Bing vulnerability made it possible to alter search results
A major security exploit that let researchers change Bing search results was revealed this week.
The vulnerability was discovered in January by cybersecurity research company Wiz and reported to the Microsoft Security Response Center (MSRC).
In a Twitter thread, Wiz researcher Hillai Ben-Sasson explained how he was able to hack into Bing's content management system (CMS). By logging into Microsoft's cloud computing platform Azure, he discovered that he could grant all users access to internal Microsoft apps. He then accessed a database of Bing's search results. From there, Ben-Sasson figured out that he could actually modify what showed up in the results.
Wiz researchers also discovered that Bing was vulnerable to a Cross-Site Scripting (XSS) attack and discovered they had access to sensitive Office 365 data including Outlook emails, Calendar information, and Teams messages. MSRC detailed security updates and shared recommendations for Azure AD admins and developers in its blog post.
The purpose of the researchers' experiment was to show that it was possible and share its findings with Microsoft. But it shows how malicious hackers could have wreaked havoc for Bing.
Related Stories
- Oh great, Microsoft's Bing AI chatbot is getting more ads
- Microsoft threatens to cut-off rival AI chatbots from Bing data
- Bing vs. Bard: The ultimate AI chatbot showdown
- Meet Copilot, Microsoft's AI tool for work and productivity
- The ChatGPT bug exposed more private data than previously thought, OpenAI confirms
"A malicious actor with the same access could’ve hijacked the most popular search results with the same payload and leak sensitive data from millions of users," said the Wiz blog post. Luckily it was caught before any major damage was done.
Tweet may have been deleted
Microsoft confirmed that it has been fixed as of March 29. Wiz received a $40,000 "bug bounty" for reporting the vulnerability, which it it plans to donate to an unspecified recipient.
-
N. Korea testYoung Korean doctors seek plan B: cosmetic dermatology or overseasHow ‘gas station in the sky’ boosts defensePhiladelphia police’s fatal shooting of armed Black man suffering from mental illness sparks unrest.14 Heists, Robberies, and Other Great CapersBarca earn Copa semiWhat to expect from Samsung Galaxy Unpacked for February 2023CATL launches ultraFootage of Kim YoSamsung's new invention could usher in a very different foldable phone
下一篇:From Prairie Grasslands to Man
- ·21 Caves That Offer Otherworldly Experiences
- ·How to watch the 2022 NBA playoffs without cable
- ·What to expect from Samsung Galaxy Unpacked for February 2023
- ·Why femicide and dating violence are growing issues in S. Korea
- ·How much will PCB's Champions Cup mentors be paid?
- ·Explaining corecore, TikTok's newest aesthetic
- ·How to mute or unmute an account on Instagram
- ·North Korea fires two projectiles, apparently from super
- ·N. Korea test
- ·Russia provides 1,355 tons of refined oil to N. Korea in Oct.
- ·Incognito mode on Chrome for Android just got a lot more useful
- ·严厉打击盗猎候鸟行为!广东部署鸟类保护专项治理工作
- ·Venture Missionaries
- ·Destination Pyongyang: 50
- ·Panic disorder most common among people in 40s
- ·What to expect from Samsung Galaxy Unpacked for February 2023
- ·蒙顶山茶有了专属茶器
- ·Incognito mode on Chrome for Android just got a lot more useful
- ·Was that video propaganda? TikTok is trying to help, kind of.
- ·The Burger King 'Whopper' jingle is going viral because NFL fans can’t escape it
- ·World's first green ammonia plant is now open for business
- ·Speaker of the House vote memes and jokes: Kevin McCarthy gets roasted online amid 6 failed votes
- ·Elon Musk invested big in Twitter, but now he's getting sued over it
- ·Elon Musk isn't joining Twitter's board of directors after all
- ·Pakistan Cricket at crossroads after shock defeat at Pindi
- ·CATL launches ultra
- ·From Prairie Grasslands to Man
- ·Fervo heralds a revolution in geothermal power technology
- ·How ‘gas station in the sky’ boosts defense
- ·Explaining corecore, TikTok's newest aesthetic
- ·Nvidia GeForce Now Ultimate vs. New Graphics Card
- ·连平花生:百岁的“红胖子”,农民的“金豆子”
- ·Why femicide and dating violence are growing issues in S. Korea
- ·Ten Hag slams 'unprofessional' Man Utd
- ·How to Backup Your Gmail Account
- ·Nosy interviewers: crossing the line is still legal in Korea