Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Data accidentally exposed by Microsoft AI researchers

wiz.io

Post reply on HN
Print view View original

201–210 of 238 posts

Re: Data accidentally exposed by Microsoft AI researchers

#201

Post by lijok »

prmoustache wrote: post #130
quickthrower2 wrote: post #67

Two of the things that make me cringe are mentioned. Pickle files and SAS tokens. I get nervous dealing with Azure storage. Use RBAC. They should depreciate SAS and account keys IMO. SOC2 type auditing should have been done here so I am surprised of the reach. Having the SAS with no expiry and then the deep level of access it gave including machine backups with their own tokens. A lot of lack of defence in depth goin…

Many SOC2 audits are a joke. We were audited this year and were asked to provide screenshots of various categories (but most being of our own choosing in the end). Only requirement was screenshots needed to show date of the computer on which the screenshot had been taken, as if it couldn't be forged as well as the file/exif data.

If you forge your SOC2 evidence you will legitimately wish you were never born once caught

Re: Data accidentally exposed by Microsoft AI researchers

#203

Post by SoftTalker »

sillysaurusx wrote: post #102
hedora wrote: post #82

Earlier quoted context omitted.

Occasionally, I’ll talk to someone suggesting a dynamically typed language (or stringly-typed java) for a very large scale (in developer count) security or mission critical application. This incident is a good one to point back to.

laughs in log4j vuln A good fraction of the flaws we found at Matasano involved pentests against statically typed languages. If an adversary has root access to your storage box, they can likely find ways to pivot their access. Netpens were designed to do that, and those were the most fun; they’d parachute us into a random network, give us non-root creds, and say “try to find as many other servers that you can get to.…

Am I one of few people who is frightened by shell history files? I always disable mine because it just seems like a roadmap to interesting stuff for anyone who might gain access to it. Including even stuff like sudo passwords typed at the wrong time or into the wrong window.

Re: Data accidentally exposed by Microsoft AI researchers

#204

Post by NikolaNovak »

sillysaurusx wrote: post #200
NikolaNovak wrote: post #26

Earlier quoted context omitted.

Not the OP, but after a lot of messing with software software and OS RAID, Raid Cards and mother boards, dedicated loud Dell servers, UnRAID, this that and the other thing over years and decades, I just set up a big Synology device 5 years ago. Since then, I've had a NAS that just worked. I have data, it's there. I do online backup to a cloud provider, and a monthly dump to external USB drives that I keep and rotate…

Which model Synology do you have? (Would you still make the same choice today?) Did you settle on using RAID, or just rely on cloud backups?

I have the DS918+

I would not make the same choices today: I got a somewhat high end one and upgraded it to whopping 32GB of RAM, thinking I'd use it for running lightweight containers or VMs, and maybe a media server. But once I put all my data on it... including 20 years of family photos and tax prep documents and work stuff and everything else... I changed my mind and am using it only and solely as an internal storage unit. Basically, as mentioned, committed to the "NAS" as opposed to "Fun Project" path :-). So I could've saved myself some money by getting a simpler unit and not upgrading it. (the DS918+ also can hook up to a cage [DX517], but I ended up not needing that either, yet).

I have it with 4 WD Red Plus NAS 8TTB drives and RAID 10 currently. I've used RAID 5 in the past but decided against it for this usage - again, went for simplicity.

Just shy of 30,000 hours on the drives, daily usage (I basically don't use local drive for any data on any of my computers; I keep it all on NAS and this way I can use any of my computers to do/access the same thing), and really no issues whatsoever so far.

Re: Data accidentally exposed by Microsoft AI researchers

#205

Post by bornfreddy »

monkpit wrote: post #154
monkpit wrote: post #22

Earlier quoted context omitted.

I strongly support the “no hello” concept but I also fear being seen as “that guy” so I never mention it. Sigh

I should have a slack bot that replies automatically to generic greetings… that way they’ll get on with whatever the issue is and I won’t have to reply.

Ha ha, that's a great idea!

A: Hello!

B's bot: Hello to you too! I am a chatty bot which loves responding to greetings. Is there a message I can forward to B?

Re: Data accidentally exposed by Microsoft AI researchers

#206

Post by alaxapta7 »

pixl97 wrote: post #185
alaxapta7 wrote: post #181

Earlier quoted context omitted.

I've seen worse. Couple years back, there was an audit that included an internal system I've been working on. It was running on Debian oldstable because of a vital proprietary library I wasn't able to get working on stable at the time, but it had unattended upgrades set up and all that. The company made some basic port scan and established that we're running outdated and vulnerable version of Apache. I found the act…

This is why I always attempt to turn off as much version information output as possible from any service. Make the pentester do their homework and not just look at "Apache 2.XX" Hopefully you also have an internal control that looks at actual package versions installed on the server.

Normally I do that too, but this was fairly new and internal application that was still in development, so that's why it was there. And if it wasn't for this incident, they might actually trick our management into thinking they're somehow qualified to carry out such an audit.

Re: Data accidentally exposed by Microsoft AI researchers

#208

Post by BlueTemplar »

saurik wrote: post #38

A number of replies here are noting (correctly) how this doesn't have much to do with AI (despite some sentences in this article kind of implicating it; the title doesn't really, fwiw) and is more of an issue with cloud providers, confusing ways in which security tokens apply to data being shared publicly, and dealing with big data downloads (which isn't terribly new)... ...but one notable way in which it does implic…

So, a little bit like a lot of people think that (non-checksummed/non-encrypted) PDFs cannot be modified, even though they are easily editable with Libre freaking Office ?

Re: Data accidentally exposed by Microsoft AI researchers

#209

Post by prmoustache »

lijok wrote: post #201
prmoustache wrote: post #130

Earlier quoted context omitted.

Many SOC2 audits are a joke. We were audited this year and were asked to provide screenshots of various categories (but most being of our own choosing in the end). Only requirement was screenshots needed to show date of the computer on which the screenshot had been taken, as if it couldn't be forged as well as the file/exif data.

If you forge your SOC2 evidence you will legitimately wish you were never born once caught

We aren't doing that. I just mention the lazyness of the auditors and that asking for screenshots is just dumb. At this point you can just ask a simply question: do you comply or not?

Re: Data accidentally exposed by Microsoft AI researchers

#210

Post by benreesman »

short_sells_poo wrote: post #165
benreesman wrote: post #133

Earlier quoted context omitted.

I’ll venture that it’s at least adjacent that the indiscriminate assembly of massive, serious pluralities of the commons on a purely unilateral basis for profit is sort of a “just try and stop us” posture that whether or not directly related here, and clearly with some precedent, is looking to create a lot of this sort of thing over and above the status-quo ick.

I have no idea what you are saying. If it is: "bad incentives cause people to misbehave", you generated an impressive verbiage around it :)

I have a bad habit of using 5 words when 1 will do: but I was saying that the probably fucking illegal status quo on AI corpus assembly is making an already ugly world a lot fucking worse.
Post reply on HN