Ongoing & enormous Microsoft Exchange server hack hits 30,000 US groups

13»

Comments

  • Reply 41 of 48
    GeorgeBMacGeorgeBMac Posts: 11,421member
    danvm said:
    danvm said:
    danvm said:
    danvm said:
    What bothers me most about this is that Microsoft was recently chosen to build and maintain the central hub of our national defense -- the $10 Billion JEDI contract.

    Why would anybody pick an organization infamous for its porous security for such a critical mission?


    I haven't seen many cases of MS applications and services (Windows Server, SQL, Exchange, MS 365, Azure, etc) being compromised, at least in recent years.  Maybe that was the case 20 years ago, with Windows Server 2000 / Windows XP, but not today.  That doesn't means they are perfect, but it looks like they are doing a very good job if they are winning contracts as large as the example you gave with JEDI. 

    BTW, that contract can be canceled if Amazon keeps fighting for it.  Let's see how it ends.

    https://www.extremetech.com/computing/320577-pentagon-may-dump-10-billion-jedi-program-over-microsoft-amazon-fight
    https://www.crn.com/news/cloud/microsoft-could-lose-jedi-contract-if-aws-case-isn-t-dismissed-report

    Then you may as well go ahead and delete your anti-virus software if MS products are so safe and secure.
    I don't have 3rd party AV installed in my Windows PC, neither in my Mac.  Windows Defender works very nice in Windows 10, and the same can be said of xProtect in macOS.  Interesting how both, MS and Apple integrate an AV to protect their users.  I suppose that in your POV, neither are secure or safe, right?

    Privacy and security are hallmarks of Apple products.   Not Microsoft's.   You didn't know that?
    Most of MS bad reputation for not being secure is for their issues with Windows 2000 / XP. In most recent years they have been proved very secure, specially in the server and cloud services. Maybe this was one of the reasons they were considered for the JEDI program. Also most business / enterprises worldwide run in the MS ecosystem for years. If they were as bad as you think, most of those business / enterprises would have move to another solutions, specially today, with so many options available.
    Not necessarily. Most businesses look at the IT investment they've already made, look at the costs and risks of compromise by external actors and make a financial decision about whether or not to spend more money on a safer system.

    I mean, if you bought a car that had a 3 star safety rank and a year later you were told that you really should buy a car with a 5 star safety rank, what would you do?
    I agree with your comment.  But if the security of the Microsoft ecosystem is as bad as @GeorgeBMac describe, it will impact daily operations and financials of business and enterprises, and that would make them look for other options.  And as today, that is not happening.  When was the last time you heard about a big security breach in Windows Server, SQL or Azure?  And it has been years from the last time MS had a security issue with Exchange, even though it is one, if not the most popular email application in business / enterprises.  My point is that MS is not "an organization infamous for its porous security for such a critical mission" as @GeorgeBMac posted.  They have proved to be very secure with their business / enterprise applications and services, but that doesn't mean they are perfect, and you'll see from time to time cases as the one with have with Exchange now.

    You set a pretty low bar.
    Or, you're just not paying attention.
  • Reply 42 of 48
    GeorgeBMacGeorgeBMac Posts: 11,421member
    danvm said:
    danvm said:
    danvm said:
    What bothers me most about this is that Microsoft was recently chosen to build and maintain the central hub of our national defense -- the $10 Billion JEDI contract.

    Why would anybody pick an organization infamous for its porous security for such a critical mission?


    I haven't seen many cases of MS applications and services (Windows Server, SQL, Exchange, MS 365, Azure, etc) being compromised, at least in recent years.  Maybe that was the case 20 years ago, with Windows Server 2000 / Windows XP, but not today.  That doesn't means they are perfect, but it looks like they are doing a very good job if they are winning contracts as large as the example you gave with JEDI. 

