News for hackers. Stuff that matters.

A comment on 30k U.S. organizations newly hacked via holes in Microsoft Exchange Server. Parent comment

Re:30k U.S. organizations newly hacked via holes in Microsof... by labster on Friday March 05, 2021 @10:13PM (#26364869)
That name is already taken by the department of hodling cyberattacks. They should have a National Vulnerability Agency that handles it.
[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by jjeaff on Friday March 05, 2021 @11:04PM (#26365085)
Or maybe let's revisit the charter of the NSA and make some major tweaks.
[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by Godel_unicode on Saturday March 06, 2021 @01:07AM (#26365565)
Why do people keep thinking that putting the military in charge of civilian cyber defense is in any way a good idea??
[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by goatinaboat on Saturday March 06, 2021 @03:52AM (#26366122)
Why do people keep thinking that putting the military in charge of civilian cyber defense is in any way a good idea??

The NSA has some military staff members but it is a civilian agency

[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by Godel_unicode on Saturday March 06, 2021 @12:51PM (#26369128)
The NSA has title 10 authorities. It's part of the DoD, with a chain of command running through SecDef. It is commanded by active-duty flag officers.
[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by hoseja on Saturday March 06, 2021 @02:25AM (#26365811)
At the end of the day, there is no distinction. "Civilian" is strictly nice-to-have concept.
[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by cheschire on Saturday March 06, 2021 @02:33AM (#26365840)
So you feel like America should just move their entire police force under the military and forego any civilian-esque facade?

Probably not. And that's also why cyber law enforcement and national cyber defense should be two separate entities.

[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by gogopuppygogo on Friday March 05, 2021 @11:23PM (#26365178)
Step 1.) Let marijuana users be employed so you can attract talent.

Step 2.) Pay above market rate for talent, even import it from Israel or other friendly nation states. We need a Wernher von Braun style approach to recruitment.

Step 3.) ???? Profit ????

[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by Pokepokalypse on Friday March 05, 2021 @11:46PM (#26365304)
Also: hire people who don't live in the DC beltway.

This goes for . . . well, how about most federal IT-related jobs.

[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by Hnrobert42 on Saturday March 06, 2021 @06:31AM (#26366732)
The US intelligence community is very successful attracting extremely talented folks.

It’s funny that you mention Israel. The would be one of the worst “allies” to partner with. Jonathan Pollard was just given a hero’s welcome. https://en.m.wikipedia.org/wiki/Jonathan_Pollard

[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by astrea on Friday March 05, 2021 @11:43PM (#26365281)
Step 1 sounds personal
[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by jcims on Saturday March 06, 2021 @12:34AM (#26365470)
It sounds like it, and it might be, but testing for weed really does impact recruiting. I know of a very large US firm that has quietly stopped including it in their drug test over the past 3-4 years in part because of that.

(I wouldn’t be surprised if folks start to push testing as a HIPAA issue.)

[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by Godel_unicode on Saturday March 06, 2021 @01:09AM (#26365569)
That's not how HIPAA works.
[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by jcims on Saturday March 06, 2021 @11:12AM (#26368359)
I'm no expert but it could place you in a situation where you are faced with divulging a legal* medical prescription as a condition of keeping your job.
[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by Godel_unicode on Saturday March 06, 2021 @01:06PM (#26369215)
That has nothing to do with HIPAA, your employer is in almost all cases not a covered entity. People frequently believe that they have a right not to have to disclose health information to their employer; this is true in certain cases but by and large is false. There are explicit provisions in HIPAA saying that requiring doctors notes is legal, for example.
[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by heroprotagonist on Monday March 08, 2021 @11:55AM (#26387990)
Also, intelligence agency requests are exempt from HIPAA. They can ask your provider for whatever they want, and your provider can give it to them with no penalty.

The few I asked seemed to feel they were _required_ to provide information if simply asked without a court order backing up the request. And they made it seem like I was the crazy one for asking that they agree to only provide my data if legally compelled. I ended up doing direct billing out of principle.

[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by jcims on Saturday March 06, 2021 @03:04PM (#26370094)
Good info! Thank you for clearing that up for me.
[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by djrogers on Saturday March 06, 2021 @10:17AM (#26367923)
It does if you can claim it’s medical use only. Or at least it reasonably could be interpreted that way.
[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by Godel_unicode on Saturday March 06, 2021 @01:02PM (#26369200)
HIPAA applies exclusively to covered entities. Your employer is, in most cases, not a covered entity. If you want evidence of this (assuming you're in the United States) go look at the information required by your employers FMLA disclosure form.

Hint, the I in HIPAA stands for insurance. If insurance isn't involved, HIPAA probably isn't either.

https://www.hhs.gov/hipaa/for-individuals/employers-health-i...

[ Parent | on HN ]
Re:30k U.S. organizations newly hacked via holes in Microsof... by Lukabuz on Saturday March 06, 2021 @03:15AM (#26365995)
https://www.wsj.com/articles/BL-LB-48089
[ Parent | on HN ]