The research team at vpnMentor, who discovered the data, believes that it belongs to Microsoft as some of the files appeared to originate from a series of pitches made to Microsoft Dynamics
Recently vpnMentor’s research team led by Noam Rotem uncovered a data breach that may presumably be owned by one of the biggest companies in the world; Microsoft.
The breach exposed sensitive internal data that was stored on a misconfigured Microsoft Azure cloud storage account. The data included files that appeared to originate from a series of pitches made to Microsoft Dynamics from numerous companies vying for a project or partnership with the company.
Many of the pitches included the source codes for the software products – some of which were eventually released to the market. This led to the highly sensitive internal data of some well-known companies being exposed and information about their operations and product lines publicly accessible.
SEE: Hacker dumps sensitive household records of 250M Americans
The total size of the data breach is 63GB with a suspected number of files being more than 3,800. The date of the breach being discovered was 7th January 2021 and it was secured by 23rd February 2021.
The platform on which these files were being stored, Azure Blob Storage, is a popular form of cloud storage developed by the tech giant for large enterprise costumes, like multinational companies.
The contents of the blob all appeared to be pitch decks and source codes. Between 10-15 products had source codes exposed, including passwords for live databases that had been hardcoded into the source codes.
With an exposed source code, the hackers find it a lot easier to find vulnerabilities in a product or database and are able to gain access to highly sensitive areas which data security protocols would typically protect. With such access, they could extract highly sensitive data or even assume control of some of the systems running the code, to devastating effect.
Moreover, the impact of the data breach also extends over to hackers finding ways to embed malicious viruses like malware or spyware into the product. If the software was connected to a larger network, they could potentially use the source code from this one product to access and infect an entire network.
SEE: Warning as hackers breach MFA to target cloud services
In their blog post, VpnMentor also provided some advice to securing an Open Blob Storage and stated that Microsoft provides the following detailed instructions to Azure users to help them secure blobs and keep them private:
- Make the bucket private and add authentication protocols.
- Follow Azure access and authentication best practices.
- Add more layers of protection to their Azure account to further restrict who can access it from every point of entry.
Did you enjoy reading this article? Do like our page on Facebook and follow us on Twitter.
pitches are always a pain.