Orca Security Discloses How It Breached Azure Synapse Customer Accounts -- Redmondmag.com

Orca Security Discloses How It Breached Azure Synapse Customer Accounts

By Kurt Mackie
06/15/2022

Orca Security on Tuesday published its findings on a security hole in Azure Synapse, as well as Azure Data Factory, that permitted access to customer tenancy accounts on Microsoft's shared "cloud" infrastructure.

Portland, Ore.-based Orca Security specializes in finding and addressing cloud security issues.

Microsoft acknowledged the security problems with the Azure Synapse service in this May 9 security announcement, and declared them as having been fixed on April 15. However, in the interval before that fix, Orca Security was able to bypass two of Microsoft's earlier attempts to address the underlying problems. All told, it took a good five months from Orca Security's first disclosure of the problems on Jan. 4 for Microsoft to reach a workable problem resolution.

Orca Security researcher Tzah Pahima is credited with the discovery of an exploit that used an integrated runtime component of Azure Synapse (formerly known as "Azure SQL Data Warehouse") to leverage a Microsoft internal API server, which then permitted remote code execution across tenancies. He used the name, "SynLapse," to refer to this research.

Pahima summarized the issue, noting that he was able to access a Synapse client certificate with "full permissions" to Microsoft's internal API server:

It is worth noting that the major security flaw wasn't so much the ability to execute code in a shared environment but rather the implications of such code execution. More specifically, executing code on the shared integration runtime exposed a client certificate to a powerful, internal API server. This enabled an attacker to compromise the service and access other customers' resources.

In the earlier phases of his investigation, Pahima only needed to know the name of an Azure Synapse workspace to conduct an attack. Azure Synapse is used to process data from various sources, and an "Azure Synapse workspace" is Microsoft's term for a Synapse instance used for that purpose, Pahima explained.

While Microsoft did eventually fix that problem, just knowing the Azure Synapse name had allowed Pahima to gain access to other customer accounts, leak the customer credentials stored in the Azure Synapse workspace, run remote code on "any customer's integration runtimes" and "take control of the Azure batch pool managing all of the shared integration runtimes."

For its trouble in researching and communicating the problems, Orca Security was awarded $60,000 from Microsoft.

Orca Security delayed publishing its findings until now to "give Azure Synapse customers time to patch their on-premises versions and reconsider their Azure Synapse usage," Pahima indicated.

Microsoft's May 9 announcement suggested that most Azure Synapse customers wouldn't need to take any action. However there was one exception. "Self-host IR customers without auto-update need to take action to safeguard their deployments," Microsoft had indicated back then.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

Multi-Tenant Organization Hooks Released for Microsoft 365

Microsoft Entra ID's new multi-tenant organization capabilities have reached general availability (GA).
Real-World Ransomware Recovery

Here's how I was (mostly) successful in recovering a family PC infected with malware.
Microsoft Launches Small AI Models Family Phi-3

Recognizing that bigger isn't always better, Microsoft has released its smallest open AI models to date, Phi-3.
Microsoft and OpenAI Continue Global AI Expansions

Microsoft and OpenAI each continued their global expansion this month, with the announcements of new infrastructure investments and service rollouts in new regions, like Asia and the Middle East.
Cisco Warns of Brute Force Attacks Targeting VPNs and Firewalls

Cisco has revealed that a global increase in brute force attacks targeting Virtual Private Networks (VPNs) and other devices is currently taking place.