Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Data accidentally exposed by Microsoft AI researchers

wiz.io

Post reply on HN
Print view View original

221–230 of 238 posts

Re: Data accidentally exposed by Microsoft AI researchers

#221

Post by amlozano »

evntdrvn wrote: post #172
mymac wrote: post #46

Earlier quoted context omitted.

Pentests where people actually get out of bed to do stuff (read code, read API docs etc) and then try to really hack your system are rare. Pentests where people go through the motions, send you report with a few unimportant bits highlit while patting you on the back for your exemplary security so you can check the box on whatever audit you're going through are common.

what I always want to know when people talk about this is "what reputable companies can I actually pay to do a real pentest (without costing hundreds of thousands of dollars)."

The problem is security is a "Market for lemons" https://en.wikipedia.org/wiki/The_Market_for_Lemons. Just like when trying to buy a used car, you need someone who is basically an expert in selling used cars.

In order to purchase a reputable pentest, you basically have to have a security team that is mature enough to have just done it themselves.

I can throw out some names for some reputable firms, but you are still going to need to do some leg work vetting the people they will staff your project with, and who knows if those firms will be any good next year or the year after.

Here's a couple generic tips from an old pentester:

* Do not try and schedule your pentest in Q4, everyone is too busy. Go for late Q1 or Q2. Also say you are willing to wait for the best fit testers to be available.

* Ask to review resumes of the testing team. They should have some experience with your tech and at least one of them needs to have at least 2 years experience pen-testing.

* Make sure your testing environment is set up, as production like as possible, and has data in it already. Test the external access. Test all the credentials, once after you generated them, again the night before the test starts. The most common reason to lose your good pentest team and get some juniors swapped in that have no idea what they are doing is you delayed the project by not being ready day 1.

Re: Data accidentally exposed by Microsoft AI researchers

#222

Post by throwaway2037 »

Faelian2 wrote: post #136
j245 wrote: post #75

Earlier quoted context omitted.

From my understanding as a non security expert: Pentest comes across more as checking all the common attack vectors don’t exist. Getting out of bed to do the so-called “real stuff” is typically called a bug bounty program or security researching. Both exist and I don’t see why most companies couldn’t start a bug bounty program if they really cared a lot about the “real stuff”

I work as pentester (as a freelance nowdays). Getting out of bed and "real stuff" is supposed to be part of a pentest. The problem is more the sheer amout of stuff your are supposed to know to be a pentester. Most pentesters come into the field by knowing a bit of XSS, a few thing about PHP, and SQL injections. Then you start to work, and the clients need you to tests things like: - compromise a full Windows Network,…

Thanks for your honest reply. This part was my favourite:

    Nobody knows everything. Being a pentester is a journey.
I recommend that you add some contact details in your HN bio page. You might get some good ledes after those post.

Re: Data accidentally exposed by Microsoft AI researchers

#223

Post by c0pium »

j245 wrote: post #75
mymac wrote: post #46

Earlier quoted context omitted.

Pentests where people actually get out of bed to do stuff (read code, read API docs etc) and then try to really hack your system are rare. Pentests where people go through the motions, send you report with a few unimportant bits highlit while patting you on the back for your exemplary security so you can check the box on whatever audit you're going through are common.

From my understanding as a non security expert: Pentest comes across more as checking all the common attack vectors don’t exist. Getting out of bed to do the so-called “real stuff” is typically called a bug bounty program or security researching. Both exist and I don’t see why most companies couldn’t start a bug bounty program if they really cared a lot about the “real stuff”

Bug bounty programs are a nightmare to run. For every real bug reported you’ll get thousands of nikto pdfs with CRITICAL in big red scare letters all over them. Then you’ll get dragged on twitter constantly for not being serious about security. Narrowing the field to vetted experts will similarly get you roasted for either having something to hide or not caring about inclusion. And god help you if you have to explain that you already knew about a bug reported by anyone with more than 30 followers…

There are as many taxonomies of security services as there are companies selling them. You have to be very specific about what you want and then read the contract carefully.

