The Register Home Page

back to article Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack

Microsoft has warned users of SharePoint Server that three on-prem versions of the product include a zero-day flaw that is under attack – and that its own failure to completely fix past problems is the cause. In a July 19 security note, the software giant admitted it is “… aware of active attacks targeting on-premises …

  1. DS999 Silver badge

    Guy I know

    Had a neighbor install a Ring camera - directly across the street and the house is up on a hill so it is basically aimed directly at his older daughter's bedroom upstairs! He set up a laser (I assume IR so it isn't something visible, I didn't ask) aimed precisely at its camera pinhole. Saw the neighbor messing with it so he turned off the laser then turned it back on the next day. Didn't see the neighbor out there anymore, he figures the guy probably assumes its camera is broken but still works as a doorbell.

    I don't think what he did should even be illegal. If it is your right to point a camera directly at my house, it should be my right to point a laser at yours. If Ring cameras had shallow depth of field so they'd only focus on, you know, people at your door I don't think people would have an objection to it. But it is a pretty deep and wide field and unnecessarily high resolution for a "doorbell" camera, so it is providing far better surveillance of the house/houses across the street than your own house. I get that you should have the right to surveil your own property but you shouldn't have the right to surveil mine - and/or I should have the right to prevent that surveillance without going so far as to have a 15' fence in front of my house (not that most cities would allow that anyway)

    1. Pascal Monett Silver badge

      Re: Guy I know

      In France it is forbidden to record images from your property to the sidewalk or street.

      You can install a camera that watches your front door on your own property, but if it proven that you can also record people walking their dog on the sidewalk, you're in trouble.

      1. DS999 Silver badge

        Re: Guy I know

        Once again Europe shows us idiot Americans how sensible privacy laws would work if we had any.

    2. Andrew Scott

      Re: Guy I know

      probably peeping tom laws would cover something like that. on the other hand, there might not be much of a difference between a ring camera and sitting on your front porch watching the neighbors go by or sitting in you living room and seeing the neighbor get their internet upgraded or amazon making a delivery.

    3. Anonymous Coward
      Anonymous Coward

      Re: Guy I know

      Even the cheapest tat CCTV from wowcher* has a function to limit recording to specified areas. And it has the bonus of working without a cloud# service.

      However, like the current craze of thinking of the children so now you need to give driving licence/passport to twatter to look at cat pictures, you still need a responsible adult to actual give enough of a shit to configure the thing correctly.

      * yes, i know it feeds the beast that is associated newspapers

      # allegedly. Your putting a lot of trust on cheapest internet tat if you plug it into your LAN.

      PROTIP: An infrared floodlight wll happily blind most cctv cameras.

  2. Tim99 Silver badge
    Windows

    Sharepoint

    Why do people use it? A genuine question.

    I'm retired but work as a volunteer, assessing about a dozen organizations a year. Part of the assessment is checking documentation, some of which goes back over several years. Whenever I see SharePoint, staff often have trouble finding a random document that I ask for. The people who seem to be able to find stuff quickly apparently remember where it's stored - Others not so good. Add to that systems being served from a remote location (not in the same building, city, or State) it can take minutes to retrieve stuff. Is it just badly configured, staff not adequately trained, or the normal Microsoft cruft?

    1. Yorick Hunt Silver badge

      Re: Sharepoint

      "Is it just badly configured, staff not adequately trained, or the normal Microsoft cruft?"

      Once upon a time, Microsoft found a piece of string and discovered that if they added some sticky tape to it, they could sell it for a profit.

      Since then, tonnes of sticky tape and even more string have been added to the "product," to the point where not even their most experienced programmers (which these days means they've worked at Microsoft for all of three months) can figure out what the "product" does.

      So of course, they just keep piling more on, to preserve the perceived value they've brainwashed their customers into believing.

    2. A Non e-mouse Silver badge

      Re: Sharepoint

      Why use SharePoint?

      It's usually used when you want to do something more than upload and serve documents. E.g. You might want some kind of workflow as a user uploads a document. (e.g. seek approval, update a database, etc) Usually used inside a corporate. SharePoint also has full version control and Word/Excel/PowerPoint integrate into it that really well.

      Why's it hard to find stuff? That's down to how the pesky humans have arranged the documents in the site.

      1. Joe W Silver badge

        Re: Sharepoint

        "Why's it hard to find stuff? That's down to how the pesky humans have arranged the documents in the site. "

        That. Do not use folders as much as you think you should. Make heavy use of categories. Define views and libraries.

        Once I started doing this, life improved. A lot.

        Companies don't want to train their users....

        1. A Non e-mouse Silver badge
          Unhappy

          Re: Sharepoint

          Companies don't want to train their users

          Plus users who don't want to learn new stuff.

        2. Charlie Clark Silver badge

          Re: Sharepoint

          I think you provide good reasons why this will never really work: taxonomies are notoriously difficult to agree upon in the first place and ever harder to keep to…

          From my experience, SharePoint is the crowning and steaming turd on the top of Microsoft's shitty software stack: it's awful for administrators and users alike.

          I think of Google's most fundament insights was to avoid categories when developing its search engine.

      2. Dan 55 Silver badge

        Re: Sharepoint

        Why's it hard to find stuff? That's down to how the pesky humans have arranged the documents in the site.

        Also possibly a broken search only surpassed in uselessness by Teams' broken search might have something to do with it.

    3. OhForF'
      Windows

      Re: Sharepoint

      >Is it just badly configured, staff not adequately trained, or the normal Microsoft cruft?<

      I'm amazed nobody has given the obvious answer yet: all of the above.

    4. Anonymous Coward
      Anonymous Coward

      Re: Sharepoint

      Because many IT workers are clueless drones and blindly choose Microsoft over other stuff which is often much better and more secure.

      But no one ever got fired for choosing Microsoft, eh?

  3. Pascal Monett Silver badge
    Facepalm

    Don't worry, Microsoft

    Nobody has ever dropped your shitty products because of bugs or security issues.

    Carry on !

  4. mikus

    It's insanity running an actual public microsoft service at all any more, it just should NOT be done. Sharepoint is up there with Exchange on the "just don't do it anymore" list, and if you really must, get 365 services and at least you can't be blamed for not patching it.

    1. Dan 55 Silver badge
    2. Anonymous Coward
      Anonymous Coward

      What I wonder is whether the patch-pocalypse will stem from AI finding bugs or more from the effects of AI fixing bugs.

  5. fg_swe Silver badge

    Replace by SSH+SCP, Apache, HTML,Intranet Search Engine

    Rock solid, quite secure, straightforward to administer.

    Also, get in touch with your local LUG to hire a competent admin.

    Train you users to write HTML, it is a really useful skill.

  6. Tim13

    Sad state of Microsoft

    A vulnerablity is discovered - reported - and fixed by MS. After the patch is released, the CVE is updated, describing the vuln.

    But wait - as happened with other CVEs before - the hackers now exploit the "not complety effective patch" !

    We congratulate the users who still stick with MS - no matter what.

    /s

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like