5 ms·

TBH the issues that I've seen with Azure are pretty shocking. Like "I don't believe anyone did a basic pentest against that system even once" levels of shocking

TBH the issues that I've seen with Azure are pretty shocking. Like "I don't believe anyone did a basic pentest against that system even once" levels of shocking. That's insane for a company the size of Microsoft. These vulns are cross tenancy violations, which, again, is insane. That's as bad as it gets for the cloud. > This incident demonstrates the evolving challenges of cybersecurity in the face of sophisticated attacks. The insane thing is that some of these vulns are as easy to discover as just running nmap. I'm sort of shocked that people haven't run into them accidentally. Hardly sophisticated. I'm not trusting Azure with shit.

deleted 3y ago
[deleted]
midoridensha 3y ago
>That's insane for a company the size of Microsoft. Why? Why does company size have anything at all to do with the security of their product? Microsoft has been making shoddy, horribly insecure products for decades now. Do you need me to list all the email viruses and other such things that were running rampant in the 90s and 2000s? What's truly insane is that people keep expecting Microsoft to do better, and then being disappointed when they don't. The common saying is "the definition of insanity is doing the same thing and expecting a different result", and that's exactly what most people do in regards to Microsoft and product quality or security.
- insanitybit 3y ago
  > Why? Why does company size have anything at all to do with the security of their product? Because they have a massive security team. Size has a lot to do with security. > What's truly insane is that people keep expecting Microsoft to do better, and then being disappointed when they don't. Microsoft has done a ton of impressive security work when it comes to Windows, they've really stepped up their game. They've invested quite heavily.
  - devwastaken 3y ago
    More cooks ensures you get the same terrible burger in triplicate.
    - insanitybit 3y ago
      No. Security teams need staff.
- bagacrap 3y ago
  Size is correlated with resources. Microsoft should have the resources to throw at this problem. Unfortunately the Microsoft approach to software engineering is to set a bunch of monkeys loose on a room full of keyboards, rather than to spend their considerable resources vying for top talent. (Obviously they do have some good engineers, no offense if you're one of them, it's simply that from my sample size of 5, 80% were just warm bodies with email access.)
  - dreamcompiler 3y ago
    Of course they have the resources. What they don't have is the incentives to do better. Just like every other big company that has a breach, they are not punished when they ignore basic security and they are not rewarded for paying attention to it. In fact they are punished by Wall Street for paying attention to it, because that costs money. As long as all they have to do is say "Whoops! We're sorry" when a breach happens, we should expect breaches to be the norm for all big companies.
    - insanitybit 3y ago
      They definitely have the incentives. This conversation is a good example of that. Azure is attempting to compete in an aggressively competitive market and their customers absolutely care about security.
    - bagacrap 3y ago
      Hopefully a news item as large as this one will cause them to lose some contracts, at least at the margin.
      - hulitu 3y ago
        You expect too much from Sales and CIOs/CEOs. Most of them have no idea what this is, but they make the decision to buy SW products.
    - BLKNSLVR 3y ago
      > Of course they have the resources. What they don't have is the incentives to do better. Off-topic: this is exactly the same reason that Google offers up ads for scams and ads containing or linking to malware on their own advertising network. The only way to get to the size of these companies is to scale what can be scaled, and damn the rest until the pigeons come home to roost. Which, if they play their political-donation cards right, won't happen. And if it does, jeez they've made bank in the meantime, and will Goodhart the shit out of whatever watered-down legislational changes may make their way through.
- nvy 3y ago
  >Why? Why does company size have anything at all to do with the security of their product? Because they have the money to hire people who know what they're doing, though it seems they are having difficulty selecting the right candidates.
  - midoridensha 3y ago
    Google has the money to hire customer service representatives for customers to call when they have a problem, but they don't do so, because it's not a priority for them. It's the same with Microsoft and security.
    - nvy 3y ago
      Yes, and Google rightly gets criticized for it. Microsoft is getting the same treatment for being equally shitty.
      - midoridensha 3y ago
        Right, and how is this helping? Yes, Google gets criticized for not having any customer service. So... what? Has this affected Google's profitability one iota? No. Same with MS.
        nvy 3y ago
        I don't understand your objective in this conversation. Are you trying to argue it's okay that Microsoft is incompetent, because Google also has bad customer service? Or that we shouldn't criticize Microsoft's awful security practices because it's "not their priority"?
- sublinear 3y ago
