2023-09-19
Why did this happen? 🧐 Account SAS tokens are created offline, with no limit on their expiry or scope. They aren't managed within the Azure portal, and they're also difficult to revoke. These features help easy content sharing, but they can also serve as dangerous pitfalls.
TechCrunch
Researchers find a GitHub repo run by Microsoft's AI research unit that exposed 38TB of sensitive data, like secret keys and 30K+ Microsoft staff Teams messages
Microsoft AI researchers accidentally exposed tens of terabytes of sensitive data, including private keys and passwords …
How can you avoid this? 🚨 Avoid using Account SAS for external sharing. Azure offers more secure alternatives, such as Service SAS with Stored Access Policy (for long-term sharing), or User Delegation SAS (for short-lived access).
TechCrunch
Researchers find a GitHub repo run by Microsoft's AI research unit that exposed 38TB of sensitive data, like secret keys and 30K+ Microsoft staff Teams messages
Microsoft AI researchers accidentally exposed tens of terabytes of sensitive data, including private keys and passwords …
Microsoft's AI research team published open-source training data using “SAS tokens” - sharable links granting access to Azure Storage data. Only instead of limiting access to specific files, the token granted access to the ENTIRE account, including *18* storage containers 🤯 [image]
TechCrunch
Researchers find a GitHub repo run by Microsoft's AI research unit that exposed 38TB of sensitive data, like secret keys and 30K+ Microsoft staff Teams messages
Microsoft AI researchers accidentally exposed tens of terabytes of sensitive data, including private keys and passwords …
Within these containers, our @wiz_io secret scan found: *️⃣ Personal passwords for Microsoft services 🔑 Private keys 📄 Private source code and AI training data 💬 Over 30k internal @MicrosoftTeams messages [image]
TechCrunch
Researchers find a GitHub repo run by Microsoft's AI research unit that exposed 38TB of sensitive data, like secret keys and 30K+ Microsoft staff Teams messages
Microsoft AI researchers accidentally exposed tens of terabytes of sensitive data, including private keys and passwords …
2023-03-31
I hacked into a @Bing CMS that allowed me to alter search results and take over millions of @Office365 accounts. How did I do it? Well, it all started with a simple click in @Azure... 👀 This is the story of #BingBang 🧵⬇️ https://twitter.com/...
The Verge
Microsoft fixed an Azure vulnerability after researchers found that the flaw could have let anyone alter Bing search results and access users' Office 365 data
Jess Weatherbed / The Verge :