4 ms·

A cross-account database vulnerability in Azure PostgreSQL

60 points by samokhvalov 4y ago

terom 4y ago
$40k bounty for complete read access to any customer database using the "public" networking access. Caused by a bad regexp in the authentication mechanism acting as the first security layer, and lack of network-level inter-tenant isolation as a second layer of security.
- eurasiantiger 4y ago
  I have been recommending clients to steer clear of anything Azure since it became obvious the platform is meant to lock in businesses to a seemingly workable system that eventually fails to force the client to pay for enterprise support.
  - mpfundstein 4y ago
    heavy claim. any evidence for any of that?
    - eurasiantiger 4y ago
      The documentation is extensive and thorough like a law book, and the UI has several advertisements for premium support.
0xy 4y ago
Azure seems to be shaping up to be a security joke, there's been a concerning number of cross-account exploits in the last couple of years. AWS isn't perfect, but you really don't see many exploits on this scale. What is Microsoft doing wrong here?
- alexjurkiewicz 4y ago
  There's a certain level of tech schaudenfreude when it comes to Microsoft failing. It's hard to say that Azure has more issues than AWS based on gut feel of recent white hat blog post volume.
  - spacemanmatt 4y ago
    It's sub-ironic, though. Microsoft has been delivering tech fails for decades.
    - philliphaydon 4y ago
      By that logic so has everyone?
- sylens 4y ago
  Azure has definitely had a bunch (too many, IMO), but AWS had a similar disclosure around CloudFormation and Glue back in January. https://www.lastweekinaws.com/blog/orca-security-aws-and-the-killer-whale-of-a-problem/ https://www.lastweekinaws.com/blog/orca-security-aws-and-the... That blog post also highlights that AWS may have a tendency to sweep security issues under the rug if there is no customer impact.
- philliphaydon 4y ago
  I think AWSs very granular permissions using IAM helps. Even tho most people I talk to hate it. I quite like it. Start out with a role with no permissions and open only what’s required for your stuff to work.
  - qxmat 4y ago
    I've found that AWS IAM is amazing compared to Azure AD. With AWS you can do per-workload account vending and grant account owners full "AdministratorAccess", because IAM resources are tied to the account. In Azure it's batshit crazy: almost all IAM resources - roles, groups, principals etc - are tied to the overarching AD tenant and not to the AWS Account equivilent, a subscription. In short this means that I, the owner of a subscription (broad powers), cannot add a new IAM role or associate it with a resource for user assignment. It gets worse... Azure AD limits are tenant wide leading to big orgs refusing to add IAM primatives because they might hit a service limit. And the lack of ABAC makes KeyVault almost unusable compared to AWS Secrets Manager. But hey, at least I have system assigned managed identities for SQL logins, that was kinda cool until AWS introduced IAM auth for RDS.
mola 4y ago
Wasn't Wiz CEO previous job leading Microsoft Israel RnD? After his previous cyber security startup (Adallom) was aquired by Microsoft? Azure security stance was under his supervision [0]. Kind of ironic that his new security startup uncovers his failings at his old job... [0] https://en.globes.co.il/en/article-microsoft-names-assaf-rappaport-head-of-israel-rd-1001220217 https://en.globes.co.il/en/article-microsoft-names-assaf-rap...
lovelearning 4y ago
Are current security monitoring systems - and I suppose a company like MS would be using state-of-the-art - not yet capable of detecting such anomalous behavior? A user gained root access, tried to access another internal IP address, tested multiple ports. I assume all these get logged at the kernel / hypervisor / firewall level...
redwood 4y ago
Wow after the same researchers discovered something similar in Cosmos DB last year. Unreal that Azure is used by anyone
cpressland 4y ago
When Flexible Server was first announced, I’m sure I remember them stating it’ll use Private (VNet) networking by default. Seems strange they’ve changed tact there. Either way, we migrated to Flexible Server on day one of GA purely for the performance benefits (Linux) over Single Server (Windows). While there has been some painful moments, also around High Availability, the service has been a huge leap forward.