  > "the definition of insanity is doing the same thing and expecting a different result" This is a nitpick, but it's often completely reasonable to expect a different result by doing the same thing. Nothing against what you wrote, I just hate this saying so much. It's usually wrong to assume things are context-free. Most of life is defined by routine. Erosion carved out the surface of the earth, breathing and eating keeps you alive, etc. At some point the definition of "same" comes under scrutiny and you will find that it's impossible to truly do the exact same thing more than once, and yet even if it was possible you might still get a different result because other things you had no control over changed. Entropy makes it all just so.
  - midoridensha 3y ago
    Well, I think the saying kinda implies that the conditions are the same. Obviously, common sense dictates that doing the same thing when conditions are radically different can yield different results. (For instance, taking a deep breath is usually good for you. But doing so underwater is obviously not.) Of course, this then leads to an argument over how the conditions differ in the example where the saying is used, like with MS here.
    - benterix 3y ago
      Well, practically speaking the conditions are never the same in the course of action. If you are trying to break something, for example, at first you don't succeed but in the end, after repeating the same action again and again, you finally do.
prepend 3y ago
Remember when cosmosdb users could read other users databases? [0] It was so boneheadedly stupid, it was like a sysadmin making all user directories readable by all users. Not sure how that would not be tested. And made me worry about what other vulnerabilities lurk in Azure. [0] https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-v...
- insanitybit 3y ago
  The vulns from wiz were so bad I basically wrote off Azure that day. And not bad like 'impact is high', bad like 'did anyone in your massive security org actually look at this?'.
  - chayesfss 3y ago
    [dead]
sylens 3y ago
I get the general sense that Azure is a frankenstein of a bunch of services they had built before as well as some that were formerly internally used, and have since been published/scaled up for customers Nothing seems to have been designed to naturally fit together, everything feels like its glued on
- minedwiz 3y ago
  Hey, don't forget acquired companies' codebases awkwardly shoehorned into being an Azure RP.
- FreshStart 3y ago
  It's funny, cause liability can scale, so if all of this can be hacked and will be hacked, the lawsuits by companies will bury Microsoft?
- hulitu 3y ago
  > Nothing seems to have been designed to naturally fit together, everything feels like its glued on This is a trademark of Windows since the beginning.
Veserv 3y ago
Microsoft certifies to the government that they can not protect against moderately skilled attackers via their Common Criteria certifications as seen on their security homepage [1][2]. These are the only security certifications they mention on that page (FIPS is also mentioned, but it is more of a crypto certification than a security certification). They specifically certify that they only conform to EAL1 [3][4] which only requires AVA_VAN.1 which is the ability to protect against attackers with a "Basic attack potential" [5]. The evaluation methodology required by AVA_VAN.1 can be seen on their certification report [6]. Effectively, they do a Google search for "Windows CVE" then they check that all the search results are patched. That's it. I am not joking. That is how they certify security. I am not joking. Seriously. To be fair, Microsoft has historically certified to conform to EAL4 which requires AVA_VAN.3 which is the ability to protect against "Enhanced basic" attackers and includes a actual penetration test. However, despite decades of attempts, they have never once successfully certified any product against AVA_VAN.4 which is the ability to protect against "Moderate" attackers. They have literally never once been able to protect against "Moderate" attackers. And they have the certifications to prove that they absolutely, positively, can not. It is the height of idiocy that anybody listens to or trusts anything that Microsoft says at all about security. The have literally certified that the height of their ability is abject incompetence and the total inability to protect against "moderately" skilled attackers. Until they can definitely prove and certify otherwise, their claims of security should be completely ignored as the useless trash that it is. [1] https://learn.microsoft.com/en-us/windows/security/ https://learn.microsoft.com/en-us/windows/security/ [2] https://learn.microsoft.com/en-us/windows/security/security-foundations/certification/windows-platform-common-criteria https://learn.microsoft.com/en-us/windows/security/security-... [3] https://www.commoncriteriaportal.org/pps/ https://www.commoncriteriaportal.org/pps/ [4] https://www.commoncriteriaportal.org/files/ppfiles/PP_OS_V4.2.1.pdf https://www.commoncriteriaportal.org/files/ppfiles/PP_OS_V4.... [5] https://www.commoncriteriaportal.org/files/ppfiles/PP_OS_V4.2.1.pdf https://www.commoncriteriaportal.org/files/ppfiles/PP_OS_V4.... Page 53 [6] https://www.commoncriteriaportal.org/files/epfiles/2022-21-INF-3955.pdf https://www.commoncriteriaportal.org/files/epfiles/2022-21-I... Page 14
- matheusmoreira 3y ago
  What exactly are moderate and advanced attackers? The documents cited only seem to go up to the "enhanced basic level" you mentioned which is penetration testing with public vulnerability search.

