Skip to main content

This mega Microsoft security flaw could let hackers change Bing results, access Outlook emails

Web Hosting & Remote IT Support

Microsoft has patched a high-severity vulnerability in its Bing search engine, which allowed potential threat actors to not only alter search results, but also access people’s Office 365 data.

Cybersecurity researchers from Wiz discovered the flaw in January 2023, identifying it as a misconfiguration in the Azure Active Directory (AAD) identity and access management service in Microsoft's Azure cloud platform.

Asides from changing search engine results, the flaw could allow access to other people’s Office 365 data, such as Outlook emails, calendars, Teams messages, OneDrive files, and more.

A common occurrence

Some applications on Azure can use multi-tenant permission, and thus be accessible by any Azure user. That means developers need to set up a way to validate users and keep tabs on who gets to access what. According to The Verge, this is where many get it wrong, as misconfigurations in this respect are “a common occurrence.” Wiz says 25% of all multi-tenant apps it scanned did not have good validation.

This is exactly what happened to Bing Trivia, and that allowed the researchers to log in with their own Azure accounts. Once logged in, they were granted access to a content management system (CMS) which let them alter live search results from Bing. The researchers said that they didn’t do anything spectacular here - anyone who knew how to reach the Bing Trivia page could have done the same.

Read more

> Nearly all firms have some kind of cloud misconfiguration issue

 > Many data breaches are being caused by misconfigured clouds

 > Here's our list of the best endpoint security software

Besides altering search engine results, the researchers also discovered they were given access to other people’s Office 365 data, such as Outlook emails, calendars, Teams messages, OneDrive files, and more. The researchers tested it out on a mock email inbox and confirmed the vulnerability. But the vulnerability’s reach doesn’t end here - there are more than 1,000 apps and websites on Microsoft cloud that had similar abusable misconfigurations, such as Mag News, PoliCheck, Cosmos, and more.

“A potential attacker could have influenced Bing search results and compromised Microsoft 365 emails and data of millions of people,” Ami Luttwak, Wiz’s chief technology officer, told The Wall Street Journal. “It could have been a nation-state trying to influence public opinion or a financially motivated hacker.”

Microsoft was tipped off on January 31, and by March 20, addressed the vulnerability entirely. The researchers did not find any evidence of prior abuse.

Via: The Verge



via Hosting & Support
Labels:

Comments

Post a Comment

Web Hosting
Remote IT Support
Sites & Socials

Popular posts from this blog

The Samsung Galaxy Ring could go into production as soon as next month

Web Hosting & Remote IT Support With the dust beginning to settle from the huge Samsung Unpacked 2023 event, we can turn our attention towards what Samsung might have planned next: and a smart ring seems to be in the company's near future. As per a report from South Korean outlet The Elec (via SamMobile ), mass production on a Samsung Galaxy Ring could begin as early as August, with a decision imminent on the schedule for getting the wearable manufactured and out to consumers. A full launch is slated for some point during 2024 though, rather than 2023. The nature of the device means that it'll need to clear several regulatory hurdles before it can go on sale and start tracking various vital statistics. An early 2024 launch would put the Galaxy Ring on a similar schedule to the Samsung Galaxy S24 – and it would therefore make sense to launch both gadgets at the same time, perhaps in January or February if Samsung follows its 2023 routine. The story so far Rumors ar...
Post a Comment
Read more

The Apple Watch ban is lifted, on appeal – but the reprieve might only be temporary

Web Hosting & Remote IT Support The Apple Watch ban story has developed quickly over the last week and a bit, and there's now a new twist: the US Court of Appeals is putting a pause on the US sales and import ban while it reviews the case, which means the Apple Watch 9 and Apple Watch Ultra 2 can go back on sale for the time being. "We are thrilled to return the full Apple Watch lineup to customers in time for the new year," an Apple spokesperson told TechRadar. "We are pleased the US Court of Appeals for the Federal Circuit has stayed the exclusion order while it considers our request to stay the order pending our full appeal." The watches in question are now once again available from "select" Apple Stores, and will also be going on sale from the Apple website from 12pm PT / 3pm ET on Thursday, December 28 (that's 8pm in the UK, and early on December 29 in Australia). All Apple Stores should have stock by the weekend. As for how long t...
Post a Comment
Read more

These mobile games are just trying to steal your crypto hoard, FBI warns

Web Hosting & Remote IT Support The FBI has warned consumers about a newly-detected, fake "play-to-earn" mobile and online game that tricks victims into depositing cryptocurrency, only to later steal it.  In a public service announcement , the FBI said the elaborate scheme sees scammers first contact the potential victim and try to build a relationship with them.  After a little back-and-forth, the scammers would invite the victim to play an online or mobile game, in which players purportedly earn cryptocurrency rewards in exchange for some activity, “such as growing ‘crops’ on an animated farm” the FBI said.  Depositing cryptos But getting into the “game” isn’t free - the victims must first create a cryptocurrency wallet and deposit some money, which is where the real scam begins. The fraudsters would later also tell the victims that the more funds they deposit, the higher the gains will be. However, as soon as the victim stops depositing additional funds, the...
Post a Comment
Read more