In recent months, concerns have been raised about the security and vulnerability of Microsoft’s Azure platform. The CEO of an esteemed cybersecurity company, Yoran, has added fuel to the fire, claiming that his company discovered a serious issue with Azure in March 2023, and it took Microsoft more than 90 days to implement a fix. This article aims to delve into the details of the discovered vulnerability, highlight the lack of transparency and security practices from Microsoft, discuss the ongoing vulnerability, examine the impact on customers, analyze Microsoft’s response, present historical data on vulnerabilities, discuss additional industry support, and address calls for accountability.
The Discovered Vulnerability
The vulnerability discovered in the Azure platform was indeed alarming. It would allow an unauthenticated attacker to access cross-tenant applications and sensitive data, including authentication secrets. This means that unauthorized individuals could potentially infiltrate the systems of multiple tenants, posing severe risks to data privacy and security.
Lack of transparency and security practices
Yoran has loudly criticized Microsoft for their lack of transparency and irresponsible security practices. He claims that breaches, security flaws, and vulnerabilities are downplayed or undisclosed, leaving customers unaware of the risks they face. This lack of transparency not only exposes businesses to potential breaches but also prevents customers from making informed decisions about risk mitigation.
Ongoing vulnerability
What is even more concerning is that the reported vulnerability still persists more than 120 days since it was first reported. Despite being made aware of the issue, Microsoft’s delayed response and sluggish actions have left a bank, among other tenants, vulnerable to potential attacks. This disregard for timely mitigation and resolution puts not only the affected bank but other customers at further risk.
Customer impact
The lack of transparency and delayed fixes by Microsoft have had a significant impact on customers. They are left uninformed and unable to make informed decisions to protect their data, systems, and customers. Without proper knowledge of the vulnerabilities and risks, businesses are unable to adequately address potential threats or take appropriate measures for risk mitigation.
Microsoft’s response
Microsoft’s response to the reported vulnerability has been met with criticism. They claim that they will fix the issue by the end of September, four months after being notified. Such a slow response is deemed grossly irresponsible if not blatantly negligent. Waiting for months to address a critical vulnerability leaves businesses and their customers in a state of heightened vulnerability and uncertainty.
Historical data on vulnerabilities
Yoran brings attention to data from Google Project Zero, revealing the significant share of zero-day vulnerabilities discovered in Microsoft products since 2014. Microsoft products accounted for an aggregate of 42.5% of all zero-day vulnerabilities discovered in this timeframe. This data raises concerns about the broader security practices and architecture of Microsoft products and platforms.
Additional industry support
The concerns raised by Yoran have found support in the industry, with George Kurtz, CEO and Founder of CrowdStrike, echoing the sentiments. Kurtz asserts that Microsoft’s architecture puts customers at risk and places blame on the victims when the inherent flaws in their systems are exposed. This additional support highlights the widespread worry surrounding Microsoft’s security practices.
New attack vector discovered
Further aggravating concerns, Vectra Research has identified a new attack vector against Azure Active Directory. This discovery suggests the possibility of lateral movement to other Microsoft tenants, increasing the potential reach and impact of an attack. With each new vulnerability discovered, the need for Microsoft to promptly and effectively address these issues becomes even more urgent.
Calls for accountability
The seriousness of the situation is underscored by a letter addressed to the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Justice, and the Federal Trade Commission (FTC) from Senator Ron Wyden. In the letter, Wyden holds Microsoft accountable for negligent cybersecurity practices that have enabled Chinese espionage against the United States government. This call for accountability highlights the need to address the systemic issues within Microsoft’s security practices.
The concerns raised about Microsoft’s Azure platform vulnerability, transparency, and security practices cannot be ignored. CEO Yoran’s claims, the ongoing vulnerability, and the support from industry leaders like George Kurtz reinforce the need for Microsoft to take prompt and effective action. Customers deserve transparency, timely fixes, and a commitment to robust security practices. As the digitization of business continues to grow, it is imperative that Microsoft prioritizes the security and privacy of its customers to maintain their trust and mitigate potential risks.