3 ms·

article mentions them "spidering into an azure tenant." Wonder if that's related to the azure multi tenancy misconfiguration that resulted in the Bing CMS being

• steffanA 4y ago
  Very common to get access to the Azure/Local AD in ransomware attacks. That Bing CMS bug was only exploited by the researchers who disclosed it to MS.
  • JohnMakin 4y ago
    I'm not saying it's literally the same attack, but the author of that Bing CMS bug identified the cause (misconfigured multi tenancy) and said up to 25% of Azure apps they scanned had this same vulnerability.
• readyplayernull 4y ago
  Is OpenAI at risk with MS deal?
  • flangola7 4y ago
    if someone hasn't stolen GPT-4's weights yet, they're definitely trying
    • jacquesm 4y ago
      I wonder what their personnel vetting processes are like. That would be my first worry.
• matthew9219 4y ago
  Fwiw, the finder here is not completely correct in their assertions. Locking the Bing CMS down to single tenancy would have meant that instead of the whole world having access, only about 180,000 Microsoft employees would have access. The actual number of people who should have access is about 50. Maybe 500 the way Bing is bloated. The problem here is that Bing CMS didn't implement the authorization half of authentication and authorization - they simply allowed all authenticated users to access all data. Multi-tenancy expands the scope, but it's not really clear what portion of the 25% of apps the finder surveyed that were multi-tenant similarly lack any authorization whatsoever.