue?" This is more a mental problem then a technological one and I don't see any likely solution. Sandboxing like Win 8 Modern can help where you at least in theory make no app able to see each other directly or even the whole of the filesystem but there are just too many use cases where being able to browse all the filesystem, one app needs to get something from anothers space etc that are needed.
It wasn't just the Macs. This was an attack on the Oracle java browser plugin, not an attack on a specific platform.
Troll less, recoiledsnake.kthxbai.
Yes, it was just the macs. The attack vector was a Java vulnerability, but the payload is always OS specific. Some attacks have been known to serve different payload after sensing the OS. But not this one. This payload was Mac specific, and Mac computers were the only one affected.
Coincidentally, the Java vulnerability exploited in the attack had been patched by Oracle several weeks before. But the vulnerability was still in the Apple maintained Java 6 (Apple still maintains their own Java 6 until EOLed - Oracle has only committed to maintain Java 7 on OS X).
This is all Macs and all Apple.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
The claim is that Macs don't get virus'
Which is obviously BS, because that's what just happened to Facebook, Twitter, Microsoft, and Apple. Macs got infected via Java. The payload was targeted for OSX.
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
You fool! You've invoked APK! Woe! Woe unto all of us!
Or a less evil way of thinking about it is that MS didn't want to say "yeah we have the problem too" without pointing out that it isn't just them having the problem but it is Apple products too. Keep in mind every time a company discloses things they lose control over how it will be presented. If their statement doesn't include that it is Apple hardware/software too (or at least implies that it might have been) what might end up as the head line is "MS hacked" with no mention of Apple at all leaving MS looking like crap and a lot of people that don't give to turds about OS X saying "man when will MS learn". It could be evil (might even likely be evil) trying to deflect the blame but it can be the opposite too making sure you don't get tainted with all the blame for something that is a common problem.
By the same token, a huge section of "Windows Malware" also has nothing to do with Windows Security. Yet we see hundreds of modded up posts on Slashdot bashing Microsoft over it regularly, yet Apple seems to be getting a free pass just like Android.
Again, this has zero to do with OS X security. This is all about end user installed software, provided and supported by Oracle.
Just so we're all on the same page, when computers get infected with malware it is not the fault of the OS, it is the fault of the third-party software, right? It seems like I heard a different tune when people were talking about Windows machines getting infected through third-party software.
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
Your essay is both good and original; however, the part that is good is not original, and the part that is original is not good.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
Well something like 80% of BSOD issues were driver based (talk from a while back in XP days) but that didn't stop MS from getting the blame. A company can encourage other vendors to make good stuff but they can't force customers to apply the blame correctly when 3rd parties fail. It is fair game for MS to say "we've been hacked and yeah our Macs got hacked too" if it is true. It is also in their best interest to make sure that their competitors get included in the sound bits about the problem (and the source of the problem too of course) so that they don't get stuck with all the blame.
Sadly, another false interpretation of the state of affairs.
Windows historically was a victim of both their poor security practices and their own success. They've actually done a lot in the Vista and up days to mitigate the need for users to 'run as administrator' to essenitally get anything done and acheive a fundamental security model roughly on par with modern Unix and Unix-like systems.
They are left with being a victim of their own success, malware authors target platforms of high popularity. Frankly, any system designed to empower the user has a damn near impossible time trying to distinguish behavior the user truly desired and intended from behavior the user was tricked into authorizing on behalf of a malware vendor (either saying yes to UAC/sudo prompt or just having their own account data compromised without even bothering to do things to the 'system' software). iOS takes the approach of forbidding any interpreted languages capable of loading more payloads and a whitelist of allowed applications to run, with the natural consequence of severely limiting what power users can 'legitimately' do with their device. In the Windows ecosystem, a tedious code blacklist approach has been adopted to try to mitigate things (aka 'anti-virus'). Formerly, anti-virus on OSX and Linux was about protecting windows systems from getting malware propogated to them, increasingly it is about blacklisting content that actually could run on OSX and Linux.
XML is like violence. If it doesn't solve the problem, use more.
The problem is for 90% of users a UNC prompt or its mac/linux equivalent pops up and they click ok. To most users the fingers go in the ears as soon as you try to explain the risks and what is happening and they just ask "So what do I need to click to continue?"
If common tasks didn't require the user to answer these pop-ups, then they would see them as "unusual" and wouldn't be as likely to just "click to continue".
There are quite a few control panel settings in Windows 7 that require answering a UAC prompt just to see the settings. Any software that tries to make a network connection and isn't on the Windows firewall "approved" list generates a UAC prompt. Then there are some settings (like "Adjust Visual Effects" in the "Perfomance Information and Tools" control panel page) that shouldn't require UAC at all, as they are merely personal preferences that are no different from desktop wallpaper as far as security or system stability is concerned.
Just as long as you don't seem to be able to tell which is which I will be happy.
=~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
Oh sure. Everything that has been said about Macs and Linux still stands.
Now we all knew Java was riddled with holes. That too still stands.
Macs and Linux just happen to be able to run Java.
It also depends on how the "don't get viruses" comment is made.
A few years back my (then) girlfriend was in need of a new laptop, so we opted to cast a wide net which included a local Apple store and during the sales pitch the 'genius' had said "and these can't get PC viruses".
While technically true (when not running Windows)... I found it a rather deceitful way to try to brag about their security as I could have listed a few recent cases were Macs were in fact hacked... such as them being the first thing taken in most Pwn2Own contests... instead I bit my tongue and bought her a Samsung at Best Buy the next week.
Help Brendan pay off his student loans
If by "sideloading from who-knows-where and installs themselves" you mean "downloading from approved app channels (Google Play Store)"... http://arstechnica.com/security/2012/07/more-malware-found-hosted-in-google-android-market/
Unlike porn, which yada yada rimshot hey-ooh!
