A few great first person write-ups I found documenting how these companies below were breached…
Please share other posts/write-ups you’re aware of…
Just a friendly reminder to make sure you’re only allowing port 80, 443, and maybe 8080 outbound from your network. According to this recent US CERT alert advanced attackers are using email attachments to leverage legitimate Microsoft Office functions to retrieve a document from a remote server using the Server Message Block (SMB) protocol. This sends the user’s credential hash to the remote server prior to retrieving the requested file. (Note: It is not necessary for the file to be retrieved for the transfer of credentials to occur.) The threat actors then likely used password-cracking techniques to obtain the plaintext password.
TCP ports 445 or 139 and UDP ports 137 or 138 (SMB) should only be allowed internally !!!
There’s a great summary of the government’s case against Microsoft concerning the subpoenaing ability of data (email) residing in an overseas data center controlled by a US company. The crux of the dispute is the territorial reach (and territorial applicability) of the Stored Communications Act (SCA), a subset of the Electronic Communications Privacy Act (ECPA) that governs law enforcement access to communications data.
The dispute arose when the Justice Department brought a warrant to Microsoft – issued based upon probable cause under the SCA (18 U.S.C. § 2703) – asking for the details and contents of an email account believed to be associated with a suspected drug trafficker.
Microsoft produced the transactional records it held on its data centers in the United States, but declined to produce the customer’s emails that it said were stored on a data center in Ireland.
A technical solution has finally been proposed to avoid locking out Linux and other OS vendors from UEFI shipped motherboards. A couple of months ago Microsoft made waves by announcing their Windows 8 support for UEFI. Open source supports took notice that this security mechanism could prevent other operating systems from booting on UEFI compatible hardware.
Microsoft also recently released an eye catching paper aptly named that discusses the validity of security reports. Far from being broadly-based estimates of losses across the population, the cyber-crime estimates that we have appear to be largely the answers of a handful of people extrapolated to the whole population.