15 ms·

250M Microsoft customer service and support records exposed on the web

405 points by el_duderino 7y ago

drallison 7y ago
Wow! So the person on the telephone who tells me in a soft Indian accent that my computer has a problem can now can authenticate themselves with authority, making it easier for them to get me (or my proxy) to enable remote administration so they can do real damage. Security is difficult. Microsoft is supposed to be skilled at preventing data breeches and exploits, but apparently not. What can be done to prevent this sort of thing?
- misterhtmlcss 7y ago
  Nothing can be done. It's a wildly asymmetrical relationship that means 9 billion people get a try to knock you out and your team of what??? 25, 50, 100, 1000? Security specialists have to see everything possible and plan for any and all possibilities. It's never going to happen. This is the simple reality of the internet and I'm sure you know this, but I saw your comment and thought I'd add this for the next person who may not realize this. I'm personally curious to know, because I'm no SecOps; if there is even a theoretical solution to the internet that would have greater integrity for the users or if this is as good as it gets.
  - rhizome 7y ago
    >Nothing can be done. Please don't do this. Something can be done, we all know it, but for some reason don't think it's possible? Prison sentences should have started with the Target CTO in 2013 (at the very latest), but the more the public is cowed by shrug emojis, the less likely companies will protect your data for anything other than commercial advantage.
    - deleted 7y ago
      [deleted]
    - jjeaff 7y ago
      Imprisoning CTOs for incompetence would be unprecedented. We don't imprison people for that reason and I can't imagine any knowledgeable CTO ever taking that position again once that precedent was set. But we do need much more oversight and serious punishment for companies that lose data like this.
      - 616c 7y ago
        Security engineer here. Why? US soldiers fight in combat knowing failure to obey orders can land them in jail for years. The US Code of Military Justice is not fun, and you sign up for it when you join implicitly. Is there an armed service staffing problem? Our general US legal system is flawed, but cops can go to jail for ethical violations and criminal behavior for actions that are integral parts of their job function. Is there a cop staffing shortage? I have argued this, ironically, about US Congresspeople: if we have a volunteer army with stringent legal codes with special punishment by virtue of their job, serving us, why are other classes of people not worthy of higher standards and why do we suspect people will shy away from that? How can we pay others more for higher probability of incompetence and less repercussions? I am not trolling. When I suggested this shows the power of commitment in volunteer armies and I wish Congress had that kind of self respect people tell me I'm nuts. I would like a CTO and security industry jobs to mean something.
        jjeaff 7y ago
        A CTO can go to jail for unethical and illegal behavior. But you are suggesting they be jailed for incompetence. And considering the fact that no amount of competence will protect you from a sufficiently motivated and resourceful hacker, seems unfair. Now if we come up with a framework and a security checklist that must be followed and certified by the CTO every quarter or something, and they don't do it, or lie, then sure, jail them.
      - rhizome 7y ago
        Everything was "unprecedented" at some point before they existed. It's only a matter of choice and priorities.
    - paulddraper 7y ago
      There has to be a felony for someone to go to prison.
      - rhizome 7y ago
        Yes, legislation is the first step. They made it illegal to access certain data with the CFAA, there's no reason illegally accessing data of a person can't be legislated too. Well, except for "businesses should be allowed to do anything they want."
    - badsectoracula 7y ago
      I have another proposal: let's stop connecting every computer together for the sake of connecting them together. Unless there is real functionality provided by said connection that doesn't exist just to excuse the connection, computers should do all their work locally. We rely way too much on Other People's Computers to do stuff. The only real way to avoid issues is to make them technically impossible, not to rely on laws (that can be abused). (yes, i know i am asking for putting the cat back in the bag long after the cat's own grandchildren have died...)
  - DoctorOetker 7y ago
    there is of course still such a thing as formal proofs and verification. with enough attention on information theoretic security (or unconditional security), things may change
  - pbhjpbhj 7y ago
    A fine of 4% of global revenue might start to focus their minds?
huzaif 7y ago
"I am calling from Microsoft" calls were bad enough. Now they will know some details to a past case and sound slightly more legit.
- texasbigdata 7y ago
  Yeah the no notice. By the way Microsoft has absolutely terrible azure support. If you have a legitimate issue and you dont have a dedicated support consultant good luck to you.
  - Analemma_ 7y ago
    All the cloud providers are like that though. If you're on the cheapo tiers of AWS or GCE, you get the cheapo support. AWS might be slightly better just because more people have used it and so there are more hacky workarounds posted on StackOverflow, but that's small comfort at best.
    - keithnz 7y ago
      I've had good experience with Rackspace and DigitalOcean support (other than having to repeat my problem multiple times until I get to the right person, but at least they are keen to help).... Azure support was a disaster with too many support staff that know almost nothing about the platform except by reading the same websites I can read until you spam every possible support mechanisim you can find and finally get to a "real" support person. This will take around 2-4 weeks.
    - emerongi 7y ago
      AWS paid support is pretty good in my experience.
- iudqnolq 7y ago
  Funnily enough, I learned that if you submit a support ticket on a $12/month single-user Microsoft business account you get a call back from someone who saus they're with Microsoft Support. The rep was very helpful, but a bit puzzled that I wanted him to read me my ticket title. He seemed to think him knowing my name should be sufficient verification. Note: I can never understand Microsoft's names for different levels of the same product. It might not be called a business account, maybe professional or pro or small business or something.
Spooky23 7y ago
What is it about elastisearch that dopey people stuff them with information and leave them on the open internet, all of the time?
- Filligree 7y ago
  It's the default configuration. Unless you go out of your way to ensure security, you'll get this result.
