I am the only one who thinks these bounties are ridiculously low? They should at least add a couple of zeroes to that one. Just wow.
If you add two zeroes you run the risk of rogue employees planting vulns themselves.
“Worst cloud vulnerability you can imagine” discovered in Microsoft Azure
81–90 of 92 posts
Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure
#82Earlier quoted context omitted.
I don't see the phrase "private key" in this article. The only mention of the word "private" is in a mention of how the problem was reported to Microsoft. I don't believe private keys were in use here, instead I expect these are secrets and the thing about secrets is, as Bono sang, "A secret is something you tell one other person" which means now there's another party that can lose it. This is a reason to avoid using…
From the article: > A privilege escalation vulnerability allowed anyone with a Cosmos DB account to filch the private key for any other Cosmos DB account, by way of the Jupyter notebook functionality. Could we not be served the same article?
Aha, it's the blurb for an image in the carousel for the article and not in the body text.
So the good news is you aren't seeing things, that is what the Ars article said. The bad news is that Ars are wrong and these are clearly not private keys but shared secrets.
Other people have linked Microsoft's documentation, the control panel for Cosmos DB lets you ask for new keys and warns you they may take minutes to be ready, so that means it's a shared secret, as a private key would be something you pick and don't reveal to Microsoft.
Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure
#83Earlier quoted context omitted.
From the article: > A privilege escalation vulnerability allowed anyone with a Cosmos DB account to filch the private key for any other Cosmos DB account, by way of the Jupyter notebook functionality. Could we not be served the same article?
Aha, it's the blurb for an image in the carousel for the article and not in the body text. So the good news is you aren't seeing things, that is what the Ars article said. The bad news is that Ars are wrong and these are clearly not private keys but shared secrets. Other people have linked Microsoft's documentation, the control panel for Cosmos DB lets you ask for new keys and warns you they may take minutes to be re…
> it's the blurb for an image in the carousel for the article and not in the body text.
Indeed. Under FF reader mode the carousel is flattened into normal inline illustrations so I thought for a moment they could A/B test the article content.
Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure
#84I remember how one of the local Azure advocates blogged how there are two specialised security teams in Azure:
1. constantly improving security by patching products
2. acting like hacker(s) are already in the system and looking for them
I believe a 3rd group should be founded - our programmers did something stupid, looking for that.
Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure
#85Earlier quoted context omitted.
Mid-range engineer at big tech makes $350k / year. I think having a vulnerability like this go to Microsoft instead of criminals is easily worth a few engineer-years. A $1M payout is just not unreasonable or even difficult for a $2.5T corporation.
My point isn't that $40K is enough or $1M is too much, it's that pinning public payouts to the grey/black market is unsustainable. This bug could easily be worth $10M in the right hands, so why stop at 7 figures?
Well, my experience is that grey/black markets and crime pop up virtually everywhere where people can't afford to make an honest living which covers food and housing.
Once you reach a certain bar, people do the right thing.
$40k isn't enough to cover the cost of research+reporting at livable salaries, let along overhead, fake starts, etc.
1) Microsoft could afford $10M
2) I think people would be honest well short of $10M
3) The cost to customers, if this went public, would be far more than $10M.
You want people to be able to make an honest living on security research, or otherwise, the only people looking for vulnerabilities, aside from the independently wealthy hobbyists, will be crooks.
Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure
#86I always wonder if these types of vulnerabilities affect the most secret DoD contracts, or if those accounts are somehow sharded onto sufficiently separate systems/networks?
Nope. Look here ( https://docs.microsoft.com/en-us/azure/azure-government/comp... ) and search for Cosmos and you'll see this service is only approved for DoD Impact Level II systems. That is the lowest impact level the DoD offers and includes only systems exposed to the public, like the websites for recruiting and career descriptions. Any system handling controlled unclassified information or PII would not have been…
> My wife once saw some AT&T contractors digging too close to the wrong fiber line at her facility when she was working for the Navy at a contractor site and unmarked black SUVs were there to take those guys away to God knows where within two minutes.
I used to do design/permitting for fiber networks and going around DOD areas/Fiber was always fun. You wind up having to submit your routes, and get vague feedback as to what you need to move, but never how far away/etc. Usually your best bet is to just go to the other side of the road if possible.
Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure
#87I'm curious if Microsoft is suffering from a massive loss of generational expertise. At least right after XP we had to go through a security standdown where all code was reviewed and audited throughout the company. Subsequent features and services had to go through a pretty thorough security review at design time as well. Over the past few years the number of security fiascos has been increasing. Is the internal Secu…
Is it possible that there's also just more software in different domains being written, hence making it more difficult to keep track of everything that is going on?
Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure
#88I'm curious if Microsoft is suffering from a massive loss of generational expertise. At least right after XP we had to go through a security standdown where all code was reviewed and audited throughout the company. Subsequent features and services had to go through a pretty thorough security review at design time as well. Over the past few years the number of security fiascos has been increasing. Is the internal Secu…
After reading into details, this sounds like a fundamental design flow that was made easily exploitable via a new feature
Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure
#89I'm curious if Microsoft is suffering from a massive loss of generational expertise. At least right after XP we had to go through a security standdown where all code was reviewed and audited throughout the company. Subsequent features and services had to go through a pretty thorough security review at design time as well. Over the past few years the number of security fiascos has been increasing. Is the internal Secu…
Is it possible that there's also just more software in different domains being written, hence making it more difficult to keep track of everything that is going on?
Shouldn't be. If I recall correctly, the process was fairly logical. One of the things you wrote down in your design doc was all the external surfaces (endpoints) your application/service had and how you were securing them.
You could literally not ship anything without this review, so they must have abandoned the process by now. Or just never extended it to "the cloud"
Re: “Worst cloud vulnerability you can imagine” discovered in Microsoft Azure
#90Earlier quoted context omitted.
You think Microsoft can't pay $10 million? Paying $40k means they don't give a shit about their customers.
1. Work at Microsoft. Make a bug. 2. Tell your "security researcher" buddy. 3. Split $10m in zcash.
Since you are already being a criminal, you could go all the way and sell it to a security agency, Zerodium or another criminal.
The company you work for, once they track the code back to you, will investigate you to make sure you did not make profit on it.