Microsoft left a server containing confidential information open to the 4 winds (and without a password)

A server of Microsoft’s cloud service, Azure, suffered a breach which simply made the information it held accessible to everyone. Flaw which has since been corrected. But that could hurt.

The Azure service has suffered attacks in recent years that have damaged the reputation of this cloud giant, owned by Microsoft. To strengthen its security, the Redmond firm announced at the end of last year its intention to use AI to shield Azure’s defenses. But if the American giant has surely become less vulnerable to external attacks in this way, it is not immune to internal failures.

An unprotected Azure storage server

This is a nice hare that the cybersecurity company SOC Radar recently raised. It has in fact identified a security flaw in an Azure server which made public, without even password protection, information linked to the in-house search engine Bing. As a result, anyone could open the door and use the available information.

And the server in question stored a lot of information, ranging from code to scripts. More annoying, it also had configuration files in which you could find passwords and credentials opening access to other Microsoft databases.

A flaw that could hurt?

Suffice to say that the risk that this flaw allows subsequent attacks seems high. SOC Radar indicates that it informed Microsoft of the problem on February 6, while Microsoft would have completed correcting the problem on March 5.

On the side of the American firm, we are obviously trying to minimize the incident. “ Although the credentials should not have been exposed, they were temporary, accessible only from internal networks, and disabled after testing. We thank our partners for reporting this issue responsibly » explained to Techcrunch one of the sector managers at Microsoft, Jeff Jones.

However, the same media also interviewed one of the researchers behind the discovery, Can Yoleri. And for the latter, the flaw “ could lead to larger data leaks and possibly compromise the services used. »Who will be right?

Source : Techcrunch