- thekyle 7y ago
  I believe Elasticsearch does not have authentication built into the open source version.
  - btown 7y ago
    This is no longer true, but ONLY as of May 2019 in response to pressure from the containerization world. https://www.elastic.co/blog/security-for-elasticsearch-is-now-free https://www.elastic.co/blog/security-for-elasticsearch-is-no... It’s not default insecure like Mongo was - this was far far worse. You couldn’t even prototype in a secure way even if you wanted to, without a massive contract. One of the most frustrating things in software - IMO they deserved to have AWS commoditize their stack.
    - xvector 7y ago
      Perhaps it's a controversial opinion, but I feel like it's just flat out unethical to relegate basic security to the paid/enterprise version of your product. Of course it's unethical to use said product to store real user data too, but the road goes both ways.
      - bouke 7y ago
        Just deploy it on your local network. No need to expose it to the internet. Sure, authentication is a nice bonus, but a simple firewall goes a long way.
Silhouette 7y ago
When people ask why we're so concerned about the privacy implications and specifically the telemetry functionality of modern software... This. This is why. Even if that functionality is implemented with good intentions and the data is only intended to be used for responsible purposes, the biggest and most technically capable organisations in the world can still make mistakes and suffer data leaks, which are potentially a gift to criminals, commercial competitors, and so on. If there's anything sensitive in there -- personal data, commercial information that was provided under NDA -- we're probably still on the hook for it legally, too.
jonplackett 7y ago
> All of the data was left accessible to anyone with a web browser, with no password or other authentication needed. Really quite incompetent. But we don’t know for sure anyone else actually accessed it.
- netsharc 7y ago
  I like the legally correct phrasing the MS blog (https://msrc-blog.microsoft.com/2020/01/22/access-misconfiguration-for-customer-support-database/ https://msrc-blog.microsoft.com/2020/01/22/access-misconfigu...) said: "While the investigation found no malicious use". If the DB server was configured so access was not logged, could you claim "We investigated, and we didn't see any evidence of access"?
  - jonplackett 7y ago
    That is definitely not ‘the whole truth’!
    - ryanlol 7y ago
      How do you know that? this data was exposed for a day or so, did you dump it yourself?
      - jonplackett 7y ago
        I was referring to the comment above which was microsoft's description, saying there was no evidence of any data being stolen - because there couldn't be any because there was no logging. So I was saying microsoft's claim was not the whole truth, the truth is that they just don't know, not that there was no evidence, because there could not be any evidence.
        netsharc 7y ago
        I wouldn't be so definite about "there was no logging". I was just speculating. If they do have logging, then maybe they are sure that no one illegally got their data (but if that was the case, I would expect a sentence with more confidence). There's been a lot of news along the lines of "We found an unsecured database of voters, and we don't even know who owns it", now those idiots I'd be more sure that they didn't turn on logging. With Microsoft, I'd believe them a bit more, because they'd be afraid of getting busted for using weasel sentences.
el_duderino 7y ago
Microsoft released further details in its own blog post: https://msrc-blog.microsoft.com/2020/01/22/access-misconfiguration-for-customer-support-database/ https://msrc-blog.microsoft.com/2020/01/22/access-misconfigu...
- IanDrake 7y ago
  "Misconfigurations are unfortunately a common error across the industry. We have solutions to help prevent this kind of mistake, but unfortunately, they were not enabled for this database." They need a solution to watch their solution that watches their configs.
  - driverdan 7y ago
    Quis custodiet ipsos custodes? For those who don't know the phrase: https://en.wikipedia.org/wiki/Quis_custodiet_ipsos_custodes%3F https://en.wikipedia.org/wiki/Quis_custodiet_ipsos_custodes%...
    - tialaramex 7y ago
      In Juvenal's context the question is rhetorical. An unfaithful partner will sleep with the people you set to watch over them, duh. But in the context where we use this phrase today the best answer is a full circle. Watching us, watching them, watching you.
  - rhizome 7y ago
    I bet the threat of prison would tune up their attitude. There's no reason that these "misconfigurations" shouldn't be felonies.
    - kart23 7y ago
      For who though? I would hate to see the blame placed on some low-level database engineer. And there's no way you could blame the executives.
meristem 7y ago
When so many elasticsearch bad condiga get published, MS ought to reevaluate their UI and default config.
harikb 7y ago
Wake me up when we expose more than 3 billion.
ifthenelseend 7y ago
How much money did you get from Microsoft for disclosing that vulnerability?
- withinrafael 7y ago
  I reported similar issues in the past and there's no bounty, but of course Microsoft reserves the right to deviate. (And I hope they did in this case!) Minimally, you get placement on the Microsoft Online Services Acknowledgments page. https://portal.msrc.microsoft.com/en-us/security-guidance/researcher-acknowledgments-online-services https://portal.msrc.microsoft.com/en-us/security-guidance/re...
- jacquesm 7y ago
  Nothing like working for free for giant companies that fail utterly at their responsibilities.
  - owlninja 7y ago
    I mean if they didn't have an open bounty or posting, you should assume you are 'working' for free.
cobookman 7y ago
Good reason why defense in depth should be used. Simply stating that your network configuration prevents access isn't the best answer.
- wang_li 7y ago
  >Simply stating that your network configuration prevents access isn't the best answer. Right. The network should actually be configured to prevent access.
  - CydeWeys 7y ago
    And, in the event that this configuration fails to do what you expect it to you, or your network is breached via other means, you should be utilizing defense and depth and all of your DBs and other sensitive systems should require authentication.
    - riknos314 7y ago
      This. This is why google assumes that the network layer adds no security. https://cloud.google.com/beyondcorp/ https://cloud.google.com/beyondcorp/
bluedino 7y ago
"misconfigured security roles" means the dinks that set it up never 'configured" a thing, right?
- TomVDB 7y ago
  That's not how I read Microsoft's statement about it: the permissions were incorrectly changed on December 5th and were corrected on December 31st.
- badwolf 7y ago
  DevOps!
reaperducer 7y ago
