The President Ordered Board to Probe Massive Russian Cyberattack. It Never Did(propublica.org)
propublica.org
The President Ordered Board to Probe Massive Russian Cyberattack. It Never Did
https://www.propublica.org/article/cyber-safety-board-never-investigated-solarwinds-breach-microsoft
24 comments
This is in regards to the SUNBURST malware delivered via SolarWinds' Orion platform. I like the Qualys blog for a detailed technical analysis: https://blog.qualys.com/vulnerabilities-threat-research/2021...
I think that was the entrypoint. But I think the ProPublica article wants more research into the weakness in Microsoft's default (at the time) Active Directory settings that allowed lateral movement, as described in
https://www.propublica.org/article/microsoft-solarwinds-gold...
https://www.propublica.org/article/microsoft-solarwinds-gold...
Actually it's a rabbit hole to wander around in. But only if you know. IYKYK.
> The report triggered a House Homeland Security Committee hearing with Microsoft president Smith last month. Smith said the company was making security its top priority.
I've heard that one a few times from Microsoft over the years.
I've heard that one a few times from Microsoft over the years.
Wow, he didn't even say what security, so I'm going to assume financial security.
The scorpion assures the frog that it takes the issue of amphibians being stung to death very seriously.
> But for reasons that experts say remain unclear, that never happened.
It's very clear why. Don't think for a second this is accidental, it's way, way to high profile for that.
It's damage control. Microsoft feels it's better for them to take the blame for not investing rather than exposing their awful or even sinister practices.
This is why "Adverse inference" is a thing in court. If you destroy or refuse produce evidence that the judge knows you have, the judge can rule based on what he thinks is in that evidence. That certainly won't be in your favour.
It's very clear why. Don't think for a second this is accidental, it's way, way to high profile for that.
It's damage control. Microsoft feels it's better for them to take the blame for not investing rather than exposing their awful or even sinister practices.
This is why "Adverse inference" is a thing in court. If you destroy or refuse produce evidence that the judge knows you have, the judge can rule based on what he thinks is in that evidence. That certainly won't be in your favour.
There's an alternative explanation. MSFT and the intelligence community were both aware of the flaw and keeping it's existence. Unfortunately, it was weaponized against them (as can happen in these situations).
To be clear: I am speculating for the sake of discussion.
To be clear: I am speculating for the sake of discussion.
This discussion on federal disclosure requirements for zero-days is really interesting: https://jia.sipa.columbia.edu/news/us-government-and-zero-da...
"The policy also includes all vulnerabilities (hardware or software) that were “newly discovered and not publicly known,” regardless of whether they were discovered by the government or purchased on the grey markets, which sell to governments and other hacking groups. However, in a notable loophole, agencies did not have to submit vulnerabilities that were not “newly discovered.” That is, if the zero day was discovered prior to 2010, they could be retained with no subsequent review. Indeed, once a vulnerability went through the process and was retained there was no periodic review to see if the decision was still solid risk management. Also, this process would have excluded non-commercial vulnerabilities and probably those that were not made or used in the United States or by its allies. If the CIA or NSA were able to get their hands on a zero day in a Russian-made S-400 air defense missile system, they would not need DHS concurrence to keep it secret."
There are a few ways for feds to avoid disclosing zero-days they're aware of, but I don't think any of them apply in this instance. Maybe they have something equivalent to an ISOO notice to prevent news orgs from publishing classified information to prevent Microsoft, etc. from disclosing security vulnerabilities they're actively using?
"The policy also includes all vulnerabilities (hardware or software) that were “newly discovered and not publicly known,” regardless of whether they were discovered by the government or purchased on the grey markets, which sell to governments and other hacking groups. However, in a notable loophole, agencies did not have to submit vulnerabilities that were not “newly discovered.” That is, if the zero day was discovered prior to 2010, they could be retained with no subsequent review. Indeed, once a vulnerability went through the process and was retained there was no periodic review to see if the decision was still solid risk management. Also, this process would have excluded non-commercial vulnerabilities and probably those that were not made or used in the United States or by its allies. If the CIA or NSA were able to get their hands on a zero day in a Russian-made S-400 air defense missile system, they would not need DHS concurrence to keep it secret."
There are a few ways for feds to avoid disclosing zero-days they're aware of, but I don't think any of them apply in this instance. Maybe they have something equivalent to an ISOO notice to prevent news orgs from publishing classified information to prevent Microsoft, etc. from disclosing security vulnerabilities they're actively using?
It's no surprise Microsoft and Boeing get special treatment and never face scrutiny for their foul-ups that get people killed and harm America's security because PR and profits come first.
Security is an afterthought even for the White house. The more layers of management and bureaucracy you had to a decision chain, the less likely it will turn into action.
Speaking of sweeping things under the rug, it's really interesting how quickly this fell off the first page of HN. There wasn't even time for the comments to turn emo before poof...gone. Been noticing a lot of this lately. Pointless and useless stories with almost no comments will linger on the first page for half a day or more, but stories that matter are getting moderated away before they even elicit two digits of comments.
>Smith said the company was making security its top priority.
This is an outright lie and everyone knows it
Microsoft's actual top priority is growing market cap. More specifically, grow profitability relative to competitors in the sector, aka Apple, Meta etc...
If an increase in "security" (whatever that means) had a linear or directly positively correlated/causal relationship with profitability then they might actually do it
However we all know that security does not increase profitability - it's a cost center from the corporate CFO perspective because literally nobody is tracking "how many contracts did we lose because we didn't actually implement the best security"
The reality is that almost all IT security is theater because the foundational architecture and design of access control, IDAM, network monitoring and alerting, data collection, data segregation etc... all have easily exploitable holes and you only need to break one to bust the whole thing usually. MSFT builds in these holes often intentionally for NATSEC customers, so "security" is just a political ruse
That's why they play these games because almost nobody believes in IT security that also allows for functional and helpful tools - and if they were honest then everyone would be horrified.
At least I've never met anyone (outside of spooks) that takes it as seriously as ACTUALLY the top priority - because that would mean you have to design your stack for it.
This is an outright lie and everyone knows it
Microsoft's actual top priority is growing market cap. More specifically, grow profitability relative to competitors in the sector, aka Apple, Meta etc...
If an increase in "security" (whatever that means) had a linear or directly positively correlated/causal relationship with profitability then they might actually do it
However we all know that security does not increase profitability - it's a cost center from the corporate CFO perspective because literally nobody is tracking "how many contracts did we lose because we didn't actually implement the best security"
The reality is that almost all IT security is theater because the foundational architecture and design of access control, IDAM, network monitoring and alerting, data collection, data segregation etc... all have easily exploitable holes and you only need to break one to bust the whole thing usually. MSFT builds in these holes often intentionally for NATSEC customers, so "security" is just a political ruse
That's why they play these games because almost nobody believes in IT security that also allows for functional and helpful tools - and if they were honest then everyone would be horrified.
At least I've never met anyone (outside of spooks) that takes it as seriously as ACTUALLY the top priority - because that would mean you have to design your stack for it.
[deleted]
[deleted]
giardini(2)
The obvious reason not to do the probe is because they were ordered by someone else they hold more dear not to do that, or it was expedient to protect someone they hold more dear -- any arrests yet?
The UK's Russia dossier seemed to get buried by the then PM Alexander Boris de Pfeffle Johnson. Does USA have Putin collaborators in high places too?
The UK's Russia dossier seemed to get buried by the then PM Alexander Boris de Pfeffle Johnson. Does USA have Putin collaborators in high places too?