>can be completed against some third party proprietary application that the busness cannot fix....
Live by the black box, die by the black box.
Good points on a lot of it. I can get the UAC for network connection though. If you download a office suite say and it tries to connect to the internet you might be suspicious. I think it is a good idea for users to know what applications use the network especially since a lot/most people have metered internet connections so you are paying for that traffic.
Visual settings: agreed and should be per login based (not sure if they are or not). Apple has a better solution here for preferences: show the preferences and make the user click on the lock to unlock the particular setting for changes. users don't accidentally change things, settings that you need to know even if you aren't an administrator can be shown etc. Heck I have work PCs I can't double click on the time on the desktop to see the calendar because I don't have sufficient privileges to change the time. It is assumed that you want to change the time when you can have other reasons for wanting to see the calendar (or the second hand on the clock for example). Generally unless things are changing don't prompt the user.
There are no known virus on Macs.
Since that statement is easily disprovable with a single example, here's the word from Sophos from 2006, for OS X specifically. There's even a nice section labeled "Is Leap-A a virus or a Trojan?" to counter your next rebuttal. If you disagree with their assessment, argue with them, not me.
If you look at the Mac virus timeline on that page, you can see the first one in 1982, which predates the first IBM PC virus by 4 years. There have been several viruses written to target various Mac operating systems, and you can even credit Microsoft with a working cross-platform macro virus.
Only malware I've heard of is Trojan Horses
Then you aren't really in a position to make any definitive claims regarding the history of viruses on Macs, are you?
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
Okay so malware might be more appropriate. See for example: http://www.kernelthread.com/publications/security/vunix.html though (albeit a bit old). Vulnerabilities exist in UNIX and a large set of things can be expected to be on a lot of other systems (eg. Apache, Perl, bash etc), so find an open interface to something and a corresponding vulnerability and away you go. Malware doesn't have to rely on peer to peer replication: they effect a server and the visitors "do it to themselves" afterwards.
Also: the dude that coined the term for virus did his research on UNIX so viruses are clearly possible on UNIX if rare.
If the update causes the business to shutdown, then the business may go out of business before the "some extra work to fix bugs" can be completed against some third party proprietary application that the busness cannot fix....
So no. bosses that don't want push updates because "it can break our systems" are correct. Pushing the update could put the company out of business.
Hey, I'm all for this as long as when the inevitable occurs, I'm not held responsible. We all know how that will go though, don't we?
Why are the computers at Apple "obviously" Macs?
iTunes, QuickTime, Safari, and other Apple software is all available for Windows. Do you think Apple does all that Windows development without any Windows machines?
Someone else stated that if it was only Macs infected, Microsoft would have made sure to state that. They didn't state that *any* of the computers were Macs, despite the implication with the "Mac Business Unit" bit, so it's safe to say that at least some of them were runnimg Windows.
"City hall" in German is "Rathaus" Kinda explains a few things......
The reason I'll have to disagree with you is that the press release does not say it was Macs that were compromised. It said in the Mac business unit. For all we know, it was 100% Windows machines that were compromised, but the press release is carefully designed to throw blame and obfuscate the facts so that when the general press gets a hold of it, the damage is as minimized as possible.
Warning: Teh poster of this messaeg is lysdexic
I can get the UAC for network connection though. If you download a office suite say and it tries to connect to the internet you might be suspicious.
Since there is now a lot of legitimate software that requires a network connection to "phone home", it just gets to the point that a user will blindly click the "make this dialog go away" button without reading. In addition, all the dialog gives you is the program name, and malware can have names that seem legitimate, while I sometimes have to google an EXE or DLL to see if it is OK or not.
Also, Internet Explorer is whitelisted, so if the malware creates an IE instance (which doesn't require a visible window), then the user will never know. Between being annoyed by UAC for permissions to open the firewall plus the fact that the firewall isn't really useful against much of what a user should be concerned about (things like a keylogger phoning home where a POST to some random control server somewhere probably wouldn't raise a red flag in IE) makes UAC just more security theater...it's annoying, doesn't really protect you, but allows Microsoft to say "we did something".
Apple still maintains their own Java 6 until EOLed
FYI, Java 6 EOLed now, Feb. 2013, no longer supported by Apple
For your information: http://support.apple.com/kb/HT5666 :"Multiple vulnerabilities existed in Java 1.6.0_37, the most serious of which may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user. These issues were addressed by updating to Java version 1.6.0_41. For Mac OS X v10.6 systems, these issues were addressed in Java for Mac OS X v10.6 Update 13"
Apple patched this vulnerability on feb 19th 2013. After systems had been compromised. Macs which had been upgraded from previous versions where Java was installed *still* has Java installed. Apple obviously felt obliged (as in "egg on their heads obliged") to patch this one. OS X systems all over the world have been compromised because of Apples approach to security, especially Java security.
This payload was Mac specific, and Mac computers were the only one affected.
Well, that's not what TFA says, nor any article I've read about it... but what possible reason would you have for making shit up?
Oh? Try read this one (or just the excerpt):
http://news.yahoo.com/microsofts-macs-hacked-java-attack-045502922.html : "Even more significantly, it wasn't Microsoft's Windows computers that were hacked so much as it was Microsoft's Macs."
Glad I could help.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
Windows can run on Macs since Macs are just another brand of PC made by Apple, so no need to buy Dells or whatever. Or just have virtual machines, which would make it easier to rollback to a clean slate when testing the programs.
It's like a self help group for non-recovering corporate assholes.
"Hi, I'm Microsoft, and I was hacked"
everyone: "Hello, Microsoft"