Microsoft AI Research SAS Token Exposed 38TB of Private Data, Wiz Reports
Summary
Wiz says a Microsoft AI research SAS token exposed 38TB of private data, including workstation backups, credentials and Teams messages. Microsoft invalidated the token in June 2023.
Key points
- Wiz reported finding the exposure while scanning for misconfigured cloud storage and notified Microsoft on June 22, 2023.
- The SAS token linked from a Microsoft GitHub repository granted access to the entire Azure storage account, not just the intended AI model files.
- Wiz says the account contained 38TB of additional private data, including two employees’ workstation backups, passwords, secret keys and more than 30,000 Teams messages from 359 employees.
- The token allowed full control, including deleting and overwriting files, and was set to expire in 2051.
- Microsoft invalidated the token on June 24, 2023, replaced it on GitHub on July 7, and completed an internal impact investigation in August, according to the article.
- Wiz says write access could have enabled malicious code injection into AI model files, creating a potential supply-chain risk; the article does not report that this occurred.
- Wiz recommends avoiding Account SAS for external sharing, limiting exposure with dedicated storage accounts, using more manageable SAS options, and monitoring or scanning for tokens.
Article Details
- Victim Organization
- Microsoft
- Incident Type
- Accidental exposure of private data through an overly permissive Azure Account SAS token shared in a Microsoft GitHub repository.
- Disclosure Date
- 2023-09-18
- Data Types Exposed
- Passwords to Microsoft services
- Secret keys
- Microsoft employees’ personal computer backups
- Internal Microsoft Teams messages
- Affected Records
- Over 30,000 internal Teams messages from 359 Microsoft employees.
- Affected Data Size
- 38 TB of additional private data.
- Operational Impact
- The storage account’s token allowed access to the entire account with full-control permissions, including the ability to delete or overwrite files. Microsoft invalidated the token on 2023-06-24. The source describes potential supply-chain and code-execution risks, but does not report that malicious code was injected or that users were infected.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
People
Hillai Ben-SassonNamed member of the Wiz Research Team, which found and reported the exposed storage access.Nir OhfeldNamed member of the Wiz Research Team, which found and reported the exposed storage access.Ronen ShustinNamed member of the Wiz Research Team, which found and reported the exposed storage access.Sagi TzadikNamed member of the Wiz Research Team, which found and reported the exposed storage access.Shir TamariNamed member of the Wiz Research Team, which found and reported the exposed storage access.
Vendors
MicrosoftMicrosoft’s AI research team, while publishing a bucket of open-source training data on GitHub, accidentally exposed 38 terabytes of additional private data — including a disk backup of two employees’ workstations. WizAs part of the Wiz Research Team’s ongoing work on accidental exposure of cloud-hosted data, the team scanned the internet for misconfigured storage containers. In this process, we found a GitHub repository under the
Products
AzureThe researchers shared their files using an Azure feature called SAS tokens, which allows you to share data from Azure Storage accounts.GitHubMicrosoft’s AI research team, while publishing a bucket of open-source training data on GitHub, accidentally exposed 38 terabytes of additional private data — including a disk backup of two employees’ workstations. Microsoft TeamsThe backup includes secrets, private keys, passwords, and over 30,000 internal Microsoft Teams messages.TensorFlowfile from the SAS link and feed it into a script. The file’s format is ckpt, a format produced by the TensorFlow library. It’s formatted using Python’s pickle formatter, which is prone to arbitrary code execution by