    BTW, that contract can be canceled if Amazon keeps fighting for it.  Let's see how it ends.

    https://www.extremetech.com/computing/320577-pentagon-may-dump-10-billion-jedi-program-over-microsoft-amazon-fight
    https://www.crn.com/news/cloud/microsoft-could-lose-jedi-contract-if-aws-case-isn-t-dismissed-report

    Then you may as well go ahead and delete your anti-virus software if MS products are so safe and secure.
    I don't have 3rd party AV installed in my Windows PC, neither in my Mac.  Windows Defender works very nice in Windows 10, and the same can be said of xProtect in macOS.  Interesting how both, MS and Apple integrate an AV to protect their users.  I suppose that in your POV, neither are secure or safe, right?

    Privacy and security are hallmarks of Apple products.   Not Microsoft's.   You didn't know that?
    Most of MS bad reputation for not being secure is for their issues with Windows 2000 / XP. In most recent years they have been proved very secure, specially in the server and cloud services. Maybe this was one of the reasons they were considered for the JEDI program. Also most business / enterprises worldwide run in the MS ecosystem for years. If they were as bad as you think, most of those business / enterprises would have move to another solutions, specially today, with so many options available.
    Not necessarily. Most businesses look at the IT investment they've already made, look at the costs and risks of compromise by external actors and make a financial decision about whether or not to spend more money on a safer system.

    I mean, if you bought a car that had a 3 star safety rank and a year later you were told that you really should buy a car with a 5 star safety rank, what would you do?

    Typically, it is not the company's data being stolen or destroyed.   It's that of their customers (such as in this case).  So, since they face no liability (except in intangibles like reputation) they have no incentive to invest in security.  

    For example:  What harm did Microsoft suffer in this case?  It wasn't they who got hacked but the people and businesses using their products.
  • Reply 43 of 48
    danvmdanvm Posts: 1,409member
    danvm said:
    danvm said:
    danvm said:
    danvm said:
    What bothers me most about this is that Microsoft was recently chosen to build and maintain the central hub of our national defense -- the $10 Billion JEDI contract.

    Why would anybody pick an organization infamous for its porous security for such a critical mission?


    I haven't seen many cases of MS applications and services (Windows Server, SQL, Exchange, MS 365, Azure, etc) being compromised, at least in recent years.  Maybe that was the case 20 years ago, with Windows Server 2000 / Windows XP, but not today.  That doesn't means they are perfect, but it looks like they are doing a very good job if they are winning contracts as large as the example you gave with JEDI. 

    BTW, that contract can be canceled if Amazon keeps fighting for it.  Let's see how it ends.

    https://www.extremetech.com/computing/320577-pentagon-may-dump-10-billion-jedi-program-over-microsoft-amazon-fight
    https://www.crn.com/news/cloud/microsoft-could-lose-jedi-contract-if-aws-case-isn-t-dismissed-report

    Then you may as well go ahead and delete your anti-virus software if MS products are so safe and secure.
    I don't have 3rd party AV installed in my Windows PC, neither in my Mac.  Windows Defender works very nice in Windows 10, and the same can be said of xProtect in macOS.  Interesting how both, MS and Apple integrate an AV to protect their users.  I suppose that in your POV, neither are secure or safe, right?

    Privacy and security are hallmarks of Apple products.   Not Microsoft's.   You didn't know that?
    Most of MS bad reputation for not being secure is for their issues with Windows 2000 / XP. In most recent years they have been proved very secure, specially in the server and cloud services. Maybe this was one of the reasons they were considered for the JEDI program. Also most business / enterprises worldwide run in the MS ecosystem for years. If they were as bad as you think, most of those business / enterprises would have move to another solutions, specially today, with so many options available.
    Not necessarily. Most businesses look at the IT investment they've already made, look at the costs and risks of compromise by external actors and make a financial decision about whether or not to spend more money on a safer system.

