Schneier on Security

Clive Robinson • July 22, 2025 6:00 AM

@ Bruce, ALL,

Another serious Microsoft Vulnerability Hacked

Just up in the news yesterday,

https://www.independent.co.uk/news/world/americas/us-politics/microsoft-sharepoint-hack-government-agencies-b2792934.html

Is that US State agencies and thousands of servers running Microsoft Sharepoint have been attacked successfully via a Zero Day that MS has just issued a patch for only one version so far,

“By obtaining access to internal servers, the hackers may have been able to steal sensitive data from connected Outlook and Teams accounts, including passwords, as well as cryptographic keys to allow them back in. Cloud-based services are not thought to have been compromised.

Microsoft has already issued one patch to address the vulnerability but, at the time of writing, two more versions of SharePoint were still awaiting custom patches of their own.”

It appears that the vulnerability has been there for quite some time, as the attackers were clued up by a Microsoft patch,

“According to Marci McCarthy, spokesperson for the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), the hack came after Microsoft fixed a security flaw in SharePoint earlier this month, which inadvertently alerted the hackers that they might be able to exploit a similar vulnerability.”

To say the old quote,

“Once you have erred, no matter what you do, ‘you are damned if you do, and damned if you don’t’.”

Might seem to be ‘rubbing salt in’ but consider even Bill Gates once got upset because of the way Microsoft Software was full of vulnerabilities. So he changed the way things were done…

Maybe he should ‘pop back into the office to do the same again’.

Clive Robinson • August 21, 2025 11:15 AM

@ Winter, lurker,

We joke about,

“dmDoing the same thing over and over and expecting different results”

But is it madness or the observer not understanding.

I worked in an office once where one of my co-workers just kept looking up sort of doing a sigh crossed with a tut. She caught a different train to me so we left at different times. It was only by chance I was working late, and she’d already left and her desk phone rang. So I grabbed it to take a message and in the process ended up siting down to search for a pencil and scrap of paper. It was whilst doing this I saw there was a tight sight line to a clock on the wall in the lab on the other side of the corridor. Move your head even slightly and you could not see the clock.

I then realised Her glancing was just good old fashioned “clock watching”… So Her sigh and tut was I guess due to the disappointment of how the day dragged on.

So not madness just “the human condition” grinding on… Which brings up,

“We think Knowledge is Power”

It is but only if you have,

1, Sufficient Understanding
2, Sufficient time
3, Sufficient agency.

It is kind of the reverse view of accidents. For some reason people think,

“accident = act of God”

Or similar. personally I don’t believe in accidents or deities.

I view an accident as an “event” where the laws of physics apply as you would expect.

But you do not have

1, Sufficient time
2, Sufficient information
3, Sufficient physical ability

To take preventative action.

But as you note humans get it backwards, because of “cognitive conditioning” or if you prefere “brain washing” by Church / State / Education.

There is a reason why religion concentrates on Women / Mothers. It’s so they can get in the childs mind before the child has mental self defences. The religion knows that in the main women control the home not the men. The person who controls the home mostly controls the family close in.

So two things follow,

1, Women are those that are in effect controlled by the church men / priests.

2, The priests are not allowed to marry so they are less influenced.

But there is a third reason which is “succession of power”. If a priest does not have children then their behaviour is more constrained.

Thus the right of succession is for the nobles not the priests, the commoners or for women (unless unmarried and childless).

One of the most important scams in religion is the God and Godhead alleged relationship. A god supposedly dictates to man through the godhead (king). Thus anything the godhead dictates is not them but the god speaking through them… Thus the godhead is not responsible any more than any other messenger.

But… The religious leader controls how the godheads message gets disseminated through the priesthood to the entirety of the godheads realm. Which gives the religious leader immense control and the advantages that brings. But also none or at most few of the disadvantages…

With children taught by mothers to go down on the knee to priests as the voice of god through the godhead, church, and priesthood, they were like members of a cult brainwashed beyond even belief… Thus “the question of “Who do you trust? And “What is truth?” Just don’t arise. And where it does declaring an awkward individual a heretic and having them killed both painfully and publicly stops the questions needing to being answered or getting asked again…