60 points by samokhvalov 4y ago

$40k bounty for complete read access to any customer database using the "public" networking access. Caused by a bad regexp in the authentication mechanism acting as the first security layer, and lack of network-level inter-tenant isolation as a second layer of security.

eurasiantiger 4y ago
I have been recommending clients to steer clear of anything Azure since it became obvious the platform is meant to lock in businesses to a seemingly workable system that eventually fails to force the client to pay for enterprise support.
- mpfundstein 4y ago
  heavy claim. any evidence for any of that?
  - eurasiantiger 4y ago
    The documentation is extensive and thorough like a law book, and the UI has several advertisements for premium support.

0xy 4y ago

Azure seems to be shaping up to be a security joke, there's been a concerning number of cross-account exploits in the last couple of years. AWS isn't perfect, but you really don't see many exploits on this scale. What is Microsoft doing wrong here?

alexjurkiewicz 4y ago
There's a certain level of tech schaudenfreude when it comes to Microsoft failing. It's hard to say that Azure has more issues than AWS based on gut feel of recent white hat blog post volume.
- spacemanmatt 4y ago
  It's sub-ironic, though. Microsoft has been delivering tech fails for decades.
  - philliphaydon 4y ago
    By that logic so has everyone?
sylens 4y ago
Azure has definitely had a bunch (too many, IMO), but AWS had a similar disclosure around CloudFormation and Glue back in January. https://www.lastweekinaws.com/blog/orca-security-aws-and-the-killer-whale-of-a-problem/ https://www.lastweekinaws.com/blog/orca-security-aws-and-the... That blog post also highlights that AWS may have a tendency to sweep security issues under the rug if there is no customer impact.
philliphaydon 4y ago
I think AWSs very granular permissions using IAM helps. Even tho most people I talk to hate it. I quite like it. Start out with a role with no permissions and open only what’s required for your stuff to work.
- qxmat 4y ago
  I've found that AWS IAM is amazing compared to Azure AD. With AWS you can do per-workload account vending and grant account owners full "AdministratorAccess", because IAM resources are tied to the account. In Azure it's batshit crazy: almost all IAM resources - roles, groups, principals etc - are tied to the overarching AD tenant and not to the AWS Account equivilent, a subscription. In short this means that I, the owner of a subscription (broad powers), cannot add a new IAM role or associate it with a resource for user assignment. It gets worse... Azure AD limits are tenant wide leading to big orgs refusing to add IAM primatives because they might hit a service limit. And the lack of ABAC makes KeyVault almost unusable compared to AWS Secrets Manager. But hey, at least I have system assigned managed identities for SQL logins, that was kinda cool until AWS introduced IAM auth for RDS.

mola 4y ago

Wasn't Wiz CEO previous job leading Microsoft Israel RnD? After his previous cyber security startup (Adallom) was aquired by Microsoft? Azure security stance was under his supervision [0]. Kind of ironic that his new security startup uncovers his failings at his old job... [0] https://en.globes.co.il/en/article-microsoft-names-assaf-rappaport-head-of-israel-rd-1001220217 https://en.globes.co.il/en/article-microsoft-names-assaf-rap...

lovelearning 4y ago

Are current security monitoring systems - and I suppose a company like MS would be using state-of-the-art - not yet capable of detecting such anomalous behavior? A user gained root access, tried to access another internal IP address, tested multiple ports. I assume all these get logged at the kernel / hypervisor / firewall level...

redwood 4y ago

Wow after the same researchers discovered something similar in Cosmos DB last year. Unreal that Azure is used by anyone

cpressland 4y ago

When Flexible Server was first announced, I’m sure I remember them stating it’ll use Private (VNet) networking by default. Seems strange they’ve changed tact there. Either way, we migrated to Flexible Server on day one of GA purely for the performance benefits (Linux) over Single Server (Windows). While there has been some painful moments, also around High Availability, the service has been a huge leap forward.