250M Microsoft customer service and support records exposed on the web Someone should grep this to find out how many times people were told to turn it off and turn it on again.
- trhway 7y ago
  or run sentiment analysis >The records contained logs of conversations between Microsoft support agents and customers
- ehsankia 7y ago
  Is there any signs that this data is actually out in the wild? From the article, it was found, reporter and fixed within 24 hours, and they claim there's no sign of other unauthorized access.
  - reaperducer 7y ago
    Is there any signs that this data is actually out in the wild? Check the dark web. From the article, it was found, reporter and fixed within 24 hours Being fixed within 24 hours of being reported does not mean it was only available for 24 hours. It could have been 24 days or 24 months. they claim there's no sign of other unauthorized access. Anyone smart enough to access this would also be smart enough to cover their tracks. When I was black hat in the 80's, this was Infiltration 101.
    - xixixao 7y ago
      Covering up is not always technically possible. It’s easy to expose data through some unprotected end point, but that end point might still be logged, and turning off the logging/deleting the logs might be a completely different challenge.
      - thisisnico 7y ago
        Even more challenging if the log destination is external, and if the logging system is an entirely independent system, even potentially provided by a third party. Makes this hard to do.
salex89 7y ago
Pretty sure at least 100M are from me...
shaabanban 7y ago
Notably, elastic's Kubernetes operator which just went 1.0 defaults to requiring a username and password (and generates one if it isn't provided). It also doesn't seem to allow you to opt out of using TLS. https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-overview.html https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-ove...
mikece 7y ago
An idea for someone looking for a fun "Show HN" project: build a scoreboard that searches all of the known data breaches for this year and tells me where I rank for how many breaches I've been in (eg: I'm 89/132 on breaches of 50,000 records or more). Over 8.5BB customer records were exposed last year; the estimate for this year is in excess of 10BB.
- dijit 7y ago
  Isn't that what snusbase and dehashed are doing? https://snusbase.com/ https://snusbase.com/ https://www.dehashed.com/ https://www.dehashed.com/
  - geddy 7y ago
    These sites really bother me sometimes. I just registered on Dehashed and it requires me to pay for a subscription... to see my own stolen data. I reject that on principle alone.
    - dijit 7y ago
      Mostly so it’s not abused my script kiddies. If you want to see if you are in a breach it will tell you but just censor the password if it has been successfully reversed. Haveibeenpwned is the same but doesn’t reverse the passwords.
      - goatsi 7y ago
        The only difference I can see between them and businesses that have gotten people sent to prison [0] is a slight change in the marketing materials. Dehashed even advertises taking Cryptocurrency payments for "unlimited searches". [0]https://www.zdnet.com/article/company-behind-leakedsource-pleads-guilty-in-canada/ https://www.zdnet.com/article/company-behind-leakedsource-pl...
        ThrowAway99122 7y ago
        Guy mentioned in the article here using a throwaway (I'm active on this site). Never went to trial, never went to prison, charges were withdrawn. > An investigation by infosec journalist Brian Krebs claimed that a second suspect, a US man named Jeremy Wade, was also behind the service. He was never charged According to American prosecutors, freedom of speech prevents prosecution in America without intent to commit a crime.
twodave 7y ago
I think Microsoft's response time to this exposure (during a holiday even) is more noteworthy than the fact that it happened. We can sit in our ivory towers all day and shake our heads at what an inept organization Microsoft is for allowing human beings to make mistakes, or we can applaud the fact that once the mistake was identified they chose to act immediately, appropriately and transparently. What are we really expecting here? Perfection?
- throwawayjava 7y ago
  > What are we really expecting here? Perfection? No, I don't expect perfection. However, I do expect very careful implementation of access management for very large databases containing lots of PII and other sensitive customer information. Things like huge databases being accessible without credentials shouldn't require perfection on the part of some human. That sort of stuff should be continuously audited in an automated fashion. But the software industry is quite bad, as a whole, so even the relatively competent actors make surprising, high-impact mistakes. Maybe it's because the stakes are relatively low (c.f., bridge collapsing vs. PII leak) and the competition relatively fierce? Maybe software engineering is still very young and moving quickly? In any case, I think it's totally reasonable to hold the opinion that MSFT is doing things pretty well relative to the rest of the industry and also that the industry as a whole is doing a pretty poor job. IDK, for me the story has to be one of the following: 1. MSFT made a huge and inexcusable mistake, so maybe there's something systemically wrong with MSFT; or, 2. MSFT is very competent, and even very competent people are making very big mistakes, so maybe there's something systemically wrong with the entire industry.
  - Tallasatree 7y ago
    Architect here: from the outside looking in, you hit the nail on the head. In addition to The industry being so young the _relatively_ low-impact when bad things happen make things like this 'not a big deal'. When your mistakes result in a public outcry for a day, then fades into obscurity into the night, why change? why invest money into figuring out a better way? When your mistake makes a building fall over...well, there's a reason why that almost never happens.
whatever1 7y ago
Databases that involve more than X users need to be regulated.No big database should be deployed in public before being vetted on whether it is secured properly. I am tired of reading every week for breaches of personal data and passwords saved in plain text. If no company can secure our data voluntarily then we should use the law to force them to at least meet a bare minimum of standards.
jsgo 7y ago
I got an email from Microsoft Azure in relation to this (didn't read the article, but people are quoting parts of the email I received here). I appreciate that they sent something, but sometimes it'd be nice for them to allow someone to access the data related to them that was exposed as they say "our analysis of the support information indicates that specific personal or organizational identifiable information related to your support case was potentially visible." Okay, what specific personal or organizational identifiable information of mine was visible? I assume the representative or I may've listed said info in our communications back and forth so let me see what was exposed so I can make a judgement of what, if anything, I should do here.