Re: Data accidentally exposed by Microsoft AI researchers

#225

Post by evertedsphere »

rowanG077 wrote: post #153
evertedsphere wrote: post #111

Earlier quoted context omitted.

types have nothing to do with this, strictly speaking; the same problems would exist if you serialised structures containing functions in a typed language to e.g. a dll or a .class file and asked users to load it at runtime the problem is in fact the far more subtle principle of "don't download and run random code, and definitely don't make it the idiomatic way to do things," and i'm not sure you can blame your use o…

The difference is that no one shares data in a statically typed language by sending over dlls or .class files. The entire point is that something so dangerous has been normalized because of dynamic typing.

poor engineering choices are just that, choices

Re: Data accidentally exposed by Microsoft AI researchers

#226

Post by rowanG077 »

evertedsphere wrote: post #225
rowanG077 wrote: post #153

Earlier quoted context omitted.

The difference is that no one shares data in a statically typed language by sending over dlls or .class files. The entire point is that something so dangerous has been normalized because of dynamic typing.

poor engineering choices are just that, choices

Some tools make poor choices harder or impossible. That's the entire point of static typing too. In this case python encouraged insecure design choices by making them very easy and even presenting them to users.

Re: Data accidentally exposed by Microsoft AI researchers

#227

Post by permo-w »

mlyle wrote: post #53
permo-w wrote: post #31

Earlier quoted context omitted.

with a 1Gbps connection you're still looking at ~248 hours to download, and that's if the remote server can keep up, which it almost certainly can't this is assuming by 1Gbps you mean 1 Gigabit/s rather than 1 Gigabyte/s

Not sure where 248 hours came from. 38 terabytes = 304 terabits. 304 terabits / 1 gigabit/second = 304,000 seconds 304,000 seconds =~ 84 hours. Add 20% for not pegging the line the whole time and the limits of 1gbps ethernet, and perhaps 100 hours is reasonable.

my mistake, I swapped the 38tb and 112tb from parent comment

whatever the download size is, you're bottlenecked by the remote server's up speed

Re: Data accidentally exposed by Microsoft AI researchers

#228

Post by eitland »

LeifCarrotson wrote: post #17
photoGrant wrote: post #3

Earlier quoted context omitted.

Hard coded secrets in shareable URL’s with almost infinite time windows and an untraceable ability to audit what’s made and shared and at what level? Sounds like it’s as hard as it’s always been. Pretty basic and filled with humans

I feel like it's harder. It's no longer hierarchical, with organization schemes limited to folders and files. People no longer talk about network paths, or server names. Mobile and desktop apps alike go to enormous effort to abstract and hide the location at which a document gets stored, instead everything is tagged and shared across buckets and accounts and domains... I expect that the people at this organization wo…

> but unless I missed the sarcasm, they may be wrong when they say [1] "Generating an Account SAS is a simple process." That looks like a really complicated process!

No, unless I understand actually it is intended to be understood the other way:

It is too easy to create a to broad token.

And in the next paragraph, after the image, they explain that in addition to it being easy to create, these tokens are impossible to audit.

Re: Data accidentally exposed by Microsoft AI researchers

#229

Post by mlyle »

permo-w wrote: post #227
mlyle wrote: post #53

Earlier quoted context omitted.

Not sure where 248 hours came from. 38 terabytes = 304 terabits. 304 terabits / 1 gigabit/second = 304,000 seconds 304,000 seconds =~ 84 hours. Add 20% for not pegging the line the whole time and the limits of 1gbps ethernet, and perhaps 100 hours is reasonable.

my mistake, I swapped the 38tb and 112tb from parent comment whatever the download size is, you're bottlenecked by the remote server's up speed

If the "remote server" is Azure, the target throughput is 0.5gbps ... for each large blob (of which this leak includes many). It seems pretty likely you'll be able to download at a few gigabits per second if your local connectivity allows.

Re: Data accidentally exposed by Microsoft AI researchers

#230

Post by BlueTemplar »

failuser wrote: post #215
BlueTemplar wrote: post #208

Earlier quoted context omitted.

So, a little bit like a lot of people think that (non-checksummed/non-encrypted) PDFs cannot be modified, even though they are easily editable with Libre freaking Office ?

You can’t edit them in Word, so that must be too advanced for most people. LibreOffice never opened the PDFs too well for me, but Inkspace was pretty good, one page at a time though.

Doesn't Microsoft Office have the equivalent to Libre Office Draw ?? (That's the one that edits PDFs.)

I'm pretty sure I used that one in middle school ?? (Though not to edit PDFs, and it might have been the Microsoft Works equivalent.)

Post reply on HN