4 ms·
Yikes. 30% of Cosmos DB customers were vulnerable to this attack. I'm really looking forward to seeing the details of this exploit. It sounds like it was a ser
by psanford 5y ago
Yikes. 30% of Cosmos DB customers were vulnerable to this attack.
I'm really looking forward to seeing the details of this exploit. It sounds like it was a service authorization that failed to check account boundary limits. That is a massive failure for a serverless database.
Putting aside this specific failure, the way all the cloud providers are trying to interconnect their service offerings makes me increasingly nervous. It is too easy to accidentally grant overly permissive IAM policies without realizing it.
- PeterCorless 5y agoNot quite. To clarify, 30% of customers were notified of the issue. A larger, currently undetermined number are projected to have been exposed to the vulnerability. "every Cosmos DB customer should assume they’ve been exposed" — Wiz.
- CyanLite2 5y agoSeriously doubt there are more than 30% of Microsoft customers who ran CosmosDB with a wide open firewall. Any serious corporate customer would be in breach of even the most basic security/compliance rules.
- ctvo 5y agoThis is an extraordinary position to take, one because it assumes "serious corporate customers" somehow take security seriously. Every. Week. There's a new breach from a "serious corporate customer". Then there's this: > So you can imagine our surprise when we were able to gain complete unrestricted access to the accounts and databases of several thousand Microsoft Azure customers, *including many Fortune 500 companies*. Source: https://www.wiz.io/blog/chaosdb-how-we-hacked-thousands-of-azure-customers-databases https://www.wiz.io/blog/chaosdb-how-we-hacked-thousands-of-a...
- psanford 5y agoWithout more details its really hard to say. One would assume that Microsoft is at least competent enough to notify potentially affected customers.