- GordonS 7y ago
  I got the same email, and I agree with what you said - I'd really like to know if this is even personally relevant, and if it is, I'd really like to know precisely what information is relevant. I'm in the EU, so I guess I could ask under the GDPR, but I wouldn't even know who to ask, and with such a large organisation, I can only imagine there would be a lot of run-arpund, requiring a lot of follow-ups from me :/
  - Darkphibre 7y ago
    Well, you can fill out this form: https://www.microsoft.com/en-us/concern/privacyrequest-msa https://www.microsoft.com/en-us/concern/privacyrequest-msa Or you could reach out to Microsoft's Data Protection Officer here: https://www.microsoft.com/en-us/concern/privacy https://www.microsoft.com/en-us/concern/privacy I'm not sure if that's the GDPR path, but it's what I came across.
    - GordonS 7y ago
      These seem like the kind of top-level links in a large organisation that will lead to nowhere, but I'll at least give them a try, thanks!
      - jchb 7y ago
coliveira 7y ago
My opinion is that ALL information that has ever being put online will, sooner or later, be made public. Despite the advances in crypto, there are so many ways to exploit security flaws and vulnerability in all kinds of software. And now with machine learning, which can also be used to help in hacking exploits, there not much that can be done.
gexla 7y ago
I imagine most of these are support issues handled by contractors they have had over the years. Windows 95 through XP had Keane and Convergy's in Tucson running their Windows support (which then forked into Canada and India.) Not sure who they have doing it now. The Windows parts of these records might be a good resource as it's probably part of the documentation which builds up to become the MSKB articles. Each support case was documented and linked to either a KB article, an internal "not yet KB article" or you had to submit it as a unique issue. After the "not yet KB articles" were referenced X times, then it would go to consideration as a KB article. Collectively, all this formed their internal KB. Worked there. Pay was terrible once Convergy's took over. Then they moved everything to India and the support got terrible also. Too bad. They had quite the brain drain from that process. There were a lot of Windows gurus in that building. I learned far more than I needed to know about Windows and went way more in depth than I ever have tinkering with Linux.
- ct520 7y ago
  retweet. I agree worked there too, had a KB article. Can't say I learned much only thing I remember that was new and I use to this day was (windows + pause key) to bring up system info.
  - gexla 7y ago
    Congrats on your KB article. ;) Looking at the dates again, records I was part of was probably before this date. I believe I was gone by 2005. That may also be around the time the Tucson location moved from the IBM campus to the Convergy's buildings. I declined when they asked me if I was going to make the move. I got there right after Convergy's took over from Keane. The training at that time was still really good. Tony Agee and John Mott were legends (unsure of spelling.) I credit this time with my beginnings in tech and learning how to think for troubleshooting. They taught linear, logical troubleshooting which was so simple and yet I still don't see much of it today. It was also a place to develop my search skills. It's incredibly valuable to be able to sift through a load of technical discussions and separate the signal from the noise.
    - 7y ago
sorokod 7y ago
"In total, the data was exposed for about two days before we alerted Microsoft and the records were secured. December 28, 2019 – The databases were indexed by search engine BinaryEdge... " ... at least two days then.
privateSFacct 7y ago
Does this have anything to do with Dell support info - it used to be literally right after buying a dell product (within a week or so) you'd start getting scam calls with your dell info. Dell always denied it, but it was pretty funny. They had service tags and everything - anyone else get that?
Pxtl 7y ago
And yet all their old help forums and documentation pages somehow they can't keep those exposed on the web.
deepspace 7y ago
I truly believe the era of privacy is over. There are zero consequences to anyone important when a data breach happens; therefore there is no incentive for companies to protect their user data and the number of breaches will continue to grow for the foreseeable future. By 2025 at the latest, there will effectively be no such thing as privacy anymore. All personal data belonging to everyone will have been exfiltrated and will be available for sale. You will be able to purchase the full medical history, all financial transactions, all addresses, phone numbers, location history (often with photo/video evidence), all account numbers, ID numbers (government and otherwise), biometric data, browser/search history, every email, sms or chat message they ever sent or received and any other information you can think of for the vast majority of people on earth.
- mathdev 7y ago
  I hope not. Much too late, I recently realised that I probably would not survive my WhatsApp history getting out.
  - rhizome 7y ago
    Better start coffin shopping, because it's going to happen...some day.
  - tialaramex 7y ago
    Because WhatsApp uses the Signal protocol design nobody ends up able to prove anything useful about the message history. To any outsider, including the WhatsApp server operators, the messages are opaque. To a participant, including you, the system delivers authenticated messages but deliberately doesn't sign them. So: Alice knows she didn't send this message, so it's from Bob, but she can't prove to anyone else that she didn't just fake it. Bob knows he sent the message but he can deny it and there's no proof. Eve has no idea what the message was, even if Alice or Bob show her the real message she can't verify they aren't lying.
    - vunie 7y ago
      What about those messages before the signal protocol was adopted?
vunie 7y ago
The solution to leaking private information has been known for a very long time: Don't collect beyond the bare minimum required to render a service. Microsoft should not have collected anything beyond an email and a password. Payment information should only be held temporarily. Personal information is a toxic asset. It baffles me why companies willingly hoard it.
afinlayson 7y ago
At what point do we not allow companies to own this data beyond a transaction. Lets be honest no one can keep this data without eventually being hacked, so maybe they shouldn't have it after that transaction.
huxflux 7y ago
And with zero consequences I suppose?

