38TB of data accidentally exposed by Microsoft AI researchers

Re:38TB of data accidentally exposed by Microsoft AI researc... by alaxapta7 on Monday September 18, 2023 @02:15PM (#37559838)

I've seen worse. Couple years back, there was an audit that included an internal system I've been working on. It was running on Debian oldstable because of a vital proprietary library I wasn't able to get working on stable at the time, but it had unattended upgrades set up and all that.

The company made some basic port scan and established that we're running outdated and vulnerable version of Apache. I found the act of explaining the concept of backports to a "pentester" to be physically painful.

They didn't get paid and another company was entrusted with the audit.

[ Parent | on HN ]

Re:38TB of data accidentally exposed by Microsoft AI researc... by pixl97 on Monday September 18, 2023 @02:23PM (#37559968)

This is why I always attempt to turn off as much version information output as possible from any service. Make the pentester do their homework and not just look at "Apache 2.XX"

Hopefully you also have an internal control that looks at actual package versions installed on the server.

[ Parent | on HN ]

Re:38TB of data accidentally exposed by Microsoft AI researc... by dylan604 on Monday September 18, 2023 @02:41PM (#37560216)

This is actually a take away that I did implement. it's one of those that's not actively a vuln, but might provide info on what other attacks to try.

[ Parent | on HN ]

Re:38TB of data accidentally exposed by Microsoft AI researc... by alaxapta7 on Monday September 18, 2023 @04:14PM (#37561394)

Normally I do that too, but this was fairly new and internal application that was still in development, so that's why it was there. And if it wasn't for this incident, they might actually trick our management into thinking they're somehow qualified to carry out such an audit.

[ Parent | on HN ]