Slashdot Mirror
Microsoft Admits To Being Hacked Too
colinneagle writes "Once upon a time, Microsoft claimed that falling prey to social engineering tactics and then being hacked was a 'rookie mistake.' But now is the time for companies to jump on the bandwagon, to admit they were targeted by cyberattacks and successfully infiltrated. The stage is so crowded with 'giants' at this point, that there are fewer 'bad press' repercussions than if only one major company had admitted to being breached. Microsoft now admitted, hey we were hacked too. 'As reported by Facebook and Apple, Microsoft can confirm that we also recently experienced a similar security intrusion,' wrote Matt Thomlinson, General Manager of Microsoft's Trustworthy Computing Security. Unlike the New York Times and the Wall Street Journal there was no mention of Chinese hackers."
...an hour later and you're losing data again!
The Macs at the Mac Business Unit were affected.
FTFA:
It wasn't just the Macs. This was an attack on the Oracle java browser plugin, not an attack on a specific platform.
Troll less, recoiledsnake.kthxbai.
The Macs at the Mac Business Unit were affected.
FTFA:
It wasn't just the Macs. This was an attack on the Oracle java browser plugin, not an attack on a specific platform.
Troll less, recoiledsnake.kthxbai.
That can imply that Macs are being used elsewhere in Microsoft apart from the Mac Business Unit. The malware was hosted on an iPhone dev site, and Microsoft has a lot of iPhone app development going on with Bing, Photosynth, Xbox etc. which are not part of the Mac Business Unit.
The computers hacked at Facebook were Macs. (Facebook devs pretty much use Macs exclusively). The ones at Apple were pretty obviously Macs. So the implied assumption in the absence of concrete information is that it was pretty much all Macs even at Microsoft targeted by this particular hack(although the exploit itself was cross platform).
Except that it has NOTHING to do with OS X security. This is all Oracle software that has the issue, software that Apple no longer distributes nor supports. If you don't run Oracle software, you won't be affected. Interestingly, even if you do have the software installed, and it isn't used after 31 days, OS X automatically disables it.
Again, this has zero to do with OS X security. This is all about end user installed software, provided and supported by Oracle.
The Admin and the Engineer
Kind of ironic that at a time when the federal government is wanting a bigger part of Fortune 500 technology departments, that some of the top companies in the world who've recently met at the White House, are now claiming they were hacked. With all these companies being hacked, our only hope is federal goverment stepping in and securing everything.
My sig of choice is Marlboro
The U.S. government has recently been saber-rattling about the NSA/DOD/whoever taking on the role of protecting vital national computer interests, particularly against the hacking efforts of China. And now, very atypically and with very little rationale for publicly admitting as much, a number of major technology/web companies have started admitting they've been hacked, allegedly from China.
So, was the U.S. government recognizing a real trend ahead of time, or maybe they had non-public information regarding these activities? Or are the companies being pressured to help create a story that will justify a government takeover of the network security infrastructure?
I distrust coincidences and the timing of these initiatives and disclosures smells a bit odd to me. Expect congressional inquiries into the "growing cybersecurity threat" to be covered on C-SPAN within the next few weeks.
Cyrano de Maniac
went on a bug hunt.
I got to the chocolate box before you, that's why the hard ones have teeth marks.
They want to look relevant. If they weren't hacked, it's because the hackers didn't think they were important.
I think the point of this story is.
You are already hacked. Doubly so if you use Java in the browser or anything else that's had any number of security flaws in the past year.
Make sure your IDS is up and running and stick it between your developers and your servers.
Oh, and make your developers run their updates. They have to be the worst at ignoring the java, adobe, and microsoft warnings from the task bar.
"During our investigation, we found a small number of computers, including some in our Mac business unit, that were infected by malicious software using techniques similar to those documented by other organizations."
Let's disect this, shall we?
"A small number of computers" of OS type undisclosed, therefore it included Windows machines or else MS would have specifically called out the faults of others to safe face and made it clear that none were running it's flagship operating system.
"including some in our Mac business unit" of OS type undisclosed, therefore it included Windows machines or else they would have called out OSX by name.
For all we know there were 78 machines compromised (a small number compared to the number of machines at all of Microsoft, and of those only 2 were in the Mac business unit. the statement reads as true but deflects the maximum amount of blame away by implying that it's a Mac issue. .
Warning: Teh poster of this messaeg is lysdexic
While your statement is completely true, perception is reality for a large segment of the population, unfortunately.
Except that it has NOTHING to do with OS X security.