405 points by el_duderino 7y ago

Wow! So the person on the telephone who tells me in a soft Indian accent that my computer has a problem can now can authenticate themselves with authority, making it easier for them to get me (or my proxy) to enable remote administration so they can do real damage. Security is difficult. Microsoft is supposed to be skilled at preventing data breeches and exploits, but apparently not. What can be done to prevent this sort of thing?

misterhtmlcss 7y ago
Nothing can be done. It's a wildly asymmetrical relationship that means 9 billion people get a try to knock you out and your team of what??? 25, 50, 100, 1000? Security specialists have to see everything possible and plan for any and all possibilities. It's never going to happen. This is the simple reality of the internet and I'm sure you know this, but I saw your comment and thought I'd add this for the next person who may not realize this. I'm personally curious to know, because I'm no SecOps; if there is even a theoretical solution to the internet that would have greater integrity for the users or if this is as good as it gets.
- rhizome 7y ago
  >Nothing can be done. Please don't do this. Something can be done, we all know it, but for some reason don't think it's possible? Prison sentences should have started with the Target CTO in 2013 (at the very latest), but the more the public is cowed by shrug emojis, the less likely companies will protect your data for anything other than commercial advantage.
  - deleted 7y ago
    [deleted]
  - jjeaff 7y ago
    Imprisoning CTOs for incompetence would be unprecedented. We don't imprison people for that reason and I can't imagine any knowledgeable CTO ever taking that position again once that precedent was set. But we do need much more oversight and serious punishment for companies that lose data like this.
    - 616c 7y ago
      Security engineer here. Why? US soldiers fight in combat knowing failure to obey orders can land them in jail for years. The US Code of Military Justice is not fun, and you sign up for it when you join implicitly. Is there an armed service staffing problem? Our general US legal system is flawed, but cops can go to jail for ethical violations and criminal behavior for actions that are integral parts of their job function. Is there a cop staffing shortage? I have argued this, ironically, about US Congresspeople: if we have a volunteer army with stringent legal codes with special punishment by virtue of their job, serving us, why are other classes of people not worthy of higher standards and why do we suspect people will shy away from that? How can we pay others more for higher probability of incompetence and less repercussions? I am not trolling. When I suggested this shows the power of commitment in volunteer armies and I wish Congress had that kind of self respect people tell me I'm nuts. I would like a CTO and security industry jobs to mean something.
      - jjeaff 7y ago
        A CTO can go to jail for unethical and illegal behavior. But you are suggesting they be jailed for incompetence. And considering the fact that no amount of competence will protect you from a sufficiently motivated and resourceful hacker, seems unfair. Now if we come up with a framework and a security checklist that must be followed and certified by the CTO every quarter or something, and they don't do it, or lie, then sure, jail them.
    - rhizome 7y ago
      Everything was "unprecedented" at some point before they existed. It's only a matter of choice and priorities.
  - paulddraper 7y ago
    There has to be a felony for someone to go to prison.
    - rhizome 7y ago
      Yes, legislation is the first step. They made it illegal to access certain data with the CFAA, there's no reason illegally accessing data of a person can't be legislated too. Well, except for "businesses should be allowed to do anything they want."
  - badsectoracula 7y ago
    I have another proposal: let's stop connecting every computer together for the sake of connecting them together. Unless there is real functionality provided by said connection that doesn't exist just to excuse the connection, computers should do all their work locally. We rely way too much on Other People's Computers to do stuff. The only real way to avoid issues is to make them technically impossible, not to rely on laws (that can be abused). (yes, i know i am asking for putting the cat back in the bag long after the cat's own grandchildren have died...)
- DoctorOetker 7y ago
  there is of course still such a thing as formal proofs and verification. with enough attention on information theoretic security (or unconditional security), things may change
- pbhjpbhj 7y ago
  A fine of 4% of global revenue might start to focus their minds?

huzaif 7y ago

"I am calling from Microsoft" calls were bad enough. Now they will know some details to a past case and sound slightly more legit.

texasbigdata 7y ago
Yeah the no notice. By the way Microsoft has absolutely terrible azure support. If you have a legitimate issue and you dont have a dedicated support consultant good luck to you.
- Analemma_ 7y ago
  All the cloud providers are like that though. If you're on the cheapo tiers of AWS or GCE, you get the cheapo support. AWS might be slightly better just because more people have used it and so there are more hacky workarounds posted on StackOverflow, but that's small comfort at best.
  - keithnz 7y ago
    I've had good experience with Rackspace and DigitalOcean support (other than having to repeat my problem multiple times until I get to the right person, but at least they are keen to help).... Azure support was a disaster with too many support staff that know almost nothing about the platform except by reading the same websites I can read until you spam every possible support mechanisim you can find and finally get to a "real" support person. This will take around 2-4 weeks.
  - emerongi 7y ago
    AWS paid support is pretty good in my experience.
iudqnolq 7y ago
Funnily enough, I learned that if you submit a support ticket on a $12/month single-user Microsoft business account you get a call back from someone who saus they're with Microsoft Support. The rep was very helpful, but a bit puzzled that I wanted him to read me my ticket title. He seemed to think him knowing my name should be sufficient verification. Note: I can never understand Microsoft's names for different levels of the same product. It might not be called a business account, maybe professional or pro or small business or something.

Spooky23 7y ago

What is it about elastisearch that dopey people stuff them with information and leave them on the open internet, all of the time?

