It’s just been revealed that Microsoft researchers accidentally leaked 38TB of confidential information onto the company’s GitHub page, where potentially anyone could see it. Among the data trove was a backup of two former employees’ workstations, which contained keys, passwords, secrets, and more than 30,000 private Teams messages.
According to cloud security firm Wiz, the leak was published on Microsoft’s artificial intelligence (AI) GitHub repository and was accidentally included in a tranche of open-source training data. That means visitors were encouraged to download it, meaning it could have fallen into the wrong hands again and again.
Data breaches can come from all kinds of sources, but it will be particularly embarrassing for Microsoft that this one originated with its own AI researchers. The Wiz report states that Microsoft uploaded the data using Shared Access Signature (SAS) tokens, an Azure feature, that lets users share data through Azure Storage accounts.
Visitors to the repository were told to download the training data from a provided URL. However, the web address granted access to much more than just the planned training data, and allowed users to browse files and folders that were not intended to be publicly accessible.
It gets worse. The access token that allowed all this was misconfigured to provide full control permissions, Wiz reported, rather than more restrictive read-only permissions. In practice, that meant that anyone who visited the URL could delete and overwrite the files they found, not merely view them.
Wiz explains that this could have had dire consequences. As the repository was full of AI training data, the intention was for users to download it and feed it into a script, thereby improving their own AI models.
Yet because it was open to manipulation thanks to its wrongly configured permissions, “an attacker could have injected malicious code into all the AI models in this storage account, and every user who trusts Microsoft’s GitHub repository would’ve been infected by it,” Wiz explains.
The report also noted that the creation of SAS tokens – which grant access to Azure Storage folders such as this one – does not create any kind of paper trail, meaning “there is no way for an administrator to know this token exists and where it circulates.” When a token has full-access permissions like this one did, the results can be potentially disastrous.
Fortunately, Wiz explains that it reported the issue to Microsoft in June 2023. The leaky SAS token was replaced in July, and Microsoft completed its internal investigation in August. The security lapse has only just been reported to the public to allow time to fully fix it.
It’s a reminder that even seemingly innocent actions can potentially lead to data breaches. Luckily the issue has been patched, but it’s unknown whether hackers gained access to any of the sensitive user data before it was removed.
Acer’s Predator Atlas 8 finally has a US release date and price, several months after the company first showed off the handheld in May. The highlight is the Intel Arc G3 Extreme chip inside, which has been adopted by only a couple of other consoles besides the Atlas 8. This version will go on sale exclusively at Best Buy on November 1 for $1,299.99.
Acer originally said the Atlas 8 would arrive in North America in October, but left pricing open at the time. The launch came amid the ongoing DRAM crunch, which has made memory more expensive across the PC industry and complicated pricing for hardware makers.
Google DeepMind's AI world model Genie 4 can now build interactive worlds that you can explore and reshape as they run. It also generates ambient sounds, music, and dialogue that respond to your actions.
The new world model builds on Genie 3 with improved realism, more natural human movement, and better simulations of real-world physics. It could eventually help with everything from game development to training robots.
Apple has an incredible talent for making me admire its products while simultaneously questioning what on earth it's thinking with the pricing. This isn't even something as bizarre as a monitor stand, but the audacity for starting a new laptop lineup from $2,000 doesn't surprise me.
The newly announced 14-inch MacBook Pro with M6 is just the latest to showcase this. The funny thing is, I already know that it's going to be a reliable workstation. You get a powerful new 2nm M6 processor, a gorgeous Liquid Retina XDR display, and up to 24 hours of battery life. We were impressed by the M5 MacBook Air, so the high-end M6 powered MacBook Pro definitely won't let us down.