Slashdot Mirror
Microsoft Responded Quietly After Detecting Secret Database Hack in 2013 (reuters.com)
Citing five former employees, Reuters reported on Tuesday that Microsoft's secret internal database for tracking bugs in its own software was broken into by a highly sophisticated hacking group more than four years ago. From the report: The company did not disclose the extent of the attack to the public or its customers after its discovery in 2013, but the five former employees described it to Reuters in separate interviews. Microsoft declined to discuss the incident. The database contained descriptions of critical and unfixed vulnerabilities in some of the most widely used software in the world, including the Windows operating system. Spies for governments around the globe and other hackers covet such information because it shows them how to create tools for electronic break-ins. The Microsoft flaws were fixed likely within months of the hack, according to the former employees. Yet speaking out for the first time, these former employees as well as U.S. officials informed of the breach by Reuters said it alarmed them because the hackers could have used the data at the time to mount attacks elsewhere, spreading their reach into government and corporate networks. "Bad guys with inside access to that information would literally have a 'skeleton key' for hundreds of millions of computers around the world," said Eric Rosenbach, who was U.S. deputy assistant secretary of defense for cyber at the time.
Regardless of whether Microsoft fixed the flaws or not, there are still millions of old computers out there with important information that do important things that have not been / will not ever be patched.
Before you rush to post about how insecure Microsoft is, don't forget that your social security number and financial history were released in a hack of Linux / Apache / Struts.
>> database contained descriptions of critical and unfixed vulnerabilities in some of the most widely used software in the world, including the Windows operating system
Closed OS FTW. On second thought, TFA says "including Windows", so was Microsoft hanging onto zero-days for other companies?
Because bad guys always have access to the bugs, in writing!
They really kept this database on an internet-facing PC?
What exactly were they supposed to do? Disclosing this publicly wouldn't have gotten the 0-days closed any faster but would have started malicious actors scrambling to get their hands on that database. Some already had it -- publicly admit it exists and has been exfiltrated, and anyone with even a passing interest is going to want it.
Now if it had been a database of someone else's 0-days, then they could be expected to at least tell the vendors of the products in question. But when they are the vendor? It's an internal problem.
How is the Riemann zeta function like Trump rallies? Both have an endless number of trivial zeros.
See subject & DataCore tech cranks wheezing SQL Servers to ridiculous speeds https://www.theregister.co.uk/2017/09/26/datacore_drives_sql_server_to_silly_speeds/
* Pretty impressive imo...
(They raised the amount of users that can concurrently hit the DB, especially on writes, massively...)
APK
P.S.=> Great job by DataCore... apk
how else do you think they have so many zero-days and other exploits noone else ever heard of? They are literally cyber terrorists, and it's criminal that they are allowed to do this to the world, and even their own companies.
Okay, one can can argue that telling means people will hack. but in my experience, the hacking community finds out anyway, and then the public isn't even given a chance to defend themselves. Perhaps MS thought it was cute to leave a backdoor, say, for the NSA, but as long as the customers are paying their salaries they have an ethical obligation to inform the customers so they can take actions to protect themselves. This is why closed source software cannot be trusted and is in fact less secure: people can leave known issues and nobody who truly knows is going to tell, so they can use it for their own purposes. No accountability, means no responsibility, means irresponsible actions. When the world knows as a whole, the world is stronger as a whole.
"Imagination is more important than knowledge" - Einstein
'Yet speaking out for the first time, these former employees as well as U.S. officials informed of the breach by Reuters said it alarmed them because the hackers could have used the data at the time to mount attacks elsewhere, spreading their reach into government and corporate networks.'
Perhaps Microsoft was told to keep the hack quiet after advising a security agency (likely DHS or possibly NSA I would imagine).
Notice in the above quote 'informed of the breach by Reuters'.
Would these employees have even known about contact between Microsoft and a security agency?
Not enough information to condemn Microsoft's response.
Nobody mentioned MS KB with bugs mentioned was app accessing network share with guest read, share containing 100s of thousands .txt files with bug descriptions, also connected with Clarify "ticketing system" total joke without any security. Nobody hacked it, anybody could just download it...
Bad guys with inside access to that information would literally have a 'skeleton key' for hundreds of millions of computers around the world.
They literally would not.
Nope, no sig