Hacker News Reader

Comment by JohnMakin | Hacker News Reader

article mentions them "spidering into an azure tenant." Wonder if that's related to the azure multi tenancy misconfiguration that resulted in the Bing CMS being accessed that was brought up a few times here recently:

https://news.ycombinator.com/item?id=35363205

View on HN

Fwiw, the finder here is not completely correct in their assertions. Locking the Bing CMS down to single tenancy would have meant that instead of the whole world having access, only about 180,000 Microsoft employees would have access. The actual number of people who should have access is about 50. Maybe 500 the way Bing is bloated. The problem here is that Bing CMS didn't implement the authorization half of authentication and authorization - they simply allowed all authenticated users to access all data. Multi-tenancy expands the scope, but it's not really clear what portion of the 25% of apps the finder surveyed that were multi-tenant similarly lack any authorization whatsoever.

Very common to get access to the Azure/Local AD in ransomware attacks.

That Bing CMS bug was only exploited by the researchers who disclosed it to MS.

I'm not saying it's literally the same attack, but the author of that Bing CMS bug identified the cause (misconfigured multi tenancy) and said up to 25% of Azure apps they scanned had this same vulnerability.

Is OpenAI at risk with MS deal?

if someone hasn't stolen GPT-4's weights yet, they're definitely trying

I wonder what their personnel vetting processes are like. That would be my first worry.

Reply on news.ycombinator.com