deleted 3y ago

[deleted]

midoridensha 3y ago

>That's insane for a company the size of Microsoft. Why? Why does company size have anything at all to do with the security of their product? Microsoft has been making shoddy, horribly insecure products for decades now. Do you need me to list all the email viruses and other such things that were running rampant in the 90s and 2000s? What's truly insane is that people keep expecting Microsoft to do better, and then being disappointed when they don't. The common saying is "the definition of insanity is doing the same thing and expecting a different result", and that's exactly what most people do in regards to Microsoft and product quality or security.

insanitybit 3y ago
> Why? Why does company size have anything at all to do with the security of their product? Because they have a massive security team. Size has a lot to do with security. > What's truly insane is that people keep expecting Microsoft to do better, and then being disappointed when they don't. Microsoft has done a ton of impressive security work when it comes to Windows, they've really stepped up their game. They've invested quite heavily.
- devwastaken 3y ago
  More cooks ensures you get the same terrible burger in triplicate.
  - insanitybit 3y ago
    No. Security teams need staff.
bagacrap 3y ago
Size is correlated with resources. Microsoft should have the resources to throw at this problem. Unfortunately the Microsoft approach to software engineering is to set a bunch of monkeys loose on a room full of keyboards, rather than to spend their considerable resources vying for top talent. (Obviously they do have some good engineers, no offense if you're one of them, it's simply that from my sample size of 5, 80% were just warm bodies with email access.)
- dreamcompiler 3y ago
  Of course they have the resources. What they don't have is the incentives to do better. Just like every other big company that has a breach, they are not punished when they ignore basic security and they are not rewarded for paying attention to it. In fact they are punished by Wall Street for paying attention to it, because that costs money. As long as all they have to do is say "Whoops! We're sorry" when a breach happens, we should expect breaches to be the norm for all big companies.
  - insanitybit 3y ago
    They definitely have the incentives. This conversation is a good example of that. Azure is attempting to compete in an aggressively competitive market and their customers absolutely care about security.
  - bagacrap 3y ago
    Hopefully a news item as large as this one will cause them to lose some contracts, at least at the margin.
    - hulitu 3y ago
      You expect too much from Sales and CIOs/CEOs. Most of them have no idea what this is, but they make the decision to buy SW products.
  - BLKNSLVR 3y ago
    > Of course they have the resources. What they don't have is the incentives to do better. Off-topic: this is exactly the same reason that Google offers up ads for scams and ads containing or linking to malware on their own advertising network. The only way to get to the size of these companies is to scale what can be scaled, and damn the rest until the pigeons come home to roost. Which, if they play their political-donation cards right, won't happen. And if it does, jeez they've made bank in the meantime, and will Goodhart the shit out of whatever watered-down legislational changes may make their way through.
nvy 3y ago
>Why? Why does company size have anything at all to do with the security of their product? Because they have the money to hire people who know what they're doing, though it seems they are having difficulty selecting the right candidates.
- midoridensha 3y ago
  Google has the money to hire customer service representatives for customers to call when they have a problem, but they don't do so, because it's not a priority for them. It's the same with Microsoft and security.
  - nvy 3y ago
    Yes, and Google rightly gets criticized for it. Microsoft is getting the same treatment for being equally shitty.
    - midoridensha 3y ago
      Right, and how is this helping? Yes, Google gets criticized for not having any customer service. So... what? Has this affected Google's profitability one iota? No. Same with MS.
      - nvy 3y ago
        I don't understand your objective in this conversation. Are you trying to argue it's okay that Microsoft is incompetent, because Google also has bad customer service? Or that we shouldn't criticize Microsoft's awful security practices because it's "not their priority"?
sublinear 3y ago
> "the definition of insanity is doing the same thing and expecting a different result" This is a nitpick, but it's often completely reasonable to expect a different result by doing the same thing. Nothing against what you wrote, I just hate this saying so much. It's usually wrong to assume things are context-free. Most of life is defined by routine. Erosion carved out the surface of the earth, breathing and eating keeps you alive, etc. At some point the definition of "same" comes under scrutiny and you will find that it's impossible to truly do the exact same thing more than once, and yet even if it was possible you might still get a different result because other things you had no control over changed. Entropy makes it all just so.
- midoridensha 3y ago
  Well, I think the saying kinda implies that the conditions are the same. Obviously, common sense dictates that doing the same thing when conditions are radically different can yield different results. (For instance, taking a deep breath is usually good for you. But doing so underwater is obviously not.) Of course, this then leads to an argument over how the conditions differ in the example where the saying is used, like with MS here.
  - benterix 3y ago
    Well, practically speaking the conditions are never the same in the course of action. If you are trying to break something, for example, at first you don't succeed but in the end, after repeating the same action again and again, you finally do.

