Office365 users shared hundreds of sensitive docs publicly through docs.com

I don't get it. It's a site designed for public sharing -- the word "showcase" is right on the front page, as username223 points out. I just loaded it up and walked through uploading a file to it. It's incredibly explicit about what it's doing. Under "Visibility," it says:

"Public on the web Anyone can find it on the web. Search engines will find the doc, giving it a larger audience."

It's not unambiguous. It's very clear. The only way you can't tell what it's doing is if you just pay no attention whatsoever to what you're doing. It's not the default sharing method from either Office 365 (web, traditional or Android/iOS) or OneDrive. You have to opt into using it at all at an IT department level if you have a corporate Office 365 department. You really just can't stop users from footgunning themselves when they're on the open Internet.

Microsoft clearly made this to be a Scribd alternative. O365 defaults to private sharing everywhere. To quote from the article, "Office 365 and Azure Tenant administrators must 'opt-in' to enable users with organizational accounts to use the service".

On https://docs.com/docscom the description of the service is "Docs.com by Microsoft is an Internet site for publishing Office documents that anyone can find, browse, and share". The only way this could be clearer is if the word 'anyone' was changed to 'anyone in the world'.

Finally, (for some license types) O365 offers precisely the kind of DLP capabilities that would let users use such a service while blocking the sharing of SSN's etc.

For business accounts, not only has someone actively turned on this capability, they have then failed to communicate its purpose to users. The users themselves have then failed to understand what they were doing.

I'm sorry, but while I can sympathise with people this is clearly not MS' problem.

For the record, my current employer (a university) has not enabled this function.

It does say right on the front page: "Showcase and discover Microsoft Word, Excel, PowerPoint, OneNote, Sway, Minecraft world and PDF documents for free," so it's pretty clearly intended for public distribution of e.g. document templates. On the other hand, how on earth did MS release it and let it live without noticing that people were using it completely wrong? They should have quickly noticed that people were using it to exchange sensitive documents, then pulled the service and redesigned it so that sort of behavior became exceedingly rare.

Even sophisticated users will misuse these services: remember the fad of putting all your dot-files on Github, when a bunch of people uploaded their Amazon credentials? This is giving the same opportunity to much less sophisticated users, with predictable results.

I understand people may want to upload documents for sharing by link for example, but its obviously not clear enough to users that their documents can be searched by anyone and MS is even providing a document search with OCR it seems.

I doubt these people intended to share, in a publicly searchable form, copies of their tax forms, passports, medical records, client lists, etc.

It's easy to call the users careless or stupid, but that expectation should've been baked into the product. For a document to be indexed and publicly searchable should be an explicit setting, not a default.

I dont understand why docs.com even has a search bar in the first place?

Apart from a "direct link" - who would want to go to docs.com and search for a topic?

I've been able to find lots of interesting documents searching for some medical, business and financial terms. There must be thousands if not tens of thousands of sensitive documents available...

In many ways the real story here is that the cloud makes certain kind of shortcuts thats incredibly common in aggressive organizations where "does" are promoted over "critics" exponentially more likely to lead to serious negative consequences.

In the past an insecure shortcut was a unsecured and unaudited consumer grade network-share sitting somewhere on a lan, today it and Internet facing cloud service designed for publication used to collaborate on "internal only" document that should not even have been viable to the entire company.

It's not that the cloud is "insecure" but that it makes it way to easy for those who should not make IT decisions to turn to shadow IT solutions in order to avoid having to adhere to cumbersome bureaucratic processes and corporate governance frameworks and "get stuff done".

Facebook sneaked in Docs.com to all Facebook users due to a deal with Microsoft (they bought 2% of the shares around the same time). So back then, one had to search through the mess of Facebook settings only to deactivate Docs.com. Otherwise users uploaded Office documents got shared with Docs.com for friends and the internet. Facebook had some simple note taking and user pages feature that allows uploading Office docs back then. I wouldn't be surprised if these old files still somewhere online even after the repurposed and their service.

https://en.wikipedia.org/wiki/Docs.com

> No results found for 1040 donald trump site:docs.com.

Dammit.

Apart from whether "publicly searchable" should be an explicit / implicit setting, this seems like something that could also largely be mitigated with some simple keyword flags. Words like "SSN" or "confidential" or the like are probably good indicators that this doc shouldn't have been shared and something that requires an extra approval dialog. That keyword list could also be something you'd expand over time and could use to retroactively remind users that they might have inadvertently shared something they shouldn't have.

I think it's hard to say how well this was communicated to the public without knowing the total amount of users of the service. Maybe 99.99% of people did NOT upload public documents by mistake. Maybe only 95%. Depends on how many documents are safely private.

Searching for "1099" brings up quite a few interesting documents

#OfficeBleed anyone?

Ouch. That seems pretty egregious. I would hope that Microsoft would at least make 'public' sharing the thing you would have to select and authorize rather than making it the default. But apparently that wasn't the choice here.

Shameless plug: I'm working on a private (encrypted) alternative to Google Docs & Office 365: https://www.airbornos.com.

So Microsoft is still mediocre security-wise, despite all of those people claiming the company has been reinvented?

I can belive the reinvented claim (that's the kind of thing a new, good CEO can influence), but quality goes very deep, into each employee. Any one hire can screw up fatally. It takes a lot of hard work to build a security conscious culture/company hierarchy.

(Edit: Hello Redmond people!)