Filligree 7y ago
It's the default configuration. Unless you go out of your way to ensure security, you'll get this result.
thekyle 7y ago
I believe Elasticsearch does not have authentication built into the open source version.
- btown 7y ago
  This is no longer true, but ONLY as of May 2019 in response to pressure from the containerization world. https://www.elastic.co/blog/security-for-elasticsearch-is-now-free https://www.elastic.co/blog/security-for-elasticsearch-is-no... It’s not default insecure like Mongo was - this was far far worse. You couldn’t even prototype in a secure way even if you wanted to, without a massive contract. One of the most frustrating things in software - IMO they deserved to have AWS commoditize their stack.
  - xvector 7y ago
    Perhaps it's a controversial opinion, but I feel like it's just flat out unethical to relegate basic security to the paid/enterprise version of your product. Of course it's unethical to use said product to store real user data too, but the road goes both ways.
    - bouke 7y ago
      Just deploy it on your local network. No need to expose it to the internet. Sure, authentication is a nice bonus, but a simple firewall goes a long way.

Silhouette 7y ago

When people ask why we're so concerned about the privacy implications and specifically the telemetry functionality of modern software... This. This is why. Even if that functionality is implemented with good intentions and the data is only intended to be used for responsible purposes, the biggest and most technically capable organisations in the world can still make mistakes and suffer data leaks, which are potentially a gift to criminals, commercial competitors, and so on. If there's anything sensitive in there -- personal data, commercial information that was provided under NDA -- we're probably still on the hook for it legally, too.

jonplackett 7y ago

> All of the data was left accessible to anyone with a web browser, with no password or other authentication needed. Really quite incompetent. But we don’t know for sure anyone else actually accessed it.

netsharc 7y ago
I like the legally correct phrasing the MS blog (https://msrc-blog.microsoft.com/2020/01/22/access-misconfiguration-for-customer-support-database/ https://msrc-blog.microsoft.com/2020/01/22/access-misconfigu...) said: "While the investigation found no malicious use". If the DB server was configured so access was not logged, could you claim "We investigated, and we didn't see any evidence of access"?
- jonplackett 7y ago
  That is definitely not ‘the whole truth’!
  - ryanlol 7y ago
    How do you know that? this data was exposed for a day or so, did you dump it yourself?
    - jonplackett 7y ago
      I was referring to the comment above which was microsoft's description, saying there was no evidence of any data being stolen - because there couldn't be any because there was no logging. So I was saying microsoft's claim was not the whole truth, the truth is that they just don't know, not that there was no evidence, because there could not be any evidence.
      - netsharc 7y ago
        I wouldn't be so definite about "there was no logging". I was just speculating. If they do have logging, then maybe they are sure that no one illegally got their data (but if that was the case, I would expect a sentence with more confidence). There's been a lot of news along the lines of "We found an unsecured database of voters, and we don't even know who owns it", now those idiots I'd be more sure that they didn't turn on logging. With Microsoft, I'd believe them a bit more, because they'd be afraid of getting busted for using weasel sentences.

el_duderino 7y ago

Microsoft released further details in its own blog post: https://msrc-blog.microsoft.com/2020/01/22/access-misconfiguration-for-customer-support-database/ https://msrc-blog.microsoft.com/2020/01/22/access-misconfigu...

IanDrake 7y ago
"Misconfigurations are unfortunately a common error across the industry. We have solutions to help prevent this kind of mistake, but unfortunately, they were not enabled for this database." They need a solution to watch their solution that watches their configs.
- driverdan 7y ago
  Quis custodiet ipsos custodes? For those who don't know the phrase: https://en.wikipedia.org/wiki/Quis_custodiet_ipsos_custodes%3F https://en.wikipedia.org/wiki/Quis_custodiet_ipsos_custodes%...
  - tialaramex 7y ago
    In Juvenal's context the question is rhetorical. An unfaithful partner will sleep with the people you set to watch over them, duh. But in the context where we use this phrase today the best answer is a full circle. Watching us, watching them, watching you.
- rhizome 7y ago
  I bet the threat of prison would tune up their attitude. There's no reason that these "misconfigurations" shouldn't be felonies.
  - kart23 7y ago
    For who though? I would hate to see the blame placed on some low-level database engineer. And there's no way you could blame the executives.

meristem 7y ago

When so many elasticsearch bad condiga get published, MS ought to reevaluate their UI and default config.

harikb 7y ago

Wake me up when we expose more than 3 billion.

ifthenelseend 7y ago

How much money did you get from Microsoft for disclosing that vulnerability?

withinrafael 7y ago
I reported similar issues in the past and there's no bounty, but of course Microsoft reserves the right to deviate. (And I hope they did in this case!) Minimally, you get placement on the Microsoft Online Services Acknowledgments page. https://portal.msrc.microsoft.com/en-us/security-guidance/researcher-acknowledgments-online-services https://portal.msrc.microsoft.com/en-us/security-guidance/re...
jacquesm 7y ago
Nothing like working for free for giant companies that fail utterly at their responsibilities.
- owlninja 7y ago
  I mean if they didn't have an open bounty or posting, you should assume you are 'working' for free.

cobookman 7y ago

Good reason why defense in depth should be used. Simply stating that your network configuration prevents access isn't the best answer.

wang_li 7y ago
>Simply stating that your network configuration prevents access isn't the best answer. Right. The network should actually be configured to prevent access.
- CydeWeys 7y ago
  And, in the event that this configuration fails to do what you expect it to you, or your network is breached via other means, you should be utilizing defense and depth and all of your DBs and other sensitive systems should require authentication.
  - riknos314 7y ago
    This. This is why google assumes that the network layer adds no security. https://cloud.google.com/beyondcorp/ https://cloud.google.com/beyondcorp/

bluedino 7y ago

"misconfigured security roles" means the dinks that set it up never 'configured" a thing, right?

