5 ms·
The Microsoft writeup is really something. > Microsoft has addressed an authorization misconfiguration for multi-tenant applications that use Azure AD, initial
by iudqnolq 4y ago
The Microsoft writeup is really something.
> Microsoft has addressed an authorization misconfiguration for multi-tenant applications that use Azure AD, initially discovered by Wiz, and reported to Microsoft, that impacted a small number of our internal applications.
Sure, a small number of internal applications. Just the ones that gave them arbitrary JavaScript execution on every visitor to bing.com and full access to every signed in user's emails and cloud office documents.
https://msrc.microsoft.com/blog/2023/03/guidance-on-potential-misconfiguration-of-authorization-of-multi-tenant-applications-that-use-azure-ad/ https://msrc.microsoft.com/blog/2023/03/guidance-on-potentia...
- knallfrosch 4y agoDoesn't get much smaller than "being able to read all Outlook emails from every Bing.com visitor", right?
- londons_explore 4y agoThis is only bing - we aint talkin Google here.
- supriyo-biswas 4y agoTo add insult to injury, the $40k bounty seems awfully low for the amount of access the vulnerability gave its reporters.
- jsnell 4y agoIt doesn't seem out of line with the published award scales of Microsoft's bug bounty program[0]. If the researchers weren't ok with that bounty, they shouldn't (and wouldn't!) have done the research with that motive. [0] https://www.microsoft.com/en-us/msrc/bounty https://www.microsoft.com/en-us/msrc/bounty
- flangola7 4y agoOr they did it out of moral reasons, which is not something every discoverer of vulnerabilities will care about
- jsnell 4y agoIf their motive wasn't the bounty, and it is just an unexpected bonus, why complain about it being too small?
- joosters 4y agoThe researchers didn't complain about the bounty, AFAIK.
- jsnell 4y agoI know. That's the entire point. It is just HN complaining on their behalf, unsolicited.
- inferiorhuman 4y agoSo. What. $40,000 is something that a senior SDE could pay out themselves without flinching. A trillion dollar company like MSFT should do better than that for something so severe. Put another way: just because the researchers didn't (publicly) complain doesn't put MSFT in the right here. There are more than a few kernel developers who didn't raise hell about Linus' abusive behavior. Yet even Linus himself realized his behavior had to change.
- ethanwillis 4y agoIt's almost as if HN is a site where we discuss things instead of just passively consuming information. In either case only paying $40,000 for disclosing an exploit like this sends a clear message from Microsoft. They don't take their user's security seriously. And it also incentivizes certain outcomes -- They're cheap and less moral actors who are only motivated by the finanical reward won't bother to engage with Microsoft. Use Microsoft products at your own peril.
- favsq 4y agoFor that price I would just sell it to the Mossad.
- belter 4y agoI would sell it first to the Mossad and after to Microsoft...
- danielvf 4y agoSay what you want to about crypto, the bug bounty payments are enormous: From the https://immunefi.com/leaderboard/ https://immunefi.com/leaderboard/ #1. 4 paid reports: $13,010,000 total earnings #2. 2 paid reports: $10,020,000 total earnings #3. 8 paid reports: $8,010,000 total earnings
- rideontime 4y agoCrypto bug bounties are high because the alternative is https://web3isgoinggreat.com/?theme=hack https://web3isgoinggreat.com/?theme=hack
- danielvf 4y agoOr for an even more funny take, see https://rekt.news https://rekt.news
- cmcaleer 4y agoBecause massive vulns like this are existential threats for these protocols. If Equifax gets breached for 150m peoples' personal information, they just get a slap on the wrist, pay you $15 (if you're lucky), and continue as a going concern. If these trillion dollar companies messing around with your personal information was an existential threat to their business, they would pay comparably with crypto companies.
- bastawhiz 4y agoIs that dollar amounts or crypto amounts normalized to dollars?
- adql 4y agoShould've reported every app that got hacked as separate bounty :D
- Alupis 4y agoI see these sort of things, and always chuckle to myself. It's reassuring to see even the Giants screwing up too. It's way too easy to assume devs at some fancy wiz-bang company are all 10X'ers and produce perfect elegant code every time. Then you realize developers at all companies are nearly universally bad. It's a kind of miracle any of this stuff works at all, despite all the intelligence that's gone into them.