    I mean, if you bought a car that had a 3 star safety rank and a year later you were told that you really should buy a car with a 5 star safety rank, what would you do?
    I agree with your comment.  But if the security of the Microsoft ecosystem is as bad as @GeorgeBMac describe, it will impact daily operations and financials of business and enterprises, and that would make them look for other options.  And as today, that is not happening.  When was the last time you heard about a big security breach in Windows Server, SQL or Azure?  And it has been years from the last time MS had a security issue with Exchange, even though it is one, if not the most popular email application in business / enterprises.  My point is that MS is not "an organization infamous for its porous security for such a critical mission" as @GeorgeBMac posted.  They have proved to be very secure with their business / enterprise applications and services, but that doesn't mean they are perfect, and you'll see from time to time cases as the one with have with Exchange now.

    You set a pretty low bar.
    Or, you're just not paying attention.
    On the contrary, in recent years MS servers applications and services have prove to be very secure.  You don't always hear about major problems as this one with Exchange.  Like I posted before, if MS is so unsecure as you describe, impacting daily operations and financials, business and enterprises would move to other platforms.  Again, that doesn't mean they are perfect, but they aren't as bad as you describe. 
    edited March 2021
  • Reply 44 of 48
    danvmdanvm Posts: 1,409member
    danvm said:
    danvm said:
    danvm said:
    What bothers me most about this is that Microsoft was recently chosen to build and maintain the central hub of our national defense -- the $10 Billion JEDI contract.

    Why would anybody pick an organization infamous for its porous security for such a critical mission?


    I haven't seen many cases of MS applications and services (Windows Server, SQL, Exchange, MS 365, Azure, etc) being compromised, at least in recent years.  Maybe that was the case 20 years ago, with Windows Server 2000 / Windows XP, but not today.  That doesn't means they are perfect, but it looks like they are doing a very good job if they are winning contracts as large as the example you gave with JEDI. 

    BTW, that contract can be canceled if Amazon keeps fighting for it.  Let's see how it ends.

    https://www.extremetech.com/computing/320577-pentagon-may-dump-10-billion-jedi-program-over-microsoft-amazon-fight
    https://www.crn.com/news/cloud/microsoft-could-lose-jedi-contract-if-aws-case-isn-t-dismissed-report

    Then you may as well go ahead and delete your anti-virus software if MS products are so safe and secure.
    I don't have 3rd party AV installed in my Windows PC, neither in my Mac.  Windows Defender works very nice in Windows 10, and the same can be said of xProtect in macOS.  Interesting how both, MS and Apple integrate an AV to protect their users.  I suppose that in your POV, neither are secure or safe, right?

    Privacy and security are hallmarks of Apple products.   Not Microsoft's.   You didn't know that?
    Most of MS bad reputation for not being secure is for their issues with Windows 2000 / XP. In most recent years they have been proved very secure, specially in the server and cloud services. Maybe this was one of the reasons they were considered for the JEDI program. Also most business / enterprises worldwide run in the MS ecosystem for years. If they were as bad as you think, most of those business / enterprises would have move to another solutions, specially today, with so many options available.
    Not necessarily. Most businesses look at the IT investment they've already made, look at the costs and risks of compromise by external actors and make a financial decision about whether or not to spend more money on a safer system.

    I mean, if you bought a car that had a 3 star safety rank and a year later you were told that you really should buy a car with a 5 star safety rank, what would you do?

    Typically, it is not the company's data being stolen or destroyed.   It's that of their customers (such as in this case).  So, since they face no liability (except in intangibles like reputation) they have no incentive to invest in security.  

    For example:  What harm did Microsoft suffer in this case?  It wasn't they who got hacked but the people and businesses using their products.
    Are you sure that they have no incentive for investing in security?  What I have seen is the oposite.  They take security seriously, specially with their business / enterprise ecosystem.  For example, Azure have a lot of security certifications, including DoD, FIPS, NIST and HIPAA.  This certifications processes are very extense and expensive.  It's easy to see that they invest in securing their platforms. 

    Azure compliance documentation | Microsoft Docs

    Initially, like you said, it has an impact in their reputation.  But if they don't take steps to fix their security issues, customers will look for other solutions.  At the end, it affects their business.  

