Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Data accidentally exposed by Microsoft AI researchers

wiz.io

Post reply on HN
Print view View original

41–50 of 238 posts

Re: Data accidentally exposed by Microsoft AI researchers

#41

Post by eddythompson80 »

numbsafari wrote: post #21
munchler wrote: post #13

> This case is an example of the new risks organizations face when starting to leverage the power of AI more broadly, as more of their engineers now work with massive amounts of training data. It seems like a stretch to associate this risk with AI specifically. The era of "big data" started several years before the current AI boom.

This is the risk of using, checks notes, Azure and working with Microsoft. Except there is no risk for them. They've proven time and again they have major security snafus and not be held accountable.

Virtual networks are a nightmare to setup and manage in Azure which is why everyone just takes the easy path and not bother.

Almost every Azure service we deal with has virtual networks as an after thought because they want to get to market as quickly as possible, and even to them managing vnets is a nightmare.

Not to excuse developers/users though. There are plenty of unsecured S3 buckets, docker containers, and Github repos that expose too much "because it's easier". I've had a developer checkin their ftp creds into a repo the whole company has access to. He even broke the keys up and concat them in shell to work around the static checks "because it's easier" for their dev/test flow.

Re: Data accidentally exposed by Microsoft AI researchers

#42

Post by zuminator »

sillysaurusx wrote: post #35
aftbit wrote: post #23

Earlier quoted context omitted.

Not the OP but I have a pair of Chenbro NR12000 1U rack mount servers, bought for about $120 each on eBay a few years ago. Each has 12 internal 3.5" mounting points and 14 SATA cables. In one server, I have 12 4TB used enterprise drives. In the other, I have 12 8TB drives. Both have 16 GB of RAM (should probably be more) and two 2.5" SATA SSDs. They are configured with two ZFS raidz1 vdevs, each made up of 6 disks. T…

(Where are you finding friends with a NAS? Or at all, for that matter… guess I’ll look on eBay.) Thank you for the details, particularly about zfs, which I know nothing about. The “if I’m lucky” part piqued my interest. HN was recently taken down by a double disk failure, which is exponentially more likely when you buy drives in bulk - the default case. So being able to survive two failures simultaneously is somethin…

Interesting. It's been a while since I've used eBay, but man they've really upped their game if you can buy friends there now.

Re: Data accidentally exposed by Microsoft AI researchers

#43

Post by intrasight »

munchler wrote: post #13

> This case is an example of the new risks organizations face when starting to leverage the power of AI more broadly, as more of their engineers now work with massive amounts of training data. It seems like a stretch to associate this risk with AI specifically. The era of "big data" started several years before the current AI boom.

Agreed. It should say "new risks organizations face when starting to leverage the power of Azure" or "the power of cloud computing". But as clickbait worthy a title.

Re: Data accidentally exposed by Microsoft AI researchers

#44

Post by daggersandscars »

sillysaurusx wrote: post #12
buro9 wrote: post #5

Part of me thought "this is fine as very few could actually download 38TB". But that's not true as it's just so cheap to spin up a machine and some storage on a Cloud provider and deal with it later. It's also not true as I've got a 1Gbps internet connection and 112TB usable in my local NAS. All of a sudden (over a decade) all the numbers got big and massive data exfiltration just looks to be trivial. I mean, obvious…

How do you have your NAS configured? The more specifics, the better; I’ve wanted one. Do you worry about failure? In your hardware life I mean, not your personal life.

Not the original poster, but to add my experience:

Two-bay NAS, two drives as a mirrored pair, two SSDs as mirrored pair cache. Only makes data available on my home network. Primarily using Nextcloud and Gitea.

It backs up important files nightly to a USB-attached drive, less critical files weekly. I have a weekly backup to a cloud provider for critical files.

A sibling comment makes a good point: do you want a hobby or an appliance? Using a commercial NAS makes it closer to an appliance[0]. Building it yourself will likely require more fiddling.

If you want to run a different OS on a commercial NAS, dig deeper into the OS requirements before buying a the NAS. Asustor Lockerstor Gen 2 series' fan is not inherently supported by things other than Asustor's software.

[0] A commercial NAS will still require monitoring, maintenance, and validation of backups.

Re: Data accidentally exposed by Microsoft AI researchers

#45

Post by Phileosopher »

munchler wrote: post #13

> This case is an example of the new risks organizations face when starting to leverage the power of AI more broadly, as more of their engineers now work with massive amounts of training data. It seems like a stretch to associate this risk with AI specifically. The era of "big data" started several years before the current AI boom.

AI has magnified the use cases, though. Before, Big Data was an advertising machine meant to tokenize and market to every living being on the planet. Now, machine learning can create "averaged" behavior of just about anything, given enough data and specificity.

Re: Data accidentally exposed by Microsoft AI researchers

#46

Post by mymac »

sillysaurusx wrote: post #20

The article tries to play up the AI angle, but this was a pretty standard misconfiguration of a storage token. This kind of thing happens shockingly often, and it’s why frequent pentests are important.

Pentests where people actually get out of bed to do stuff (read code, read API docs etc) and then try to really hack your system are rare. Pentests where people go through the motions, send you report with a few unimportant bits highlit while patting you on the back for your exemplary security so you can check the box on whatever audit you're going through are common.

Re: Data accidentally exposed by Microsoft AI researchers

#49

Post by heywhatupboys »

LinuxBender wrote: post #18
tombert wrote: post #4

Earlier quoted context omitted.

My wife and I just rewatched WarGames for the millionth time a few nights ago. The level of cybersecurity incompetency in the early 80's makes sense; computers (and in particular networked computers) were still relatively new, and there weren't that many external users to begin with, so while the potential impact of a mistake was huge (which of course was the plot of the movie), the likelihood of a horrible thing hap…

That modem setup in Wargames is still a thing for many organizations including some banks and telcos. Not naming names but I suspect the modems will be around for a very long time. Some have a password on their modem but they are usually very simple. Their only saving grace is that they are usually in front of a mainframe speaking proprietary MML that only old fuddy duddies like me would remember. There are a few of…

what does this have to do with a "modem" per se?

Re: Data accidentally exposed by Microsoft AI researchers

#50

Post by omgJustTest »

munchler wrote: post #13

> This case is an example of the new risks organizations face when starting to leverage the power of AI more broadly, as more of their engineers now work with massive amounts of training data. It seems like a stretch to associate this risk with AI specifically. The era of "big data" started several years before the current AI boom.

This comment is a good bit of rationalization, and whichever the categorical mismatch you feel is happening, it misses the overarching point, the focus should be on the broader systemic issues: data security is not a first or second tier priority to "big data" or "AI"... largely because there's no cost to doing it poorly.
Post reply on HN