Slashdot Mirror
Microsoft Update Servers Left All Azure RHEL Instances Hackable (theregister.co.uk)
An anonymous reader shares a report on The Register: Microsoft has patched flaws that attackers could exploit to compromise all Azure Red Hat Enterprise Linux (RHEL) instances. Software engineer Ian Duffy found the flaws while building a secure RHEL image for Microsoft Azure. During that process he noticed an installation script Azure uses in its preconfigured RPM Package Manager contains build host information that allows attackers to find all four Red Hat Update Appliances which expose REST APIs over HTTPS. From there Duffy found a package labeled PrepareRHUI (Red Hat Update Infrastructure) that runs on all Azure RHEL boxes, and contains the rhui-monitor.cloud build host. Duffy accessed that host and found it had broken username and password authentication. This allowed him to access a backend log collector application which returned logs and configuration files along with a SSL certificate that granted full administrative access to the four Red Hat Update Appliances. Duffy says all Azure RHEL images are configured without GPG validation checks meaning all would accept malicious package updates on their next run of yum updates.
... why would you go to Microsoft, instead of Amazon or someone else? Doesn't Red Hat have any cloud services?
They locked the vault door after the money was stolen. Problem solved.
Moral of the story: Microsoft got caught backdooring their Azure instances on behalf of the government. Shill all you want, you fucking whore, in the end you'll burn like the rest.
Just kidding.
It is pitch black. You are likely to be eaten by a grue.
They locked the vault door after the money was stolen. Problem solved.
Too bad they didn't lock it before the guy's wife was murdered, then he wouldn't have had to spend his life searching for his kid.
(oh wait...he just didn't care enough to look)
No, no, no!
That was OJ! It was OJ who said he was going to spend the rest of his life looking for Nicole's killer.
Obviously, OJ thought Nicole's killer was a golfer who spent most of his time on Florida golf courses. OJ was right, too.
MS security sucks, dog bites man, water is wet, and the sky is Azure (no clouds) - FTFY
Is the Red Hat Certification any good for Linux jobs?
... that clouds are places to hide big rocks.
No, no, no!
That was OJ! It was OJ who said he was going to spend the rest of his life looking for Nicole's killer.
Obviously, OJ thought Nicole's killer was a golfer who spent most of his time on Florida golf courses. OJ was right, too.
Cut the Juice some slack. He's trying harder. He's infiltrated a prison doing recon. Now that's selflessness.
"So your saying MS is Backdooring RHEL."
No, only instances built from the default Azure template.
(And this is one of those problems of 'cloud', you outsource some of your host security in the name of convenience)
While this is a serious flaw and it is good to know that it has been fixed, it is easily avoidable. I can't speak for other Azure customers, but my organization does not use the default Microsoft OS images. We provide our own. If there is an issue in our base builds, it is because our internal security team screwed up.
Azure is an okay platform, but it is also a very new platform. The old adage of "Trust but verify." definitely applies.
I mostly trust that Microsoft can put together a clean Windows Server build, but we still bring our own. I would not trust Microsoft to secure a Linux build.
Microsoft loves Linux