Thread by @QuinnyPig

And now, the most horrifying security vulnerability I've seen in ages, staring @Microsoft @Azure.

A thread...

https://twitter.com/yoavalon/status/1536705262819725313

So @orcasec found a vulnerability in @azure and reported it to Microsoft back in January. @Azure's response was to go out and buy a booth for @RSAConference, then get back to Orca six short weeks later.

A speedy month and a half later, Azure releases a patch.

I AM NOT DONE.

Orca was able to BYPASS THE PATCH. @Azure security swung into action and expanded the size of their #RSAC booth, while paying @orcasec a $60K bug bounty. (This remains the only thing Azure got right in this entire debacle.)

Orca reached out to @Azure with an "oh, by the way, the security certificate we exfiltrated and reported to you have not been revoked."

Azure's security team met with Orca a few days later, presumably to ask @orcasec which flavor of crayon was the most delicious.

After that, @Azure finally understood what @orcasec was saying, and deployed a second patch.

Three days later ORCA BYPASSED THE NEW PATCH.

@Azure installed a 60 foot banner above their #rsac booth, and deployed a third patch. This one seems to have worked?

This is not a story about an @Azure security failure. This is a story about a complete lack of security culture apparent anywhere in this story.

If I were an Azure customer, I would seek to change that immediately after reading @orcasec's blog post.
orca.security/resources/blog…

I would dearly love @Azure to expound upon this. Tell me, how does "an attacker has access to and can run code within customer environments" not catapult "minimizing customer disruption" into the next county?!

Engineering mistakes happen, and I’m not one to shame people for making them. But this lack of responsiveness to reports of serious security issues is just wild to me.

I’ve seen their larger competitor patch issues far less severe within two days globally.