3 ms·
In their report (https://msrc.microsoft.com/blog/2023/03/guidance-on-potential-misconfiguration-of-authorization-of-multi-tenant-applications-that-use-azure-ad/
by vander_elst 4y ago
In their report (https://msrc.microsoft.com/blog/2023/03/guidance-on-potential-misconfiguration-of-authorization-of-multi-tenant-applications-that-use-azure-ad/ https://msrc.microsoft.com/blog/2023/03/guidance-on-potentia...) Microsoft doesn't even say whether end users were impacted. This seems to be a MASSIVE issue.
- jacquesm 4y agoBy law they are required to report this to the DPA's of countries in Europe where end users were affected.
- TheNewsIsHere 4y agoThe Wiz article does mention that (specifically for their XSS attack at least) Microsoft can't necessarily determine if anyone was affected. Not that you're wrong of course, but with an attack like that it wouldn't be accurate to say that every user is affected. At the same time, if you can't figure out if anyone was affected, what do you tell regulators? They could definitely review historical or backup copies of their CMS databases for Bing, or database transaction logs, or whatever they have, to determine if this type of attack was ever launched. They'd have to correlate that to Bing visitor/usage records and hopefully be able to connect the dots. Even if they have the data to do this, I don't see them doing it.
- adql 4y agoI'd imagine they have logging history somewhere? Then again if you fucked up your internal apps that badly, failure to include auditing is also likely
- mh- 4y agoCalifornia residents too, under CCPA, if it meets the definition of a data breach.