Slashdot Mirror
Microsoft Responded Quietly After Detecting Secret Database Hack in 2013 (reuters.com)
Citing five former employees, Reuters reported on Tuesday that Microsoft's secret internal database for tracking bugs in its own software was broken into by a highly sophisticated hacking group more than four years ago. From the report: The company did not disclose the extent of the attack to the public or its customers after its discovery in 2013, but the five former employees described it to Reuters in separate interviews. Microsoft declined to discuss the incident. The database contained descriptions of critical and unfixed vulnerabilities in some of the most widely used software in the world, including the Windows operating system. Spies for governments around the globe and other hackers covet such information because it shows them how to create tools for electronic break-ins. The Microsoft flaws were fixed likely within months of the hack, according to the former employees. Yet speaking out for the first time, these former employees as well as U.S. officials informed of the breach by Reuters said it alarmed them because the hackers could have used the data at the time to mount attacks elsewhere, spreading their reach into government and corporate networks. "Bad guys with inside access to that information would literally have a 'skeleton key' for hundreds of millions of computers around the world," said Eric Rosenbach, who was U.S. deputy assistant secretary of defense for cyber at the time.
Regardless of whether Microsoft fixed the flaws or not, there are still millions of old computers out there with important information that do important things that have not been / will not ever be patched.
>> database contained descriptions of critical and unfixed vulnerabilities in some of the most widely used software in the world, including the Windows operating system
Closed OS FTW. On second thought, TFA says "including Windows", so was Microsoft hanging onto zero-days for other companies?
They really kept this database on an internet-facing PC?
What exactly were they supposed to do? Disclosing this publicly wouldn't have gotten the 0-days closed any faster but would have started malicious actors scrambling to get their hands on that database. Some already had it -- publicly admit it exists and has been exfiltrated, and anyone with even a passing interest is going to want it.
Now if it had been a database of someone else's 0-days, then they could be expected to at least tell the vendors of the products in question. But when they are the vendor? It's an internal problem.
How is the Riemann zeta function like Trump rallies? Both have an endless number of trivial zeros.
Okay, one can can argue that telling means people will hack. but in my experience, the hacking community finds out anyway, and then the public isn't even given a chance to defend themselves. Perhaps MS thought it was cute to leave a backdoor, say, for the NSA, but as long as the customers are paying their salaries they have an ethical obligation to inform the customers so they can take actions to protect themselves. This is why closed source software cannot be trusted and is in fact less secure: people can leave known issues and nobody who truly knows is going to tell, so they can use it for their own purposes. No accountability, means no responsibility, means irresponsible actions. When the world knows as a whole, the world is stronger as a whole.
"Imagination is more important than knowledge" - Einstein
Before you rush to post about how insecure Microsoft is, don't forget that your social security number and financial history were released in a hack of Linux / Apache / Struts.
Funny thing this wasn't a windows hack. FTA: "The group, variously called Morpho, Butterfly and Wild Neutron by security researchers elsewhere, exploited a flaw in the Java programming language to penetrate employees' Apple Macintosh computers and then move to company networks"
I browse on +1 so AC's need not respond, I won't see it.
Before you rush to post about how insecure Microsoft is, don't forget that your social security number and financial history were released in a hack of Linux / Apache / Struts.
Funny thing this wasn't a windows hack. FTA: "The group, variously called Morpho, Butterfly and Wild Neutron by security researchers elsewhere, exploited a flaw in the Java programming language to penetrate employees' Apple Macintosh computers and then move to company networks"
Hypothesis: The hack was ordered by the SSA trying to discredit the use of social security numbers as financial credentials, so they could push the government to adopt cryptographically secure credentials for individuals.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Before you rush to post about how insecure Microsoft is, don't forget that your social security number and financial history were released in a hack of Linux / Apache / Struts.
Funny thing this wasn't a windows hack. FTA: "The group, variously called Morpho, Butterfly and Wild Neutron by security researchers elsewhere, exploited a flaw in the Java programming language to penetrate employees' Apple Macintosh computers and then move to company networks"
Hypothesis: The hack was ordered by the SSA trying to discredit the use of social security numbers as financial credentials, so they could push the government to adopt cryptographically secure credentials for individuals.
SSA could care less about the SSN in that respect. It'd more likely be the FBI, CIA, NSA, DIA, and a number of other agencies that have more of an interest with collecting all that information...
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
methinks you dont really understand any of them, which, afaics, amount to bugs of local users of the system. none of them are critical vulnerabilities. let alone anywhere close to a database chock full of unfixed severe vulnerabilities because not enough developers have access to the windows source code to fix them in a reasonable time.
Bad guys with inside access to that information would literally have a 'skeleton key' for hundreds of millions of computers around the world.
They literally would not.
Nope, no sig
Before you rush to post about how insecure Microsoft is, don't forget that your social security number and financial history were released in a hack of Linux / Apache / Struts.
Funny thing this wasn't a windows hack. FTA: "The group, variously called Morpho, Butterfly and Wild Neutron by security researchers elsewhere, exploited a flaw in the Java programming language to penetrate employees' Apple Macintosh computers and then move to company networks"
Hypothesis: The hack was ordered by the SSA trying to discredit the use of social security numbers as financial credentials, so they could push the government to adopt cryptographically secure credentials for individuals.
You are going to have to expand on that hypothesis for me. I'm not seeing a link to SSA's desire to not use SSN for financial credentials and a hack of an internal Microsoft bug database.
I browse on +1 so AC's need not respond, I won't see it.
Before you rush to post about how insecure Microsoft is, don't forget that your social security number and financial history were released in a hack of Linux / Apache / Struts.
Funny thing this wasn't a windows hack. FTA: "The group, variously called Morpho, Butterfly and Wild Neutron by security researchers elsewhere, exploited a flaw in the Java programming language to penetrate employees' Apple Macintosh computers and then move to company networks"
Hypothesis: The hack was ordered by the SSA trying to discredit the use of social security numbers as financial credentials, so they could push the government to adopt cryptographically secure credentials for individuals.
You are going to have to expand on that hypothesis for me. I'm not seeing a link to SSA's desire to not use SSN for financial credentials and a hack of an internal Microsoft bug database.
That's why it's a hypothesis - so I don't have to prove it. The feds did ask NIST (I think NIST) to start working on a crypto based replacement for SSNs a couple of weeks ago. The SSA thing came from the post that is one level up in the hierarchy up, which brought up the topic.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
I didn't ask you to prove it, I asked you to explain it. It's nonsensical.
I browse on +1 so AC's need not respond, I won't see it.
> It's nonsensical.
That's because it was a joke. Although with the current government I wouldn't be surprised if it was true.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
I don't think you understand how jokes work....
I browse on +1 so AC's need not respond, I won't see it.
I don't think you understand how jokes work....
Slashdot is the place where jokes go to whoosh.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.