prepend 3y ago

Remember when cosmosdb users could read other users databases? [0] It was so boneheadedly stupid, it was like a sysadmin making all user directories readable by all users. Not sure how that would not be tested. And made me worry about what other vulnerabilities lurk in Azure. [0] https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough https://www.wiz.io/blog/chaosdb-explained-azures-cosmos-db-v...

insanitybit 3y ago
The vulns from wiz were so bad I basically wrote off Azure that day. And not bad like 'impact is high', bad like 'did anyone in your massive security org actually look at this?'.
- chayesfss 3y ago
  [dead]

sylens 3y ago

I get the general sense that Azure is a frankenstein of a bunch of services they had built before as well as some that were formerly internally used, and have since been published/scaled up for customers Nothing seems to have been designed to naturally fit together, everything feels like its glued on

minedwiz 3y ago
Hey, don't forget acquired companies' codebases awkwardly shoehorned into being an Azure RP.
FreshStart 3y ago
It's funny, cause liability can scale, so if all of this can be hacked and will be hacked, the lawsuits by companies will bury Microsoft?
hulitu 3y ago
> Nothing seems to have been designed to naturally fit together, everything feels like its glued on This is a trademark of Windows since the beginning.

Veserv 3y ago

Microsoft certifies to the government that they can not protect against moderately skilled attackers via their Common Criteria certifications as seen on their security homepage [1][2]. These are the only security certifications they mention on that page (FIPS is also mentioned, but it is more of a crypto certification than a security certification). They specifically certify that they only conform to EAL1 [3][4] which only requires AVA_VAN.1 which is the ability to protect against attackers with a "Basic attack potential" [5]. The evaluation methodology required by AVA_VAN.1 can be seen on their certification report [6]. Effectively, they do a Google search for "Windows CVE" then they check that all the search results are patched. That's it. I am not joking. That is how they certify security. I am not joking. Seriously. To be fair, Microsoft has historically certified to conform to EAL4 which requires AVA_VAN.3 which is the ability to protect against "Enhanced basic" attackers and includes a actual penetration test. However, despite decades of attempts, they have never once successfully certified any product against AVA_VAN.4 which is the ability to protect against "Moderate" attackers. They have literally never once been able to protect against "Moderate" attackers. And they have the certifications to prove that they absolutely, positively, can not. It is the height of idiocy that anybody listens to or trusts anything that Microsoft says at all about security. The have literally certified that the height of their ability is abject incompetence and the total inability to protect against "moderately" skilled attackers. Until they can definitely prove and certify otherwise, their claims of security should be completely ignored as the useless trash that it is. [1] https://learn.microsoft.com/en-us/windows/security/ https://learn.microsoft.com/en-us/windows/security/ [2] https://learn.microsoft.com/en-us/windows/security/security-foundations/certification/windows-platform-common-criteria https://learn.microsoft.com/en-us/windows/security/security-... [3] https://www.commoncriteriaportal.org/pps/ https://www.commoncriteriaportal.org/pps/ [4] https://www.commoncriteriaportal.org/files/ppfiles/PP_OS_V4.2.1.pdf https://www.commoncriteriaportal.org/files/ppfiles/PP_OS_V4.... [5] https://www.commoncriteriaportal.org/files/ppfiles/PP_OS_V4.2.1.pdf https://www.commoncriteriaportal.org/files/ppfiles/PP_OS_V4.... Page 53 [6] https://www.commoncriteriaportal.org/files/epfiles/2022-21-INF-3955.pdf https://www.commoncriteriaportal.org/files/epfiles/2022-21-I... Page 14

matheusmoreira 3y ago
What exactly are moderate and advanced attackers? The documents cited only seem to go up to the "enhanced basic level" you mentioned which is penetration testing with public vulnerability search.