Bleeping Computer

JUNE 18, 2023

Microsoft has confirmed that recent outages to Azure, Outlook, and OneDrive web portals resulted from Layer 7 DDoS attacks against the company's services. [.]

DDOS 145

DDOS 145

Security Boulevard

JULY 24, 2023

The post ‘China’ Azure Breach: MUCH Worse Than Microsoft Said appeared first on Security Boulevard. Storm-0558 Breaks: Satya and Pooh, sitting in a tree, K.I.S.S.I.N.G.

Social Engineering 98

Social Engineering Authentication Security Awareness Engineering 98

Security Boulevard

JULY 13, 2023

Microsoft revealed its Azure Active Directory (Azure AD) enterprise identity service will be rebranded Entra ID, a change that will occur by the end of the year. The post Microsoft Entra Expands, Azure Active Directory is Now Entra ID appeared first on Security Boulevard.

Authentication 98

Authentication Cybersecurity 98

Security Affairs

JANUARY 19, 2023

Researchers found a new critical remote code execution (RCE) flaw impacting multiple services related to Microsoft Azure. Researchers from Ermetic found a remote code execution flaw, dubbed EmojiDeploy, that impacts Microsoft Azure services and other cloud services including Function Apps, App Service and Logic Apps.

Engineering 98

Engineering Phishing Hacking Information Security 98

Security Boulevard

FEBRUARY 2, 2024

Microsoft Breach — What Happened? What Should Azure Admins Do? On January 25, 2024, Microsoft published a blog post that detailed their recent breach at the hands of “Midnight Blizzard”. Step 4 : The adversary created a new user in the Microsoft corporate tenant (Figure 4). It doesn’t really matter.

Authentication 75

Authentication Architecture Technology Passwords 75

Bleeping Computer

FEBRUARY 6, 2024

AI SPERA, a leader in Cyber Threat Intelligence (CTI)-based solutions, today announced that Criminal IP ASM (Attack Surface Management) is now available on the Microsoft Azure Marketplace. [.]

Cyber threats 81

Cyber threats Cybersecurity 81

CSO Magazine

MAY 5, 2023

Microsoft has patched three new vulnerabilities in the Azure API Management service which includes two Server-Side Request Forgery (SSRF) vulnerabilities and a file upload path traversal on an internal Azure workload, according to cybersecurity firm Ermetic. To read this article in full, please click here

Cybersecurity 101

Cybersecurity 101

Tech Republic Security

JUNE 1, 2022

The latest move will enable MFA as the default security setting even for older Azure accounts. The post Microsoft sets multi-factor authentication as default for all Azure AD customers appeared first on TechRepublic.

Authentication 150

Authentication Accountability 150

CyberSecurity Insiders

AUGUST 9, 2021

Microsoft has unveiled a new service yesterday that is aimed to detect ransomware activities on its Azure cloud platform. Therefore, as soon as any suspicious activity is observed on the Azure platform, the system sends an immediate alert to security teams to gather their attention.

Ransomware 142

Ransomware Artificial Intelligence Technology Cybersecurity 142

Security Boulevard

NOVEMBER 14, 2022

In the next few minutes, you will explore the in-depth design of Azure services and capabilities to help you secure, manage and monitor your cloud data and infrastructure. As a managed service, Microsoft designs and operates its cloud services with security at the core and provides you with built-in controls and tools to meet your […].

Engineering 98

Engineering 98

CSO Magazine

NOVEMBER 22, 2022

Microsoft is extending the Azure DDoS Protection family with a new product focusing on small and medium-size businesses (SMBs). The product, DDoS IP Protection for SMBs, was announced at Microsoft's Ignite conference and is now in public preview. To read this article in full, please click here

DDOS 110

DDOS 110

Security Affairs

JANUARY 18, 2023

SSRF vulnerabilities in four Microsoft Azure services could be exploited to gain unauthorized access to cloud resources. Researchers at the security firm Orca discovered that four different Microsoft Azure services were vulnerable to server-side request forgery (SSRF) attacks. ” reads the analysis published by Orca.

