wordpress blog stats
Connect with us

Hi, what are you looking for?

Microsoft Azure customers warned about critical security flaw that exposed data to hackers

The cloud platform’s users were advised to take urgent steps against a security flaw that had existed for months.

We missed this earlier: The Indian Computer Emergency Response Team (CERT-In) issued an advisory on August 27, warning against a critical security vulnerability in Microsoft Azure’s cloud platform Cosmos DB. According to the advisory, a vulnerability in open-source platform Jupyter Notebook – used for data sharing and visualisation on Cosmos – exposed primary keys of users (which are used for administrative purposes to manage user accounts, according to a Microsoft webpage), potentially giving an attacker admin access to data stored by affected accounts.

According to CERT-In, the vulnerability could allow a hacker unrestricted access to download, delete, or manipulate any user data stored on the Cosmos DB platform.

Earlier this year, Microsoft had reportedly turned the Jupyter Notebook feature on by default for all Cosmos DB instances, including those by Fortune 500 companies Exxon Mobile and Coca-Cola. A day before the CERT-In advisory, Microsoft notified 30% of its customers who may have been impacted by the breach, Reuters reported. Cloud security firm Wiz.io who first alerted Microsoft about the issue, said that the vulnerability had existed for a few months before it was flagged and may have impacted all customers. Here’s an illustration of the vulnerability:

https://chaosdb.wiz.io/img/diagram.gif

Source: Wix.io

Microsoft asks customers to reset keys

On August 26, according to a Wix.io blog, Microsoft mailed its customers the following statement:

Microsoft has recently become aware of a vulnerability in Azure Cosmos DB that could potentially allow a user to gain access to another customer’s resources by using the account’s primary read-write key. This vulnerability was reported to us in confidence by an external security researcher. Once we became aware of this issue on 12 August 2021, we mitigated the vulnerability immediately.

We have no indication that external entities outside the researcher had access to the primary read-write key associated with your Azure Cosmos DB account(s). In addition, we are not aware of any data access because of this vulnerability. Azure Cosmos DB accounts with a vNET or firewall enabled are protected by additional security mechanisms that prevent risk of unauthorized access. Out of an abundance of caution, we are notifying you to take the following actions as a precautionary measure.

After fixing the vulnerability within 48 hours of receiving Wix.io’s report, Microsoft recommended that users regenerate their Cosmos DB Primary Keys through a guide on their website for security.

Advertisement. Scroll to continue reading.

Cybersecurity breaches in recent months

In May, Air India (AI) reported a massive data breach that has compromised the personal details and information of 4.5 million customers.

In July, 1,500 businesses around the world were affected by a ransomware attack centered on U.S. information technology firm Kaseya. Data belonging to 700 million people were reportedly put on sale on the dark web by a hacker who claimed to have obtained them from professional networking site LinkedIn’s application programming interface (API).

In the same month, Tamil Nadu’s Makkal Number, a unique ID being used to tie together all the digital records of citizens of the state, was exposed in a massive data breach.

In August, a LockBit hacker group accessed proprietary data of IT consulting firm Accenture in a ransomware attack. Earlier that month, a hacker reportedly stole confidential data on 100 million T-Mobile users.

Also read:

 

Have something to add? Post your comment and gift someone a MediaNama subscription.

Advertisement. Scroll to continue reading.

Written By

I cover health and education technology for MediaNama. Reach me at anushka@medianama.com

MediaNama’s mission is to help build a digital ecosystem which is open, fair, global and competitive.

Views

News

The US and other countries' retreat from a laissez-faire approach to regulating markets presents India with a rare opportunity.

News

When news that Walmart would soon accept cryptocurrency turned out to be fake, it also became a teachable moment.

News

The DSCI's guidelines are patient-centric and act as a data privacy roadmap for healthcare service providers.

News

In this excerpt from the book, the authors focus on personal data and autocracies. One in particular – Russia.  Autocracies always prioritize information control...

News

By Jai Vipra, Senior Resident Fellow at Vidhi Centre for Legal Policy The use of new technology, including facial recognition technology (FRT) by police...

You May Also Like

Advert

135 job openings in over 60 companies are listed at our free Digital and Mobile Job Board: If you’re looking for a job, or...

News

Rajesh Kumar* doesn’t have many enemies in life. But, Uber, for which he drives a cab everyday, is starting to look like one, he...

News

By Aroon Deep and Aditya Chunduru You’re reading it here first: Twitter has complied with government requests to censor 52 tweets that mostly criticised...

News

Google has released a Google Travel Trends Report which states that branded budget hotel search queries grew 179% year over year (YOY) in India, in...

MediaNama is the premier source of information and analysis on Technology Policy in India. More about MediaNama, and contact information, here.

© 2008-2021 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ

Subscribe to our daily newsletter
Name:*
Your email address:*
*
Please enter all required fields Click to hide
Correct invalid entries Click to hide

© 2008-2021 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