２０２X年 ある日の行政書士 第１９話

「隆、大変よ。ハッキングよ。」オルガはワインカップをテーブル上に置くと慌てた口調で言った。

「ハッキング！」隆は、思わず身を乗り出した。

「マイクロソフトからメールがあったの。」オルガがパソコンを操作するとメール文が画面に現れた。

** Update ** Learn how to protect your environment in our latest post Nearly everything we do online these days runs through applications and databases in the cloud. While leaky storage buckets get a lot of attention, database exposure is the bigger risk for most companies because each one can contain millions or even billions of sensitive records. Every CISO’s nightmare is someone getting their access keys and exfiltrating gigabytes of data in one fell swoop.

Watch our ChaosDB: How We Hacked Databases of Thousands of Azure Customers BlackHat 2021 live talk So you can imagine our surprise when we were able to gain complete unrestricted access to the accounts and databases of several thousand Microsoft Azure customers, including many Fortune 500 companies. As part of building a market-leading CNAPP, Wiz’s security research team (that’s us) constantly looks for new attack surfaces in the cloud, and two weeks ago we discovered an unprecedented breach that affects Azure’s flagship database service, Cosmos DB.

Some of the world’s biggest businesses (see their website) use Cosmos DB to manage massive amounts of data from around the world in near real-time. As one of the simplest and most flexible ways for developers to store data, it powers critical business functions like processing millions of prescription transactions or managing customer order flows on e-commerce sites.

Database exposures have become alarmingly common in recent years as more companies move to the cloud, and the culprit is usually a misconfiguration in the customer’s environment. In this case, customers were not at fault.

Rather, a series of flaws in a Cosmos DB feature created a loophole allowing any user to download, delete or manipulate a massive collection of commercial databases, as well as read/write access to the underlying architecture of Cosmos DB.

We named this vulnerability #ChaosDB. Exploiting it was trivial and required no other credentials.

「MicrosoftはJupyter Notebookと呼ばれる機能をCosmos DBにオンにしたすべての顧客に知らせていなかった。このことについて質問されたマイクロソフトは、影響を受ける可能性のある顧客には通知したとロイターに答えただけで、それ以上の説明はしなかったらしい。」オルガは続けた。

「あの老紳士かい？　原因は。」隆は言葉を継いだ。

「そうよ。あの老紳士からのメールの添付ファイル開いたら、クラウドがダウン。老紳士に嵌められたわけよ。は。は。」オルガは自嘲げに言った。

「警察には連絡したの？」隆は不安げな表情をしながら言った。

「おそらく、隆のビックデータ情報をねらったのかもしれない。C国のエージェントよ。あの老紳士。マイクロソフトが情報を出さないので警察に通報は無理よ。」オルガは苦々しい口調で言った。