TomVDB 7y ago
That's not how I read Microsoft's statement about it: the permissions were incorrectly changed on December 5th and were corrected on December 31st.
badwolf 7y ago
DevOps!

reaperducer 7y ago

250M Microsoft customer service and support records exposed on the web Someone should grep this to find out how many times people were told to turn it off and turn it on again.

trhway 7y ago
or run sentiment analysis >The records contained logs of conversations between Microsoft support agents and customers
ehsankia 7y ago
Is there any signs that this data is actually out in the wild? From the article, it was found, reporter and fixed within 24 hours, and they claim there's no sign of other unauthorized access.
- reaperducer 7y ago
  Is there any signs that this data is actually out in the wild? Check the dark web. From the article, it was found, reporter and fixed within 24 hours Being fixed within 24 hours of being reported does not mean it was only available for 24 hours. It could have been 24 days or 24 months. they claim there's no sign of other unauthorized access. Anyone smart enough to access this would also be smart enough to cover their tracks. When I was black hat in the 80's, this was Infiltration 101.
  - xixixao 7y ago
    Covering up is not always technically possible. It’s easy to expose data through some unprotected end point, but that end point might still be logged, and turning off the logging/deleting the logs might be a completely different challenge.
    - thisisnico 7y ago
      Even more challenging if the log destination is external, and if the logging system is an entirely independent system, even potentially provided by a third party. Makes this hard to do.

salex89 7y ago

Pretty sure at least 100M are from me...

shaabanban 7y ago

Notably, elastic's Kubernetes operator which just went 1.0 defaults to requiring a username and password (and generates one if it isn't provided). It also doesn't seem to allow you to opt out of using TLS. https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-overview.html https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-ove...

mikece 7y ago

An idea for someone looking for a fun "Show HN" project: build a scoreboard that searches all of the known data breaches for this year and tells me where I rank for how many breaches I've been in (eg: I'm 89/132 on breaches of 50,000 records or more). Over 8.5BB customer records were exposed last year; the estimate for this year is in excess of 10BB.

dijit 7y ago
Isn't that what snusbase and dehashed are doing? https://snusbase.com/ https://snusbase.com/ https://www.dehashed.com/ https://www.dehashed.com/
- geddy 7y ago
  These sites really bother me sometimes. I just registered on Dehashed and it requires me to pay for a subscription... to see my own stolen data. I reject that on principle alone.
  - dijit 7y ago
    Mostly so it’s not abused my script kiddies. If you want to see if you are in a breach it will tell you but just censor the password if it has been successfully reversed. Haveibeenpwned is the same but doesn’t reverse the passwords.
    - goatsi 7y ago
      The only difference I can see between them and businesses that have gotten people sent to prison [0] is a slight change in the marketing materials. Dehashed even advertises taking Cryptocurrency payments for "unlimited searches". [0]https://www.zdnet.com/article/company-behind-leakedsource-pleads-guilty-in-canada/ https://www.zdnet.com/article/company-behind-leakedsource-pl...
      - ThrowAway99122 7y ago
        Guy mentioned in the article here using a throwaway (I'm active on this site). Never went to trial, never went to prison, charges were withdrawn. > An investigation by infosec journalist Brian Krebs claimed that a second suspect, a US man named Jeremy Wade, was also behind the service. He was never charged According to American prosecutors, freedom of speech prevents prosecution in America without intent to commit a crime.

twodave 7y ago

I think Microsoft's response time to this exposure (during a holiday even) is more noteworthy than the fact that it happened. We can sit in our ivory towers all day and shake our heads at what an inept organization Microsoft is for allowing human beings to make mistakes, or we can applaud the fact that once the mistake was identified they chose to act immediately, appropriately and transparently. What are we really expecting here? Perfection?

throwawayjava 7y ago
> What are we really expecting here? Perfection? No, I don't expect perfection. However, I do expect very careful implementation of access management for very large databases containing lots of PII and other sensitive customer information. Things like huge databases being accessible without credentials shouldn't require perfection on the part of some human. That sort of stuff should be continuously audited in an automated fashion. But the software industry is quite bad, as a whole, so even the relatively competent actors make surprising, high-impact mistakes. Maybe it's because the stakes are relatively low (c.f., bridge collapsing vs. PII leak) and the competition relatively fierce? Maybe software engineering is still very young and moving quickly? In any case, I think it's totally reasonable to hold the opinion that MSFT is doing things pretty well relative to the rest of the industry and also that the industry as a whole is doing a pretty poor job. IDK, for me the story has to be one of the following: 1. MSFT made a huge and inexcusable mistake, so maybe there's something systemically wrong with MSFT; or, 2. MSFT is very competent, and even very competent people are making very big mistakes, so maybe there's something systemically wrong with the entire industry.
- Tallasatree 7y ago
  Architect here: from the outside looking in, you hit the nail on the head. In addition to The industry being so young the _relatively_ low-impact when bad things happen make things like this 'not a big deal'. When your mistakes result in a public outcry for a day, then fades into obscurity into the night, why change? why invest money into figuring out a better way? When your mistake makes a building fall over...well, there's a reason why that almost never happens.

whatever1 7y ago

Databases that involve more than X users need to be regulated.No big database should be deployed in public before being vetted on whether it is secured properly. I am tired of reading every week for breaches of personal data and passwords saved in plain text. If no company can secure our data voluntarily then we should use the law to force them to at least meet a bare minimum of standards.

jsgo 7y ago

I got an email from Microsoft Azure in relation to this (didn't read the article, but people are quoting parts of the email I received here). I appreciate that they sent something, but sometimes it'd be nice for them to allow someone to access the data related to them that was exposed as they say "our analysis of the support information indicates that specific personal or organizational identifiable information related to your support case was potentially visible." Okay, what specific personal or organizational identifiable information of mine was visible? I assume the representative or I may've listed said info in our communications back and forth so let me see what was exposed so I can make a judgement of what, if anything, I should do here.

