{"id":40329,"date":"2020-01-30T12:24:34","date_gmt":"2020-01-30T12:24:34","guid":{"rendered":"http:\/\/icloud.pe\/blog\/?guid=6003707268fe952e66ef7ffb13ca2505"},"modified":"2020-01-30T12:24:34","modified_gmt":"2020-01-30T12:24:34","slug":"check-point-spots-two-flaws-in-microsoft-azure","status":"publish","type":"post","link":"https:\/\/icloud.pe\/blog\/check-point-spots-two-flaws-in-microsoft-azure\/","title":{"rendered":"Check Point spots two flaws in Microsoft Azure"},"content":{"rendered":"


\n Nicole Kobie<\/a><\/span>
\n <\/span><\/p>\n

\n
\n
30 Jan, 2020<\/span><\/div>\n<\/p><\/div>\n<\/div>\n

\n<\/a><\/p>\n

\n

Check Point security researchers spotted flaws in Microsoft Azure<\/a> that could have let hackers take control over the cloud servers.<\/p>\n

The work was part of a wider project looking at cloud infrastructure, dubbed “Attack the Cloud”, in which Check Point wants to “break the assumption that cloud infrastructures are secure”.<\/p>\n

With Microsoft Azure, the researchers spotted two flaws. The first was in Azure Stack, and could have let criminals take screenshots or see other sensitive information by taking advantage of a vulnerability in the “DataService” function, which didn’t require authentication.<\/p>\n

“This security flaw would enable a hacker to get sensitive information of any business that has its machine running on Azure,” the researchers said. “In order to execute the exploitation, a hacker would first gain access to the Azure Stack Portal, enabling that person to send unauthenticated HTTP requests that provide screenshots and information about tenants and infrastructure machines.”<\/p>\n

The second flaw was in the Azure App Service, where businesses provision and deploy apps and business processes, and could have allowed hackers to take control of a server.<\/p>\n

“The end result would be that a hacker could potentially take control over the entire Azure server, and consequently take control over all your business code,” the researchers said.<\/p>\n

The researchers could get into applications, see data and take over accounts by creating a free user in Azure Cloud and running malicious functions.<\/p>\n

“Exploiting this vulnerability in all of the plans could allow us to compromise Microsoft\u2019s App Service infrastructure,” the researchers explain. “However, exploiting it specifically on a Free\/Shared plan could also allow compromising other tenant apps, data, and account.”<\/p>\n

Check Point disclosed the findings to Microsoft in January<\/a> and June last year<\/a>, with patches for both issued at the end of 2019. The first flaw was awarded $5,000 from Microsoft’s bug bounty programme; the second earned $40,000.<\/p>\n

The researchers emphasised in a report on the second flaw that while the cloud is “considered safe”, it can still have vulnerabilities:\u00a0“The cloud is not a magical place.” <\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"

Nicole Kobie<\/p>\n

30 Jan, 2020 <\/p>\n

Check Point security researchers spotted flaws in Microsoft Azure that could have let hackers take control over the cloud servers.
\nThe work was part of a wider project looking at cloud infrastru…<\/p>\n","protected":false},"author":414,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-40329","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts\/40329","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/users\/414"}],"replies":[{"embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/comments?post=40329"}],"version-history":[{"count":2,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts\/40329\/revisions"}],"predecessor-version":[{"id":40374,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts\/40329\/revisions\/40374"}],"wp:attachment":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/media?parent=40329"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/categories?post=40329"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/tags?post=40329"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}