pull down to refresh
Everyone has poor security, even the people with high-end security, because the chains are interdependent and all you need is one weak link.
I find this really depressing. The sense that if I have one weak link in my security, it's all for naught is scarily apparent to me in Bitcoin. But I know that much of my life is even more exposed. I'm not looking forward to navigating all this in the coming years.
How I read it, that was low effort and more than one.
It's not even about the number of employees per se. You need one then you can privilege escalate inside azure/outlook because MS Azure, at least in the EU, rarely patches fast, and throws out many issues as "not-a-bug". The entire EU (and almost every national govt inside the EU) runs more than 70% of their infra on Azure. So within that environment, you basically only need to get in once. I've been given 2 demos in the past 18 months of what it's like on Azure mail servers in terms of exploitable "not-a-bug"s, and it's not pretty. So all you need is some dude with a login, or even hotter and concurrently easier targets: sysadmins.
The main issue is digital systems security across the entire chain. It's not just some Estonian regulator (or the DMV) that has poor security - that's just low hanging fruit. Everyone has poor security, even the people with high-end security, because the chains are interdependent and all you need is one weak link. That's why I claimed that after Bitcoin comes the banks. And here we are. The guy didn't even have to hack the bank.
I know a bunch of people in LE and the honest, knowledgeable, hard-working people among them are often as much against this crap as you or I. Same goes mostly for the few natsec people I know, on both continents. They're often very much aware of how poor the systems are, how bad the requirements were at the start and how even these were higher standards than what got delivered. In all aspects really, because it's not just security, it's also in the breadth of effectiveness of what these systems were intended for.
Most of these ideas come from people that want to be re-elected / re-appointed their next term and thus cannot "look weak" by not addressing something for the sake of keeping the greater evil out, because it will be narrated against them no matter what. That means that we get completely leaky mandatory processes, that can often not be enforced and often cannot be secured without trustmebro bullshit. The KYC crap is one of the things where this is going very wrong very quickly now. It's not much worse in Europe than in the US tho, as the prescribed chains of information dissemination have, especially since 2020, been heavily maldesigned everywhere. I've since then worked on projects on both sides on the Atlantic where PII non-confidentiality is mandated rather than stricly forbidden.