“Worst cloud vulnerability you can imagine” discovered in Microsoft Azure
1–10 of 92 posts
Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure
#2I always wonder if these types of vulnerabilities affect the most secret DoD contracts, or if those accounts are somehow sharded onto sufficiently separate systems/networks?
Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure
#3I always wonder if these types of vulnerabilities affect the most secret DoD contracts, or if those accounts are somehow sharded onto sufficiently separate systems/networks?
DoD only has idiotic requirements like there has to be a fence around their private racks, not useful requirements like the global database isn’t open to the world.
Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure
#4I always wonder if these types of vulnerabilities affect the most secret DoD contracts, or if those accounts are somehow sharded onto sufficiently separate systems/networks?
I'd guess that the azure us gov cloud defaults to stuff not being open to the web, so if you spin up an azure function this is only available internally, but this is a guess
Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure
#5I always wonder if these types of vulnerabilities affect the most secret DoD contracts, or if those accounts are somehow sharded onto sufficiently separate systems/networks?
DoD only has idiotic requirements like there has to be a fence around their private racks, not useful requirements like the global database isn’t open to the world.
[deleted]
Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure
#6I think the worst vulnerability I can imagine is the USG having unfettered access to the entire db contents without a warrant, which is already the case with everything in Azure.
This bug only seems to widen that vulnerability slightly, to those groups plus those with knowledge of this bug.
Nothing in major US cloud providers can reasonably be expected to remain private, so I think this breathless headline is a little overblown.
Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure
#7I think the worst vulnerability I can imagine is the USG having unfettered access to the entire db contents without a warrant, which is already the case with everything in Azure. This bug only seems to widen that vulnerability slightly, to those groups plus those with knowledge of this bug. Nothing in major US cloud providers can reasonably be expected to remain private, so I think this breathless headline is a littl…
So this vulnerability is worse than the worst you could imagine
Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure
#8I always wonder if these types of vulnerabilities affect the most secret DoD contracts, or if those accounts are somehow sharded onto sufficiently separate systems/networks?
DoD only has idiotic requirements like there has to be a fence around their private racks, not useful requirements like the global database isn’t open to the world.
Azure runs their Gov and China clouds as separate infrastructures with separate capabilities.
Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure
#9I think the worst vulnerability I can imagine is the USG having unfettered access to the entire db contents without a warrant, which is already the case with everything in Azure. This bug only seems to widen that vulnerability slightly, to those groups plus those with knowledge of this bug. Nothing in major US cloud providers can reasonably be expected to remain private, so I think this breathless headline is a littl…
>the worst vulnerability I can imagine is the USG having unfettered access
You cannot imagine any other party it would be worse to be vulnerable to?
Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure
#10It's bothersome that they keep saying 'primary key' in regards to what seems to be an 'access key' relating to a database.
Disappointing to see that it's arstechnica.