  • Reply 45 of 48
    GeorgeBMacGeorgeBMac Posts: 11,421member
    danvm said:
    danvm said:
    danvm said:
    danvm said:
    danvm said:
    What bothers me most about this is that Microsoft was recently chosen to build and maintain the central hub of our national defense -- the $10 Billion JEDI contract.

    Why would anybody pick an organization infamous for its porous security for such a critical mission?


    I haven't seen many cases of MS applications and services (Windows Server, SQL, Exchange, MS 365, Azure, etc) being compromised, at least in recent years.  Maybe that was the case 20 years ago, with Windows Server 2000 / Windows XP, but not today.  That doesn't means they are perfect, but it looks like they are doing a very good job if they are winning contracts as large as the example you gave with JEDI. 

    BTW, that contract can be canceled if Amazon keeps fighting for it.  Let's see how it ends.

    https://www.extremetech.com/computing/320577-pentagon-may-dump-10-billion-jedi-program-over-microsoft-amazon-fight
    https://www.crn.com/news/cloud/microsoft-could-lose-jedi-contract-if-aws-case-isn-t-dismissed-report

    Then you may as well go ahead and delete your anti-virus software if MS products are so safe and secure.
    I don't have 3rd party AV installed in my Windows PC, neither in my Mac.  Windows Defender works very nice in Windows 10, and the same can be said of xProtect in macOS.  Interesting how both, MS and Apple integrate an AV to protect their users.  I suppose that in your POV, neither are secure or safe, right?

    Privacy and security are hallmarks of Apple products.   Not Microsoft's.   You didn't know that?
    Most of MS bad reputation for not being secure is for their issues with Windows 2000 / XP. In most recent years they have been proved very secure, specially in the server and cloud services. Maybe this was one of the reasons they were considered for the JEDI program. Also most business / enterprises worldwide run in the MS ecosystem for years. If they were as bad as you think, most of those business / enterprises would have move to another solutions, specially today, with so many options available.
    Not necessarily. Most businesses look at the IT investment they've already made, look at the costs and risks of compromise by external actors and make a financial decision about whether or not to spend more money on a safer system.

    I mean, if you bought a car that had a 3 star safety rank and a year later you were told that you really should buy a car with a 5 star safety rank, what would you do?
    I agree with your comment.  But if the security of the Microsoft ecosystem is as bad as @GeorgeBMac describe, it will impact daily operations and financials of business and enterprises, and that would make them look for other options.  And as today, that is not happening.  When was the last time you heard about a big security breach in Windows Server, SQL or Azure?  And it has been years from the last time MS had a security issue with Exchange, even though it is one, if not the most popular email application in business / enterprises.  My point is that MS is not "an organization infamous for its porous security for such a critical mission" as @GeorgeBMac posted.  They have proved to be very secure with their business / enterprise applications and services, but that doesn't mean they are perfect, and you'll see from time to time cases as the one with have with Exchange now.

    You set a pretty low bar.
    Or, you're just not paying attention.
    On the contrary, in recent years MS servers applications and services have prove to be very secure.  You don't always hear about major problems as this one with Exchange.  Like I posted before, if MS is so unsecure as you describe, impacting daily operations and financials, business and enterprises would move to other platforms.  Again, that doesn't mean they are perfect, but they aren't as bad as you describe. 

    You set a pretty low bar.
    Or, you're just not paying attention.
  • Reply 46 of 48
    gatorguygatorguy Posts: 24,213member
    docbburk said:
    rob53 said:
    I guess none of you realize every country, especially the US, is involved in computer espionage on a daily basis. Before you complain about the Chinese or Russians check out the NSA, CIA and many others. 
    The fact that they are using it to steal tech/industrial secrets, scientific research, and steal info in order to win bids on contracts worldwide for Chinese companies is where it gets criminal.  Sadly the current administration says “China isn’t an enemy.  China isn’t a competitor. .......”. I hope they get their head out of their backside on this topic. 

