Microsoft has resolved a security flaw that exposed internal files and credentials to the open Internet.
Security researchers Can Yoleri, Murat Özfidan, and Egemen Koçhisarlı worked with SOCRadar, a cybersecurity company that helps organizations find security weaknesses, to find out which stores internal information related to Microsoft's Bing search engine. We discovered an open public storage server hosted on Microsoft's Azure cloud service.
Azure storage servers stored code, scripts, and configuration files containing passwords, keys, and credentials used by Microsoft employees to access other internal databases and systems.
However, the storage server itself was not password protected and could be accessed by anyone on the Internet.
Yoleri told TechCrunch that the leaked data could help malicious actors identify or access other locations where Microsoft stores internal files. . Identifying these storage locations “could result in a more significant data breach and compromise of the services you use,” Yorelli said.
The researchers notified Microsoft of the security revocation on February 6th, and Microsoft secured the leaked files on March 5th.
It's unclear how long the cloud servers were exposed to the internet or whether anyone other than SOCRadar discovered the exposed data inside. A Microsoft spokesperson contacted us via email, but did not respond to a request for comment at the time of publication. Microsoft did not say whether it had reset or changed any exposed internal credentials.
This is the latest security lapse as Microsoft seeks to rebuild trust with customers after a series of cloud security incidents in recent years. In a similar security lapse last year, researchers discovered that a Microsoft employee had exposed his corporate network logins in code published on his GitHub.
Microsoft admitted last year that it does not know how Chinese-backed hackers stole internal email signature keys that gave the hackers broad access to Microsoft-hosted inboxes of U.S. government officials. He was criticized for this. An independent panel of cyber experts tasked with investigating the email breach said in a report released last week that the hackers were successful because of “a series of security failures at Microsoft.”
Microsoft said in March it was continuing efforts to combat an ongoing cyberattack that allowed Russian state-backed hackers to steal some of the company's source code and internal emails from Microsoft executives. Announced.