According to a copy of the email and a cyber security researcher, Microsoft warned thousands of its cloud computing customers, including some of the world's largest organizations, that intruders might read, update, or even delete their major databases. Researchers uncovered a "serious" vulnerability in Cosmos DB, a Microsoft Azure flagship database product, that allows an attacker to read, write, and remove data from Cosmos DB customers.
Microsoft's proprietary database service Cosmos DB was launched in 2017 and is offered through the tech giant's cloud computing platform Azure. Coca-Cola, ExxonMobil, and Schneider Electric are just a few of the world's major organizations that utilize it to manage their data. Many of Microsoft's own programmes, such as Skype, Xbox, and Office, use Cosmos DB.
Wiz's research team realized it was possible to gain access to keys that controlled access to databases owned by tens of thousands of companies. Ami Luttwak, Wiz's Chief Technology Officer, was previously the CTO of Microsoft's Cloud Security Group. Because Microsoft is unable to alter those keys on its own, consumers were emailed on Thursday and were told to create new ones. According to an email from Microsoft to Wiz, the company promised to pay them $40,000 for discovering and reporting the flaw.
Wiz, which was founded by ex-Microsoft workers, identified the flaw on August 9, 2021. Three days later, the cybersecurity firm notified Microsoft about the problem. Microsoft's security teams disabled the vulnerable feature within 48 hours, according to Wiz.
There was no evidence that the flaw had been exploited, according to Microsoft's notification to customers. The email stated, "We have no indication that external entities other than the researcher (Wiz) had access to the primary read-write key."
“This is the worst cloud vulnerability you can imagine. It is a long-lasting secret,” Luttwak told Reuters. “This is the central database of Azure, and we were able to get access to any customer database that we wanted.” Even clients who have not been contacted by Microsoft may have had their keys swiped by attackers, giving them access until their keys are changed, according to Luttwak.
The flaw was found in Jupyter Notebook, a visualization tool that has been available for years but was only enabled by default in Cosmos in February.
Microsoft has been plagued by bad security news for months. The same alleged Russian government hackers who entered SolarWinds and stole Microsoft source code broke into the company. Then, while a patch was being created, a large number of hackers got into Exchange email servers.