    I think they already did that.  It's why they will be running foreign policy based on reality rather than hate
    You're of course referring to this reality:

    :...in their first month in office, Biden and Secretary of State Antony Blinken have reaffirmed many of the (previous) administration’s most significant steps targeting China, including a determination that its crackdown on Uyghur Muslims and other minorities in western Xinjiang region constitutes a “genocide” and a flat-out rejection of nearly all of China’s maritime claims in the South China Sea.

    Nor has the new administration signaled any let-up in Trump’s tariffs, restrictions on Chinese diplomats, journalists and academics in the U.S. or criticism of Chinese policies toward Tibet, Taiwan and Hong Kong. It’s also critical of Beijing’s attempts to further its increasing global influence through telecommunications technology, social media and educational and cultural exchanges."

    and

    "Biden’s nominee to head the CIA, William Burns, was explicit about his concerns over many of these issues at his confirmation hearing Wednesday. And, the newly confirmed U.S. ambassador to the United Nations, Linda Thomas-Greenfield, made a point of highlighting her unease with the state of affairs and pledged to combat Chinese attempts to exert undue pressure on other countries at the U.N."

    and:

    "The Biden administration wants to be "in lockstep" with allies and partners and then will engage with China, US State Department spokesperson Ned Price said ...

    "We know that China is engaged in a range of conduct that hurts American workers. It blunts our technological edge. It threatens our alliances and influence international organizations," Price said at a State Department briefing Tuesday.
      "And China has engaged in gross human rights violations that shock the conscience. So we will counter China's aggressive and coercive actions, sustain our key military advantages, defend democratic values, invest in advanced technologies and restore are vital security partnerships," he said. 

      The State Department spokesperson also called on China "to cease its military, diplomatic and economic pressure against Taiwan and instead engage in meaningful dialogue with Taiwan's democratically elected leadership."

      And THAT'S the reality even if it doesn't agree with you. 

      edited March 2021
    • Reply 47 of 48
      danvmdanvm Posts: 1,409member
      danvm said:
      danvm said:
      danvm said:
      danvm said:
      danvm said:
      What bothers me most about this is that Microsoft was recently chosen to build and maintain the central hub of our national defense -- the $10 Billion JEDI contract.

      Why would anybody pick an organization infamous for its porous security for such a critical mission?


      I haven't seen many cases of MS applications and services (Windows Server, SQL, Exchange, MS 365, Azure, etc) being compromised, at least in recent years.  Maybe that was the case 20 years ago, with Windows Server 2000 / Windows XP, but not today.  That doesn't means they are perfect, but it looks like they are doing a very good job if they are winning contracts as large as the example you gave with JEDI. 

      BTW, that contract can be canceled if Amazon keeps fighting for it.  Let's see how it ends.

      https://www.extremetech.com/computing/320577-pentagon-may-dump-10-billion-jedi-program-over-microsoft-amazon-fight
      https://www.crn.com/news/cloud/microsoft-could-lose-jedi-contract-if-aws-case-isn-t-dismissed-report

      Then you may as well go ahead and delete your anti-virus software if MS products are so safe and secure.
      I don't have 3rd party AV installed in my Windows PC, neither in my Mac.  Windows Defender works very nice in Windows 10, and the same can be said of xProtect in macOS.  Interesting how both, MS and Apple integrate an AV to protect their users.  I suppose that in your POV, neither are secure or safe, right?

      Privacy and security are hallmarks of Apple products.   Not Microsoft's.   You didn't know that?
      Most of MS bad reputation for not being secure is for their issues with Windows 2000 / XP. In most recent years they have been proved very secure, specially in the server and cloud services. Maybe this was one of the reasons they were considered for the JEDI program. Also most business / enterprises worldwide run in the MS ecosystem for years. If they were as bad as you think, most of those business / enterprises would have move to another solutions, specially today, with so many options available.
      Not necessarily. Most businesses look at the IT investment they've already made, look at the costs and risks of compromise by external actors and make a financial decision about whether or not to spend more money on a safer system.

