Microsoft AI researchers accidentally exposed terabytes of sensitive internal data, including private keys and passwords, while publishing an open-source training data repository on GitHub.
The involuntary exposure of this information could have allowed anyone with access to the URL to manipulate, delete, or inject malicious content into the exposed data.
Terrible Microsoft security flaw exposes sensitive information
In an investigation, cloud security startup Wiz said it discovered a GitHub repository belonging to Microsoft's AI research division as part of its ongoing work on the accidental exposure of cloud-hosted data.
Readers of the GitHub repository, which provided open-source code and AI models for image recognition, were instructed to download the models from an Azure storage URL. However, Wiz discovered that this URL was configured to grant permissions across the entire storage account , inadvertently exposing additional private data.
What was in the exposed Microsoft data?
This information included 38 terabytes of sensitive data , with personal backups from two Microsoft employees' personal computers. The data also contained other confidential personal information , such as Microsoft service passwords, secret keys, and more than 30,000 internal Microsoft Teams messages from hundreds of Microsoft employees.
The URL, which had exposed this data since 2020, was also misconfigured to allow "full control" instead of read-only permissions, according to Wiz, meaning anyone who knew where to look could potentially delete, replace, and inject malicious content into them.
Wiz notes that the storage account wasn't directly exposed. Instead, Microsoft's AI developers included an overly permissive Shared Access Signing (SAS) token in the URL . SAS tokens are a mechanism used by Azure that allows users to create shareable links that grant access to data in an Azure storage account.
Conclusion
The Microsoft AI researchers incident highlights the need to implement more rigorous security measures when handling large amounts of data.
Users should also be aware of the risks associated with accidental data exposure and take steps to protect their personal information.
On the other hand, this incident also highlights the potential harm that can occur when sensitive data is accessed by unauthorized individuals. It is important that companies and developers implement appropriate security controls to prevent the exposure of confidential data.
