An accidentally disclosed SAS token with excessive privileges enabled researchers to access nearly 40TB of Microsoft’s data, highlighting the risks of privilege mismanagement and oversharing.
Yeah my ex makes a lot of money basically sitting down with companies and over years (because it’s such an arduous process to get managers to understand the importantance of) make them slowly, ever so slowly, do proper access or even identity management.
“Like any secret, SAS tokens need to be created and handled appropriately,” said the MSRC team. “As always, we highly encourage customers to follow our best practices when using SAS tokens to minimise the risk of unintended access or abuse.
lol - follow our best practices - ironic. Of course documented best practices don’t mean everyone follows them, even internally, but that statement still makes for humorous irony. Ambiguous, almost implies, “follow how we did it here” in my reading.
Among other things, their access levels can be easily and readily customised by the user, as can the expiry time, which could in theory allow a token to be created that never expired (the compromised one was in fact valid through to 2051, 28 years from now).
[…] it’s not easy to revoke the token either […]
Reading this, the drive to managed cloud and centralization feels like an effort to replace memory management issues as the top vulnerability cause. We - as an industry - are more aware of those as ever, and have interesting efforts like Rust adoption. And at the same time, hierarchical access tokens you can’t easily revoke, with arbitrary configured lifetimes and access, that are hard to monitor, track, and trace (from reading this article) are introduced as an entirely new set of risk and attack surface.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !programming@programming.dev
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person’s post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
Follow the programming.dev instance rules
Keep content related to programming in some way
If you’re posting long videos try to add in some form of tldr for those who don’t want to watch videos
Yeah my ex makes a lot of money basically sitting down with companies and over years (because it’s such an arduous process to get managers to understand the importantance of) make them slowly, ever so slowly, do proper access or even identity management.
I wonder how many data breaches or leaks happen that we don’t hear about. Is it like ten for every one that makes the news, or worse?
lol - follow our best practices - ironic. Of course documented best practices don’t mean everyone follows them, even internally, but that statement still makes for humorous irony. Ambiguous, almost implies, “follow how we did it here” in my reading.
Reading this, the drive to managed cloud and centralization feels like an effort to replace memory management issues as the top vulnerability cause. We - as an industry - are more aware of those as ever, and have interesting efforts like Rust adoption. And at the same time, hierarchical access tokens you can’t easily revoke, with arbitrary configured lifetimes and access, that are hard to monitor, track, and trace (from reading this article) are introduced as an entirely new set of risk and attack surface.