4 ms·

How do you know that? this data was exposed for a day or so, did you dump it yourself?

jonplackett 7y ago
I was referring to the comment above which was microsoft's description, saying there was no evidence of any data being stolen - because there couldn't be any because there was no logging. So I was saying microsoft's claim was not the whole truth, the truth is that they just don't know, not that there was no evidence, because there could not be any evidence.
- netsharc 7y ago
  I wouldn't be so definite about "there was no logging". I was just speculating. If they do have logging, then maybe they are sure that no one illegally got their data (but if that was the case, I would expect a sentence with more confidence). There's been a lot of news along the lines of "We found an unsecured database of voters, and we don't even know who owns it", now those idiots I'd be more sure that they didn't turn on logging. With Microsoft, I'd believe them a bit more, because they'd be afraid of getting busted for using weasel sentences.
- ryanlol 7y ago
  How do you know there was no logging? Linux distros log by default, as does elasticsearch. Most networking setups also keep some sort of BW usage logs. Unless you have some insider knowledge it sounds like you’re full of shit. If you’re going to claim that they’ve deliberately turned off all logging, you’ll need to show some evidence. (Or at the very least claim that you have some!)
  - jonplackett 7y ago
    Seems like i've misinterpreted the previous comment, and then had my misinterpretation misinterpreted for good measure. Ah well.
pbhjpbhj 7y ago
My home computer, which is on for 4hrs a day, used to get hundreds of SSH login attempts. I imagine the number of people trying to scan MS is a couple of orders of magnitude higher, and some of those will have enough savvy to exploit a security hole. Comparitech found/accessed it, what are the chances they're the only ones? (I say, very low.) I'd say it seems likely. But I only have domestic experience. People with industry experience, what do you think?
- ryanlol 7y ago
  SSH worms are a completely different subject, MS does not get orders of magnitude more scan traffic than you do. Services like greynoise provide an easy answer to “who’s scanning for elasticsearch?”, although most of those are trying to RCE and not exfil data. It’s certainly possible that someone else found this ES and dumped the data during the few hours it was exposed, but I certainly wouldn’t call that likely.
  - pbhjpbhj 7y ago
    The company reporting it found the breach, so we know someone found it. What's your background? I'd be surprised to find corporate IPs were only scanned at the rate of domestic non-fixed IPs. If a black hat cracker finds data they can exfiltrate do you think they'd just leave it; especially data like this that has obvious value to phishers/fraudsters?
    - ryanlol 7y ago
      > What's your background? I'd be surprised to find corporate IPs were only scanned at the rate of domestic non-fixed IPs. I scan for a living, have been doing so for a better part of the last 10 years. I spend lots of time keeping up with what other people are scanning for. > If a black hat cracker finds data they can exfiltrate do you think they'd just leave it Yeah sure, if a malicious hacker had access and knew what they had access to they wouldn’t just leave the data there. Odds are this would just be discovered by scripts trying to drop malware for DDoS, or ransomware. As a black hat hacker scanning for things like this I always had the problem that I was finding way more data than I could realistically store and process, I’m sure I missed hundreds of things like this in my results because of that. The criminals doing this stuff don’t have teams of people working for them analyzing the data. Then there’s the fact that a very significant chunk of blackhat hackers just won’t be working in late december. I understand that this may not sound like such an convincing argument at first, but this’ll almost certainly exclude at least half of the malicious actors who could’ve possibly found it. I’m not saying it’s impossible, I just don’t think it’s particularly likely.

I was referring to the comment above which was microsoft's description, saying there was no evidence of any data being stolen - because there couldn't be any because there was no logging. So I was saying microsoft's claim was not the whole truth, the truth is that they just don't know, not that there was no evidence, because there could not be any evidence.

netsharc 7y ago
I wouldn't be so definite about "there was no logging". I was just speculating. If they do have logging, then maybe they are sure that no one illegally got their data (but if that was the case, I would expect a sentence with more confidence). There's been a lot of news along the lines of "We found an unsecured database of voters, and we don't even know who owns it", now those idiots I'd be more sure that they didn't turn on logging. With Microsoft, I'd believe them a bit more, because they'd be afraid of getting busted for using weasel sentences.
ryanlol 7y ago
How do you know there was no logging? Linux distros log by default, as does elasticsearch. Most networking setups also keep some sort of BW usage logs. Unless you have some insider knowledge it sounds like you’re full of shit. If you’re going to claim that they’ve deliberately turned off all logging, you’ll need to show some evidence. (Or at the very least claim that you have some!)
- jonplackett 7y ago
  Seems like i've misinterpreted the previous comment, and then had my misinterpretation misinterpreted for good measure. Ah well.

pbhjpbhj 7y ago

My home computer, which is on for 4hrs a day, used to get hundreds of SSH login attempts. I imagine the number of people trying to scan MS is a couple of orders of magnitude higher, and some of those will have enough savvy to exploit a security hole. Comparitech found/accessed it, what are the chances they're the only ones? (I say, very low.) I'd say it seems likely. But I only have domestic experience. People with industry experience, what do you think?

ryanlol 7y ago
SSH worms are a completely different subject, MS does not get orders of magnitude more scan traffic than you do. Services like greynoise provide an easy answer to “who’s scanning for elasticsearch?”, although most of those are trying to RCE and not exfil data. It’s certainly possible that someone else found this ES and dumped the data during the few hours it was exposed, but I certainly wouldn’t call that likely.
- pbhjpbhj 7y ago
  The company reporting it found the breach, so we know someone found it. What's your background? I'd be surprised to find corporate IPs were only scanned at the rate of domestic non-fixed IPs. If a black hat cracker finds data they can exfiltrate do you think they'd just leave it; especially data like this that has obvious value to phishers/fraudsters?
  - ryanlol 7y ago
    > What's your background? I'd be surprised to find corporate IPs were only scanned at the rate of domestic non-fixed IPs. I scan for a living, have been doing so for a better part of the last 10 years. I spend lots of time keeping up with what other people are scanning for. > If a black hat cracker finds data they can exfiltrate do you think they'd just leave it Yeah sure, if a malicious hacker had access and knew what they had access to they wouldn’t just leave the data there. Odds are this would just be discovered by scripts trying to drop malware for DDoS, or ransomware. As a black hat hacker scanning for things like this I always had the problem that I was finding way more data than I could realistically store and process, I’m sure I missed hundreds of things like this in my results because of that. The criminals doing this stuff don’t have teams of people working for them analyzing the data. Then there’s the fact that a very significant chunk of blackhat hackers just won’t be working in late december. I understand that this may not sound like such an convincing argument at first, but this’ll almost certainly exclude at least half of the malicious actors who could’ve possibly found it. I’m not saying it’s impossible, I just don’t think it’s particularly likely.