5 ms·
From the researchers: > So you can imagine our surprise when we were able to gain complete unrestricted access to the accounts and databases of several thousan
by dlor 5y ago
From the researchers:
> So you can imagine our surprise when we were able to gain complete unrestricted access to the accounts and databases of several thousand Microsoft Azure customers, including many Fortune 500 companies.
This is basically worst-case scenario for a database provider.
https://www.wiz.io/blog/chaosdb-how-we-hacked-thousands-of-azure-customers-databases https://www.wiz.io/blog/chaosdb-how-we-hacked-thousands-of-a...
- onionisafruit 5y agoIt’s worst-case for their customers. They’re the ones who need to figure out what data to consider compromised. Microsoft gets a temporary mark on their reputation until their pr and marketing departments make us forget about it. That’s it. Nobody is even going to lose their bonus over this.
- DaiPlusPlus 5y agoAlso, it's CosmosDB - it has a certain reputation internally in the Azure org...
- geoduck14 5y agoPlease elaborate
- outside1234 5y agoIt sucks, is expensive, and was designed by someone who was fired.
- lloydatkinson 5y agoDo you have some sources? What was they fired for? I thought they got Leslie Lanport to design it
- onionisafruit 5y agoLet me take a wild guess. I bet they work for GitHub now.
- edgyquant 5y agoWhy would he still work for Microsoft if he was fired?
- panda88888 5y agoHe probably is jokingly referring to the Nokia acquisition, which at that time is ran by an ex-Microsoft executive, whom rejoins Microsoft after the acquisition. https://www.google.com/amp/s/www.nytimes.com/2013/09/04/technology/microsoft-acquires-nokia-units-and-leader.amp.html https://www.google.com/amp/s/www.nytimes.com/2013/09/04/tech...
- scns 5y agoSorry but small correction: s/ran by/ran into the ground by/g
- panda88888 5y agoOh yes, I forgot about that important detail. MS was able to buy at a greatly discounted price due to that.
- plorkyeran 5y agoDo you love MongoDB, but wish it was slower, more expensive, and even less reliable? Then CosmosDB may be the database for you.
- habeebtc 5y agoFrankly, I do not know why people don't build things on Kusto.
- DaiPlusPlus 5y agoI haven't even heard of Kusto until now...
- UK-Al05 5y agoWe use comos and we used to use mongo. It's a lot less hands off then mongo.
- dustinmoris 5y agoSame as Azure Functions. Internally at Microsoft everyone knows that it’s completely broken and they don’t understand why customers use it either. Apparently it was due to an extremely dysfunctional team and certain team members.
- binarytox1n 5y agoWhy are Azure Functions completely broken?
- dustinmoris 5y agoHave a play with AWS Lambda or Google Cloud Functions, then compare that with Azure Functions and you might wonder if what Azure has done is even remotely “serverless” FaaS or just a huge messy clusterfuck of an App Service which is billed per second and overly complicated to manage and observe.
- DaiPlusPlus 5y agoGet something-out-the-door to compete with Lambda and GCF by hacking together an abstraction over Azure App Services - then improve things by version 2?
- manigandham 5y agoAll 3 clouds have the same fundamental architecture. There's no magic "serverless", everything is just compiled down to a container or some executable package, placed on a server, executed as requests come in, and then paused with varying control and scheduling parameters. Azure is a little messier than the rest but the end result is the same.
- kerng 5y agoThis sounds like no basic pen testing was performed - quite surprised Microsoft isn't doing that. Seems like their resources (billions in cash) aren't allocated correctly.
- spydum 5y agoI'm sure it was pentested, but the problem is pentesting quality can vary wildly. Hard to know if you have a great tester or a great dev team.
- scns 5y agoHow are you sure when Windows is tested by the users and they scaled down their testing teams? Genuinely curious?
- spydum 5y agoLate to reply but the answer is services are different than desktop software. Azure services fall under a rigorous compliance regime and pentesting (3rd party even) is part of that. Just goes to show compliance does not always mean secure.
- gautamdivgi 5y agoYou should use private endpoints and private link services and turn-off public access to every resource except components that need public Internet access. Sure it costs some $ but why would a fortune 500 expose their DB endpoint publicly?
- onionisafruit 5y ago> why would a fortune 500 expose their DB endpoint publicly? Incompetence. It’s not the exclusive domain of small companies. I’ve dealt with some very incompetent people at Fortune 500 companies. As a matter of fact, the very people responsible for the mishap we are discussing now work at a Fortune 500 company.
- gautamdivgi 5y agoI do apologize, I didn't mean to imply incompetence at small companies. I can understand smaller companies not using private endpoints/private link services for cost reasons. I can't fathom why fortune 500's would not use them to secure their resources.
- onionisafruit 5y agoNo apology needed. I’m the one who brought up small companies. I just wanted to point out that big businesses don’t necessarily know what they are doing. People who don’t work for one assume they are well oiled machines, and people who do work for a big business assume every other big business is a well oiled machine.
- effingwewt 5y agoEspecially these days as OPSec is seen more as a cost-center than a lawsuit buffer. For some reason they will keep millions on the books specifically for lawsuits, but shelling out $ for proper security is unfathomable (see- T-mobile).
- dhosek 5y ago