Researchers at Wiz have uncovered a major security lapse at Microsoft, leading to the exposure of a staggering 38 terabytes of private data. This breach occurred during a routine open-source AI training material update on GitHub.
The exposed data includes a disk backup of employees’ workstations, corporate secrets, private keys, passwords, and an extensive cache of over 30,000 internal Microsoft Teams messages.
Furthermore, the incident stemmed from misconfigured sharing using Azure SAS tokens, inadvertently granting access to the entire storage account, comprising 38TB of sensitive data.
Wiz, a cloud data security startup founded by former Microsoft software engineers, detected this issue during their routine internet scans for misconfigured storage containers. The exposed data was linked to a GitHub repository within the Microsoft organization, known as “robust-models-transfer,” which belongs to Microsoft’s AI research division. This repository was intended for sharing open-source code and AI models for image recognition.
The security implications were severe, as the misconfigured URL allowed access not only to open-source models but also to the entire storage account, including personal computer backups of Microsoft employees. This backup contained sensitive information, including passwords for Microsoft services, secret keys, and thousands of internal Microsoft Teams messages.
Additionally, the token was misconfigured to allow “full control” permissions, potentially enabling attackers to inject malicious code into AI models within the storage account, putting users who trust Microsoft’s GitHub repository at risk.
Wiz reported this issue to Microsoft’s security response team, which invalidated the SAS token within two days of the initial disclosure in June. A new token was subsequently deployed on GitHub a month later, addressing the security breach.
