{"id":42388,"date":"2021-08-27T09:28:04","date_gmt":"2021-08-27T09:28:04","guid":{"rendered":"http:\/\/icloud.pe\/blog\/?guid=95d661da83c156eaa104140dedb1d48e"},"modified":"2021-08-27T09:28:04","modified_gmt":"2021-08-27T09:28:04","slug":"microsoft-azure-flaw-exposed-thousands-of-customer-databases","status":"publish","type":"post","link":"https:\/\/icloud.pe\/blog\/microsoft-azure-flaw-exposed-thousands-of-customer-databases\/","title":{"rendered":"Microsoft Azure flaw exposed ‘thousands’ of customer databases"},"content":{"rendered":"


\n Bobby Hellard<\/a><\/span>
\n <\/span><\/p>\n

\n
\n
27 Aug, 2021<\/span><\/div>\n<\/p><\/div>\n<\/div>\n

\n<\/a><\/p>\n

\n

Microsoft<\/a>\u00a0has warned thousands of its Azure cloud customers that their main databases have been compromised.<\/p>\n

The impacted customers included some of the world’s largest companies, according to cyber security researcher\u00a0Wiz<\/a>.\u00a0<\/p>\n

<\/p>\n

\nThe vulnerability is in Microsoft’s\u00a0Azure<\/a>\u00a0Cosmos database and allows intruders to read, change and even delete customer information, according to Wiz. The researchers were able to find keys that control access to databases held by “thousands” of companies.<\/p>\n

The chief technology officer of Wiz, Ami Luttwak, is former\u00a0CTO<\/a>\u00a0of Microsoft’s Cloud Security Group. Her team found the exploit, dubbed ‘ChaosDB’, on 9 August and notified Microsoft on 12 August.\u00a0<\/p>\n

“This is the worst cloud vulnerability you can imagine. It is a long-lasting secret,” Luttwak told\u00a0Reuters<\/em><\/a>. “This is the central database of Azure, and we were able to get access to any customer database that we wanted.”<\/p>\n

IT Pro<\/em>\u00a0has approached Microsoft for comment, but it seems that it cannot change the access keys by itself, according to emails sent by the company to Wiz. The tech giant has reportedly agreed to pay the security researchers $40,000 for finding the flaw and reporting it.<\/p>\n

In the email to customers, Microsoft said it has fixed the vulnerability, adding that there was no evidence the flaw had been exploited: “We have no indication that external entities outside the researcher (Wiz) had access to the primary read-write key,” it said.\u00a0<\/p>\n

This latest disclosure comes just a few months after the SolarWinds hack, where actors suspected to be working for the Russian government\u00a0stole Microsoft’s source code<\/a>\u00a0and caused breaches and issues around the world.<\/p>\n

Exchange email flaws were still cropping up last week, with the US government sending out a warning that customers needed to instal\u00a0patches that were issued months ago because ransomware gangs were now exploiting them.\u00a0 <\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"

Bobby Hellard<\/p>\n

27 Aug, 2021 <\/p>\n

Microsoft\u00a0has warned thousands of its Azure cloud customers that their main databases have been compromised.
\nThe impacted customers included some of the world’s largest companies, according to …<\/p>\n","protected":false},"author":403,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-42388","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts\/42388","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/users\/403"}],"replies":[{"embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/comments?post=42388"}],"version-history":[{"count":1,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts\/42388\/revisions"}],"predecessor-version":[{"id":42389,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts\/42388\/revisions\/42389"}],"wp:attachment":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/media?parent=42388"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/categories?post=42388"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/tags?post=42388"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}