Microsoft Data Mishap: Accidental Exposure of Terabytes of Sensitive Information
In an era of heightened data security awareness, the accidental exposure of sensitive data remains a recurring concern. Microsoft, a tech giant renowned for its commitment to data protection, recently found itself in an unforeseen predicament.
This incident involved the inadvertent exposure of a staggering 38 terabytes of private data, including confidential information like passwords and internal messages, courtesy of a misconfiguration involving Azure’s Shared Access Signature (SAS) tokens.
In this article, we will delve into the details of this inadvertent data leak, its implications, and the valuable lessons that can be gleaned from this incident.
The Data Leak Unveiled
The discovery of this data leak was made by Wiz Research, shedding light on a situation where Microsoft’s AI research team, while sharing open-source training data on GitHub, accidentally opened the floodgates to a vast repository of private data.
This data treasure trove included a disk backup from two employees’ workstations, harboring sensitive information like passwords for Microsoft services, secret keys, and an astonishing 30,000 internal Microsoft Teams messages originating from 359 Microsoft employees.
Understanding Shared Access Signature (SAS) Tokens
The crux of the problem lay in Azure’s Shared Access Signature (SAS) tokens, a feature designed to enable users to share data from Azure Storage accounts securely. These tokens, in essence, are strings that grant specific access rights to designated Azure Storage resources, such as blobs or a range of blobs. When wielded appropriately, they offer a secure means of data sharing.
However, in this case, an overly-permissive SAS token for an internal storage account was inadvertently shared via a GitHub repository.
The Impact and Potential Consequences
The gravity of this situation extended beyond the exposure of sensitive data. In the wrong hands, this vulnerability could have been exploited to inject malicious code into AI models stored in the affected storage account. This could have led to a cascade of infections, affecting any user relying on Microsoft’s GitHub repository for AI models.
Microsoft’s Swift Response
Upon receiving Wiz’s findings on June 22, 2023, Microsoft promptly took action by revoking the problematic SAS token within two days. Microsoft emphasized that the exposed information was unique to former employees and their workstations, reassuring users that no customer data was compromised, and no other Microsoft services were at risk.
To prevent such incidents in the future, Microsoft has expanded GitHub’s secret spanning service to monitor all public open-source code changes for potential exposure of credentials or secrets, including overly permissive SAS tokens.
Best Practices for SAS Tokens
Microsoft has shared valuable insights into best practices for working with SAS URLs to prevent such incidents in the future. These recommendations include:
- Applying the Principle of Least Privilege
- Using Short-Lived SAS Tokens
- Handling SAS Tokens with Care
- Having a Revocation Plan
- Monitoring and Auditing Applications
Wiz Research also advises against external usage of SAS tokens, citing their complexity and the potential for extended expiration times.
Conclusion
Microsoft’s accidental exposure of terabytes of sensitive data serves as a stark reminder of the importance of robust data security practices in today’s digital landscape. It underscores the need for both individuals and organizations to exercise utmost caution when handling data-sharing mechanisms like SAS tokens.
By learning from this incident and implementing best practices, we can collectively fortify our data defenses and minimize the risk of data breaches in an increasingly interconnected world.
Penetration testing to combat cybersecurity threats
One of the best ways to combat cybersecurity threats in today’s modern time is by conducting regular penetration testing. Remember, if you suffered a data breach under the PDPA, you could be liable for up to a financial penalty of S$1,000,000. Luckily, Privacy Ninja is here to help you check if there are any vulnerabilities in your system.
Privacy Ninja can assist you in this endeavor by providing penetration testing services, which check if your organisation has vulnerabilities that could be exploited by bad actors, whether in your email environment or your organisation in general.
Privacy Ninja has years of experience in cybersecurity and offers quality services, as evidenced by the feedback from its clients as the years go by. It is a licensed VAPT provider (Penetration Testing Service License No. CS/PTS/C-2022-0128) and has the best team of professionals who are experts in their field, leaving no stone unturned in checking for any vulnerabilities in your system or organisation as a whole.
Moreover, we work hand in hand with our clients and deliver results on time, especially when there is a hint of vulnerabilities that need to be checked. Most importantly, Privacy Ninja has a Price Beat Guarantee, which makes the service even more affordable but will not leave the quality of services each client deserves.
What are you waiting for? Choose Privacy Ninja now as your penetration testing partner and experience the quality of services brought to you by cybersecurity experts at an affordable price, Price Beat Guarantee!
0 Comments