No; bullshit. There is a whole load of security stuff that could have protected against that. The SELinux stuff that came from the NSA, that RedHat has been working on for years; that is present in Fedora; is exactly what could protect against this kind of user level stuff. There was a choice made by a number of computer manufacturers to put in ease of use without thinking through how to do that securely. Apple and Microsoft both, together, chose to push out alternative more secure solutions by trying to fool the users into thinking things could be easier. Without click to install there could never have been email viruses (did you youth know that we used to think these were an impossible joke). Even today, iOS, Android, Bada, BB(?) and Windows Phone come with fixed app permissions which don't allow you to reduce privilages. This is a choice of convenience over security, yet again.
Anyway; stupid article. I don't know if Microsoft did it for legal reasons, however no matter what, coming clean about a security breach is not something to be criticised. Well done Google, Apple and Microsoft. Shame on the ones who haven't yet discovered or admitted to it. Now you have admitted you have a problem start to give the users the ability to secure their own systems.
=~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
Than to admit to certificate management incompetence.
Yes none of their Linux PC got hacked.
I got into a bit of a flame war back and forth with a guy when the Java vulnerability first appeared. He said it would only affect PCs since viruses don't work on Mac or Linux. I called bs he responded with "they use different filesystems, learn something before spewing off at the mouth." To which I replied: 1) this is a browser based attack and 2) do you think a hacker can't figure out /home/bob rather than \Users\bob? My God the things people come up with. All three platforms now have a request for elevation kind of mechanism that is supposed to protect you. The problem is for 90% of users a UNC prompt or its mac/linux equivalent pops up and they click ok. To most users the fingers go in the ears as soon as you try to explain the risks and what is happening and they just ask "So what do I need to click to continue?" This is more a mental problem then a technological one and I don't see any likely solution. Sandboxing like Win 8 Modern can help where you at least in theory make no app able to see each other directly or even the whole of the filesystem but there are just too many use cases where being able to browse all the filesystem, one app needs to get something from anothers space etc that are needed.
It wasn't just the Macs. This was an attack on the Oracle java browser plugin, not an attack on a specific platform.
Troll less, recoiledsnake.kthxbai.
Yes, it was just the macs. The attack vector was a Java vulnerability, but the payload is always OS specific. Some attacks have been known to serve different payload after sensing the OS. But not this one. This payload was Mac specific, and Mac computers were the only one affected.
Coincidentally, the Java vulnerability exploited in the attack had been patched by Oracle several weeks before. But the vulnerability was still in the Apple maintained Java 6 (Apple still maintains their own Java 6 until EOLed - Oracle has only committed to maintain Java 7 on OS X).
This is all Macs and all Apple.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
By the same token, a huge section of "Windows Malware" also has nothing to do with Windows Security. Yet we see hundreds of modded up posts on Slashdot bashing Microsoft over it regularly, yet Apple seems to be getting a free pass just like Android.
Again, this has zero to do with OS X security. This is all about end user installed software, provided and supported by Oracle.
Just so we're all on the same page, when computers get infected with malware it is not the fault of the OS, it is the fault of the third-party software, right? It seems like I heard a different tune when people were talking about Windows machines getting infected through third-party software.
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
Well something like 80% of BSOD issues were driver based (talk from a while back in XP days) but that didn't stop MS from getting the blame. A company can encourage other vendors to make good stuff but they can't force customers to apply the blame correctly when 3rd parties fail. It is fair game for MS to say "we've been hacked and yeah our Macs got hacked too" if it is true. It is also in their best interest to make sure that their competitors get included in the sound bits about the problem (and the source of the problem too of course) so that they don't get stuck with all the blame.
Oh sure. Everything that has been said about Macs and Linux still stands.
Now we all knew Java was riddled with holes. That too still stands.
Macs and Linux just happen to be able to run Java.
If by "sideloading from who-knows-where and installs themselves" you mean "downloading from approved app channels (Google Play Store)"... http://arstechnica.com/security/2012/07/more-malware-found-hosted-in-google-android-market/
Unlike porn, which yada yada rimshot hey-ooh!
Why are the computers at Apple "obviously" Macs?
iTunes, QuickTime, Safari, and other Apple software is all available for Windows. Do you think Apple does all that Windows development without any Windows machines?
Someone else stated that if it was only Macs infected, Microsoft would have made sure to state that. They didn't state that *any* of the computers were Macs, despite the implication with the "Mac Business Unit" bit, so it's safe to say that at least some of them were runnimg Windows.
"City hall" in German is "Rathaus" Kinda explains a few things......
The reason I'll have to disagree with you is that the press release does not say it was Macs that were compromised. It said in the Mac business unit. For all we know, it was 100% Windows machines that were compromised, but the press release is carefully designed to throw blame and obfuscate the facts so that when the general press gets a hold of it, the damage is as minimized as possible.
Warning: Teh poster of this messaeg is lysdexic