Security researchers from the firm SOCRadar made a troubling discovery earlier this year - an unprotected Microsoft Azure storage server openly exposing sensitive internal company data.
Upon investigating an anonymous tip, Can Yoleri, Murat Özfidan and Egemen Koçhisarlı located an Azure server containing a treasure trove of Microsoft secrets. Code, scripts, passwords and credentials related to Bing search engine operations were all stored without basic access restrictions.
As the SOCRadar team soon realized, any internet user could freely browse folders housing years of proprietary Microsoft work. Internal databases and systems were also at risk, as employee login credentials were leaked. Yoleri noted that malicious hackers could leverage such a data spill to infiltrate other servers and services.
Alerting Microsoft on February 6th, the researchers hoped for a swift response. However, over a month passed before the damaged was contained on March 5th. In that time, it’s unclear if other threat actors may have stumbled upon the server goldmine.
This followed a string of security failures plaguing the software giant in recent years…
As cloud infrastructure grows, properly securing sensitive data is paramount. Microsoft’s sloppy storage practices contradict their claims of bolstered defenses. While the server is now locked, doubts linger around Microsoft’s ability to learn from mistakes. If preventable data leaks reoccur, customers may lose trust in the company’s commitment to privacy.
Only open communication and strengthened protocols can reassure the public. Microsoft must prove incidents like this will not happen again due to lack of foresight or half-hearted patching afterwards. The future of their cloud business depends on it.
See also: Revisiting Microsoft’s Original Surface, The $10,000 Coffee Table Computer