Cloud Server Misconfigurations

Cloud Server Misconfigurations

Product Serial: F-2022-10-20a

TLP:CLEAR

In this report, ZeroFox Intelligence briefly discusses "BlueBleed" and the ramifications of cloud server misconfigurations leading to data leaks.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on October 20, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Misconfigured cloud servers are not a new occurrence; they happen regularly given that the ease of use of cloud servers often overshadows the need for additional security measures beyond what on-premises solutions require. These misconfigurations have garnered attention when a vulnerability is discovered or threat actors leverage them. The most recently reported event, dubbed "BlueBleed," occurred when security researchers informed Microsoft on September 24, 2022, of a misconfigured storage endpoint allowing unauthenticated access. After being notified, Microsoft properly configured the endpoint so that it could only be accessed after authentication. Microsoft’s official response stated, "Our investigation found no indication customer accounts or systems were compromised. We have directly notified the affected customers," in addition to expressing disappointment around the numbers listed in the report, calling them "exaggerated."

Key Findings

• Recent activity around BlueBleed has highlighted the prominence of cloud server misconfigurations.
• Internet-wide scanning has made it easy for exposed services to be discovered within hours of deployment.
• Many reported misconfigured servers are due to a lack of authentication.