Microsoft Azure security flaw left thousands of cloud databases vulnerable to hackers
Thousands of Cosmos DB users on Azure cloud computing may have been affected
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Microsofthas revealed that thousands ofAzureCosmos DB database users may need to update their security protections after a serious flaw was discovered.
Cosmos DB is Microsoft’sdatabaseservice that runs atop its Azurecloud computingplatform, and is used by various Fortune 500 companies all around the world.
Cybersecurityresearchers from cloud infrastructure security companyWizdiscovered a series of flaws in one of the features of the database service, which could be exploited by threat actors to gain complete control over a database, meaning they could read or even delete data.
We’re looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won’t take more than 60 seconds of your time, and we’d hugely appreciate if you’d share your experiences with us.
Click here to start the survey in a new window«
“Every CISO’s nightmare is someone getting their access keys and exfiltrating gigabytes of data in one fell swoop. So you can imagine our surprise when we were able to gain complete unrestricted access to the accounts and databases of several thousand Microsoft Azure customers, including many Fortune 500 companies,”writeWiz’s Nir Ohfeld and Sagi Tzadik in a joint blog post.
Keyless entry
The security researchers note that exploiting the vulnerability, which they’ve named ChaosDB, was “trivial.”
The vulnerability exists in the Jupyter Notebook feature that helps users visualize their data. It was introduced in 2019 and was automatically enabled for all Cosmos DB databases in February 2021.
Without giving out too many details, the researchers note that Jupyter’s implementation gave attackers access to the database’ primary keys and other highly sensitive secrets such as its blob storage access token.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Exploiting these details keys, the researchers were able to access and exercise full read/write/delete control over the database from across the internet.
On being notified by the researchers, Microsoft quickly disabled the vulnerable notebook feature to prevent leaking secrets. The company is also asking a section of its users to rotate their keys to ensure that any keys that have already been exfiltrated by unauthorized users are rendered useless.
According to Reuters, Microsoft’s email highlighted the fact that the company had found no evidence to suggest that the flaw had been exploited.
ViaReuters
With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’sTechRadar Pro’sexpert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.
New fanless cooling technology enhances energy efficiency for AI workloads by achieving a 90% reduction in cooling power consumption
Samsung plans record-breaking 400-layer NAND chip that could be key to breaking 200TB barrier for ultra large capacity AI hyperscaler SSDs
NYT Strands today — hints, answers and spangram for Sunday, November 10 (game #252)