      I mean, if you bought a car that had a 3 star safety rank and a year later you were told that you really should buy a car with a 5 star safety rank, what would you do?
      I agree with your comment.  But if the security of the Microsoft ecosystem is as bad as @GeorgeBMac describe, it will impact daily operations and financials of business and enterprises, and that would make them look for other options.  And as today, that is not happening.  When was the last time you heard about a big security breach in Windows Server, SQL or Azure?  And it has been years from the last time MS had a security issue with Exchange, even though it is one, if not the most popular email application in business / enterprises.  My point is that MS is not "an organization infamous for its porous security for such a critical mission" as @GeorgeBMac posted.  They have proved to be very secure with their business / enterprise applications and services, but that doesn't mean they are perfect, and you'll see from time to time cases as the one with have with Exchange now.

      You set a pretty low bar.
      Or, you're just not paying attention.
      On the contrary, in recent years MS servers applications and services have prove to be very secure.  You don't always hear about major problems as this one with Exchange.  Like I posted before, if MS is so unsecure as you describe, impacting daily operations and financials, business and enterprises would move to other platforms.  Again, that doesn't mean they are perfect, but they aren't as bad as you describe. 

      You set a pretty low bar.
      Or, you're just not paying attention.
      No, the bar is pretty high, specially with their business / enterprises software and services.  Maybe you need to pay a little more attention.  
    • Reply 48 of 48
      GeorgeBMacGeorgeBMac Posts: 11,421member
      gatorguy said:
      docbburk said:
      rob53 said:
      I guess none of you realize every country, especially the US, is involved in computer espionage on a daily basis. Before you complain about the Chinese or Russians check out the NSA, CIA and many others. 
      The fact that they are using it to steal tech/industrial secrets, scientific research, and steal info in order to win bids on contracts worldwide for Chinese companies is where it gets criminal.  Sadly the current administration says “China isn’t an enemy.  China isn’t a competitor. .......”. I hope they get their head out of their backside on this topic. 

      I think they already did that.  It's why they will be running foreign policy based on reality rather than hate
      You're of course referring to this reality:

      :...in their first month in office, Biden and Secretary of State Antony Blinken have reaffirmed many of the (previous) administration’s most significant steps targeting China, including a determination that its crackdown on Uyghur Muslims and other minorities in western Xinjiang region constitutes a “genocide” and a flat-out rejection of nearly all of China’s maritime claims in the South China Sea.

      Nor has the new administration signaled any let-up in Trump’s tariffs, restrictions on Chinese diplomats, journalists and academics in the U.S. or criticism of Chinese policies toward Tibet, Taiwan and Hong Kong. It’s also critical of Beijing’s attempts to further its increasing global influence through telecommunications technology, social media and educational and cultural exchanges."

      and

      "Biden’s nominee to head the CIA, William Burns, was explicit about his concerns over many of these issues at his confirmation hearing Wednesday. And, the newly confirmed U.S. ambassador to the United Nations, Linda Thomas-Greenfield, made a point of highlighting her unease with the state of affairs and pledged to combat Chinese attempts to exert undue pressure on other countries at the U.N."

      and:

      "The Biden administration wants to be "in lockstep" with allies and partners and then will engage with China, US State Department spokesperson Ned Price said ...

      "We know that China is engaged in a range of conduct that hurts American workers. It blunts our technological edge. It threatens our alliances and influence international organizations," Price said at a State Department briefing Tuesday.
      "And China has engaged in gross human rights violations that shock the conscience. So we will counter China's aggressive and coercive actions, sustain our key military advantages, defend democratic values, invest in advanced technologies and restore are vital security partnerships," he said. 

      The State Department spokesperson also called on China "to cease its military, diplomatic and economic pressure against Taiwan and instead engage in meaningful dialogue with Taiwan's democratically elected leadership."

      And THAT'S the reality even if it doesn't agree with you. 


      As I said:
      " It's why they will be running foreign policy based on reality rather than hate"

      That's a BIG difference.
      It is to nobody's advantage to continue Chump's cold war no matter how much you want one.
    Sign In or Register to comment.