Authentication 95

Authentication Hacking Accountability Risk 95

CyberSecurity Insiders

MARCH 24, 2023

Microsoft has detected that a Russian-affiliated hacking group dubbed Killnet has been targeting healthcare apps being hosted on the Azure cloud platform. The post Killnet targeting healthcare apps hosted on Microsoft Azure appeared first on Cybersecurity Insiders.

Healthcare 112

Healthcare DDOS Manufacturing Threat Detection 112

Bleeping Computer

MAY 27, 2022

Microsoft has announced that it will force enable stricter secure default settings known as 'security defaults' on all existing Azure Active Directory (Azure AD) tenants starting in late June 2022. [.].

144

144

The Hacker News

JUNE 14, 2023

Two "dangerous" security vulnerabilities have been disclosed in Microsoft Azure Bastion and Azure Container Registry that could have been exploited to carry out cross-site scripting (XSS) attacks.

96

96

Malwarebytes

JUNE 23, 2023

Researchers have found that a flaw in Microsoft Azure AD can be used by attackers to take over accounts that rely on pre-established trust. In a nutshell, Microsoft Azure AD allows you to change the email address associated with an account without verification of whether you are in control of that email address.

Accountability 82

Accountability Passwords Authentication Internet 82

Thales Cloud Protection & Licensing

NOVEMBER 14, 2023

Together, Intel, Thales and Microsoft offer a comprehensive end-to-end data protection solution for Microsoft Azure customers. Intel® Trust Authority attests the authenticity of the Azure confidential computing environment before decrypting customer-sensitive workloads.

Digital transformation 78

Digital transformation Architecture Engineering Authentication 78

Bleeping Computer

JULY 14, 2023

Microsoft says it still doesn't know how Chinese hackers stole an inactive Microsoft account (MSA) consumer signing key used to breach the Exchange Online and Azure AD accounts of two dozen organizations, including government agencies. [.]

Accountability 98

Accountability Government 98

Security Affairs

APRIL 11, 2023

A flaw in Microsoft Azure could be exploited by attackers to gain access to storage accounts, perform lateral movements, and even execute remote code. Azure storage accounts can host different data objects, such as blobs and file shares. The IT giant recommends using Azure AD authorization instead of Shared Key Authorization.

Accountability 91

Accountability Education Media Authentication 91

Security Boulevard

MARCH 28, 2021

Key takeaways from our recent webinar on Microsoft Azure cloud security As we discussed in a recent webinar on Microsoft Azure security […]. The post Microsoft Azure Checklist: Expert Advice on Security appeared first on Sonrai Security.

124

124

Bleeping Computer

AUGUST 13, 2021

A security researcher has figured out a way to dump a user's unencrypted plaintext Microsoft Azure credentials from Microsoft's new Windows 365 Cloud PC service using Mimikatz. [.].

145

145

The Hacker News

JUNE 21, 2023

A security shortcoming in Microsoft Azure Active Directory (AD) Open Authorization (OAuth) process could have been exploited to achieve full account takeover, researchers said. California-based identity and access management service Descope, which discovered and reported the issue in April 2023, dubbed it nOAuth.

Accountability 95

Accountability Authentication 95

Bleeping Computer

AUGUST 3, 2023

Microsoft's new Azure Active Directory Cross-Tenant Synchronization (CTS) feature, introduced in June 2023, has created a new potential attack surface that might allow threat actors to more easily spread laterally to other Azure tenants. [.]

97

97

CyberSecurity Insiders

DECEMBER 26, 2021

Microsoft, the technology giant of America, has warned all its users that there is a hidden vulnerability hidden in an Azure cloud that could leak user data to hackers. Highly placed sources say that the researchers’ team from Wiz notified Microsoft about the bug existing in an Azure cloud in October this year.

Cybersecurity 122

Cybersecurity Technology Software 122

The Hacker News

JULY 21, 2023

The recent attack against Microsoft's email infrastructure by a Chinese nation-state actor referred to as Storm-0558 is said to have a broader scope than previously thought.