GordonS 7y ago
I got the same email, and I agree with what you said - I'd really like to know if this is even personally relevant, and if it is, I'd really like to know precisely what information is relevant. I'm in the EU, so I guess I could ask under the GDPR, but I wouldn't even know who to ask, and with such a large organisation, I can only imagine there would be a lot of run-arpund, requiring a lot of follow-ups from me :/
- Darkphibre 7y ago
  Well, you can fill out this form: https://www.microsoft.com/en-us/concern/privacyrequest-msa https://www.microsoft.com/en-us/concern/privacyrequest-msa Or you could reach out to Microsoft's Data Protection Officer here: https://www.microsoft.com/en-us/concern/privacy https://www.microsoft.com/en-us/concern/privacy I'm not sure if that's the GDPR path, but it's what I came across.
  - GordonS 7y ago
    These seem like the kind of top-level links in a large organisation that will lead to nowhere, but I'll at least give them a try, thanks!
    - jchb 7y ago

coliveira 7y ago

My opinion is that ALL information that has ever being put online will, sooner or later, be made public. Despite the advances in crypto, there are so many ways to exploit security flaws and vulnerability in all kinds of software. And now with machine learning, which can also be used to help in hacking exploits, there not much that can be done.

gexla 7y ago

I imagine most of these are support issues handled by contractors they have had over the years. Windows 95 through XP had Keane and Convergy's in Tucson running their Windows support (which then forked into Canada and India.) Not sure who they have doing it now. The Windows parts of these records might be a good resource as it's probably part of the documentation which builds up to become the MSKB articles. Each support case was documented and linked to either a KB article, an internal "not yet KB article" or you had to submit it as a unique issue. After the "not yet KB articles" were referenced X times, then it would go to consideration as a KB article. Collectively, all this formed their internal KB. Worked there. Pay was terrible once Convergy's took over. Then they moved everything to India and the support got terrible also. Too bad. They had quite the brain drain from that process. There were a lot of Windows gurus in that building. I learned far more than I needed to know about Windows and went way more in depth than I ever have tinkering with Linux.

ct520 7y ago
retweet. I agree worked there too, had a KB article. Can't say I learned much only thing I remember that was new and I use to this day was (windows + pause key) to bring up system info.
- gexla 7y ago
  Congrats on your KB article. ;) Looking at the dates again, records I was part of was probably before this date. I believe I was gone by 2005. That may also be around the time the Tucson location moved from the IBM campus to the Convergy's buildings. I declined when they asked me if I was going to make the move. I got there right after Convergy's took over from Keane. The training at that time was still really good. Tony Agee and John Mott were legends (unsure of spelling.) I credit this time with my beginnings in tech and learning how to think for troubleshooting. They taught linear, logical troubleshooting which was so simple and yet I still don't see much of it today. It was also a place to develop my search skills. It's incredibly valuable to be able to sift through a load of technical discussions and separate the signal from the noise.
  - 7y ago

sorokod 7y ago

"In total, the data was exposed for about two days before we alerted Microsoft and the records were secured. December 28, 2019 – The databases were indexed by search engine BinaryEdge... " ... at least two days then.

privateSFacct 7y ago

Does this have anything to do with Dell support info - it used to be literally right after buying a dell product (within a week or so) you'd start getting scam calls with your dell info. Dell always denied it, but it was pretty funny. They had service tags and everything - anyone else get that?

Pxtl 7y ago

And yet all their old help forums and documentation pages somehow they can't keep those exposed on the web.

deepspace 7y ago

I truly believe the era of privacy is over. There are zero consequences to anyone important when a data breach happens; therefore there is no incentive for companies to protect their user data and the number of breaches will continue to grow for the foreseeable future. By 2025 at the latest, there will effectively be no such thing as privacy anymore. All personal data belonging to everyone will have been exfiltrated and will be available for sale. You will be able to purchase the full medical history, all financial transactions, all addresses, phone numbers, location history (often with photo/video evidence), all account numbers, ID numbers (government and otherwise), biometric data, browser/search history, every email, sms or chat message they ever sent or received and any other information you can think of for the vast majority of people on earth.

mathdev 7y ago
I hope not. Much too late, I recently realised that I probably would not survive my WhatsApp history getting out.
- rhizome 7y ago
  Better start coffin shopping, because it's going to happen...some day.
- tialaramex 7y ago
  Because WhatsApp uses the Signal protocol design nobody ends up able to prove anything useful about the message history. To any outsider, including the WhatsApp server operators, the messages are opaque. To a participant, including you, the system delivers authenticated messages but deliberately doesn't sign them. So: Alice knows she didn't send this message, so it's from Bob, but she can't prove to anyone else that she didn't just fake it. Bob knows he sent the message but he can deny it and there's no proof. Eve has no idea what the message was, even if Alice or Bob show her the real message she can't verify they aren't lying.
  - vunie 7y ago
    What about those messages before the signal protocol was adopted?

vunie 7y ago

The solution to leaking private information has been known for a very long time: Don't collect beyond the bare minimum required to render a service. Microsoft should not have collected anything beyond an email and a password. Payment information should only be held temporarily. Personal information is a toxic asset. It baffles me why companies willingly hoard it.

afinlayson 7y ago

At what point do we not allow companies to own this data beyond a transaction. Lets be honest no one can keep this data without eventually being hacked, so maybe they shouldn't have it after that transaction.

huxflux 7y ago

And with zero consequences I suppose?