Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Worst cloud vulnerability you can imagine” discovered in Microsoft Azure

arstechnica.com

Post reply on HN
Print view View original

21–30 of 92 posts

Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure

#21

Post by inetknght »

arduinomancer wrote: post #19

Whenever stuff like this happens I see people saying there should be legal consequences for leaking data. By that logic should there be legal consequences for a company if someone breaks into their office and steals paper records?

> By that logic should there be legal consequences for a company if someone breaks into their office and steals paper records?

Comparing cloud storage and paper records is worse than comparing apples to oranges; it's comparing apples to celery. Sure they're both edible but they are vastly different organisms.

And yes, there can be legal consequences for a company if someone breaks into their office and steals paper records.

Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure

#22

Post by donmcronald »

$40k? Lol. I’m poor and I’d have to think twice about disclosing it for that. How many government lists does having the ability to discover that type of exploit get you on?

I bet Microsoft would claim damages of $1+ billion if someone used that type of exploit maliciously by damaging data and undermining customer confidence in Azure.

What a joke. This should pay $1+ million.

Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure

#23

Post by aranchelk »

arduinomancer wrote: post #19

Whenever stuff like this happens I see people saying there should be legal consequences for leaking data. By that logic should there be legal consequences for a company if someone breaks into their office and steals paper records?

It depends, in a regulated industry if you fail to do stuff like install a commercial firewall, keep facilities secured with proper door locks, etc. you may very well face fines or loss of a license to operate.

I think when people talk about consequences, they’re not regarding these companies as victims of crimes, rather as negligent actors.

Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure

#24

Post by cagenut »

donmcronald wrote: post #22

$40k? Lol. I’m poor and I’d have to think twice about disclosing it for that. How many government lists does having the ability to discover that type of exploit get you on? I bet Microsoft would claim damages of $1+ billion if someone used that type of exploit maliciously by damaging data and undermining customer confidence in Azure. What a joke. This should pay $1+ million.

The context you're missing here is the company/research-team that found this are ex-MS employees who started a company (Wiz.io) to help other companies secure their cloud hosting/environments. This is some of the most pure-gold viral content marketing they can dream of, they don't care about the $40k at all, its just to acknowledge this is non-trivial.

Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure

#25

Post by muststopmyths »

I'm curious if Microsoft is suffering from a massive loss of generational expertise. At least right after XP we had to go through a security standdown where all code was reviewed and audited throughout the company. Subsequent features and services had to go through a pretty thorough security review at design time as well.

Over the past few years the number of security fiascos has been increasing. Is the internal Security team (forget what the org was called) dead now ?

I'm sure lack of dedicated testing is also a major factor, but do launches no longer have to satisfy a security review ? Maybe in the name of agile development ?

Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure

#26

Post by vorpalhex »

arduinomancer wrote: post #19

Whenever stuff like this happens I see people saying there should be legal consequences for leaking data. By that logic should there be legal consequences for a company if someone breaks into their office and steals paper records?

If there is negligence involved, yes - an insecured building being broken into can absolutely have legal consequences.

That computers are involved should not remove negligence as a possibility to recover damages.

Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure

#27

Post by jereees »

inetknght wrote: post #21
arduinomancer wrote: post #19

Whenever stuff like this happens I see people saying there should be legal consequences for leaking data. By that logic should there be legal consequences for a company if someone breaks into their office and steals paper records?

> By that logic should there be legal consequences for a company if someone breaks into their office and steals paper records? Comparing cloud storage and paper records is worse than comparing apples to oranges; it's comparing apples to celery. Sure they're both edible but they are vastly different organisms. And yes, there can be legal consequences for a company if someone breaks into their office and steals paper r…

An analogy of an analogy. Could somebody go one level deeper?

Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure

#28

Post by bifrost »

sneak wrote: post #6

I think the worst vulnerability I can imagine is the USG having unfettered access to the entire db contents without a warrant, which is already the case with everything in Azure. This bug only seems to widen that vulnerability slightly, to those groups plus those with knowledge of this bug. Nothing in major US cloud providers can reasonably be expected to remain private, so I think this breathless headline is a littl…

Its the secret about "the cloud" that nobody wants to say.
Post reply on HN