Accountability 98

Accountability 98

Security Boulevard

SEPTEMBER 17, 2021

Using OMI on Microsoft Azure? The post ‘OMIGOD’ Azure Critical Bugfix? Do It Yourself—Because Microsoft Won’t appeared first on Security Boulevard. Drop everything and patch this critical vulnerability.

Banking 119

Banking Security Awareness Cybersecurity Network Security 119

Security Affairs

JULY 2, 2021

Microsoft is urging Azure users to update PowerShell to address a remote code execution vulnerability that was fixed earlier this year. Microsoft is recommending its Azure users to update PowerShell versions 7.0 “If you manage yoiur Azure resources from PowerShell version 7.0 as soon as possible.

Hacking 130

Hacking Information Security Cybersecurity 130

The Hacker News

JULY 14, 2023

Microsoft on Friday said a validation error in its source code allowed for Azure Active Directory (Azure AD) tokens to be forged by a malicious actor known as Storm-0558 using a Microsoft account (MSA) consumer signing key to breach two dozen organizations.

Authentication 98

Authentication Accountability 98

The Hacker News

MAY 4, 2023

Three new security flaws have been disclosed in Microsoft Azure API Management service that could be abused by malicious actors to gain access to sensitive information or backend services.

107

107

Security Affairs

NOVEMBER 18, 2021

Microsoft recently addressed an information disclosure vulnerability, tracked as CVE-2021-42306 , affecting Azure AD. Microsoft has recently addressed an information disclosure vulnerability, tracked as CVE-2021-42306 , affecting Azure AD. on an Azure AD Application or Service Principal (which is not recommended).

Accountability 113

Accountability Authentication Hacking Information Security 113

Heimadal Security

JANUARY 18, 2023

Cyber researchers discovered last year that four of Microsoft Azure`s Services had security issues that made them vulnerable to server-side request forgery (SSRF) attacks. Two of the vulnerabilities did not request authentication, so threat actors had the opportunity to exploit them without even having an Azure account.

Authentication 94

Authentication Accountability Cybersecurity 94

Bleeping Computer

AUGUST 30, 2022

Microsoft Azure customers' virtual machines (VMs) running Ubuntu 18.04 have been taken offline by an ongoing outage caused by a faulty systemd update. [.].

121

121

Security Affairs

SEPTEMBER 27, 2020

Microsoft removed 18 Azure Active Directory applications from its Azure portal that were created by a Chinese-linked APT group Gadolinium. The 18 Azure AD apps were taken down by the IT giant in April, Microsoft also published a report that includes technical details about the Gadolinium’s operation.

Advertising 140

Advertising Malware Phishing Hacking 140

The Hacker News

JANUARY 17, 2023

Four different Microsoft Azure services have been found vulnerable to server-side request forgery (SSRF) attacks that could be exploited to gain unauthorized access to cloud resources.

96

96

Security Affairs

AUGUST 10, 2021

Microsoft Azure Sentinel cloud-native SIEM (Security Information and Event Management) platform used the Fusion machine learning model to detect ransomware attack. “In collaboration with the Microsoft Threat Intelligence Center (MSTIC), we are excited to announce Fusion detection for ransomware is now publicly available!”

Ransomware 109

Ransomware Malware Software Phishing 109

Bleeping Computer

APRIL 3, 2021

Microsoft has revealed that Thursday's worldwide outage was caused by a code defect that allowed the Azure DNS service to become overwhelmed and not respond to DNS queries. [.].

DNS 145

DNS 145

Security Affairs

DECEMBER 22, 2021

A vulnerability in the Microsoft Azure App Service led to the exposure of customer source code for at least four years. The vulnerability was discovered by security firm Wiz, which reported the bug to Microsoft in September. ” reads the advisory published by Microsoft. SecurityAffairs – hacking, azure app service).

Hacking 107

Hacking Risk Information Security 107