Connect with us
X
Categories:

Technology

AttachMe Oracle cloud bug exposes volumes to data theft and hijacking

Published

on

AttachMe Oracle cloud bug exposes volumes to data theft and hijacking
Share this post:

Oracle has patched a critical vulnerability in its cloud infrastructure that could have allowed attackers to steal data or tamper with client files.

On September 20, Wiz security researcher Elad Gabay publicly disclosed the security flaw, found in June following an examination of Oracle Cloud Infrastructure (OCI).

Dubbed #AttachMe, the “major” bug centers on one problem: a lack of permissions protection when attaching volumes to OCI.

Attack path

An attack would begin with the use of a target’s unique identifier, their cloud environment ID (OCID), which could be found via publicly available information or a low-privilege account.

A threat actor would then initiate an instance in an attacker-controlled tenant – located in the same availability domain (AD) as the target volume – before attaching the victim’s volume to the instance.

OCI, by design, supports the attachment of a single volume to multiple instances simultaneously.

The lack of authorization checks would ensure the attacker had read/write privileges over the target volume, whether or not they had sufficient permissions

As a result, it may have been possible for attackers to leverage this avenue to steal or modify information, search for cleartext secrets, or move laterally across the volume.

Worst-case scenario

In the worst-case scenario, attackers could potentially hijack an environment by manipulating binaries to achieve code execution.

“Before it was patched, #AttachMe could have allowed attackers to access and modify any other users’ OCI storage volumes without authorization, thereby violating cloud isolation,” Gabay said.

Wiz added that the vulnerability could have impacted all OCI customers or could have been used to target the infrastructure of individual client services.

The Wiz security team disclosed its findings to Oracle on June 9, three days after discovery.

Oracle acknowledged the security report on June 10, and it was on the same day that the vulnerability was confirmed and fixed. No OCI customer action is required.

RECOMMENDED  Your daily horoscope for Friday, September 30, 2022

Speaking to Daily Swig, Wiz researcher Sagi Tzadik said that the real-world ramifications of the vulnerability, if not patched so rapidly by oracle, could have been quite severe.

“This could lead to severe sensitive data leakage for potentially all OCI customers and in some scenarios could even be exploited to gain remote code execution on their environment, providing an initial entry point for further movement in the victim’s cloud environment,” he commented.

“While OCIDs are generally private, they are not treated as secrets. It is relatively feasible to obtain these IDs from a quick GitHub or Google search.”

Oracle declined to comment, but thanked Gabay in the firm’s July 2022 Critical Patch Update notes.

“Insufficient validation of user permissions is a common bug class among cloud service providers,” Wiz added.

“The best way to identify such issues is by performing rigorous code reviews and comprehensive tests for each sensitive API in the development stage. We also recommend performing service-specific penetration tests and participating in bug bounty programs, as these have proven effective with these types of issues.”


Get More Stories Like This On: Facebook: @AllNaijaEntertainment, Twitter: @AllNaijaEntertainment
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

General2 hours ago

Skylar Grey – Everything I Need [LYRICS]

General2 hours ago

[Music] Diddy – Dirty Money – “Coming Home” Feat. Skylar Grey

General2 hours ago

Diddy – Dirty Money – “Coming Home” Feat. Skylar Grey [LYRICS]

General2 hours ago

[Music] African China – Amen

General2 hours ago

[Music] African China – Baba God

General3 hours ago

African China – Baba God [LYRICS]

General3 hours ago

Machine Gun Kelly (MGK) “Home” Feat X Ambassadors & Bebe Rexha [LYRICS]

General3 hours ago

Passenger – Let Her Go [LYRICS]

General3 hours ago

[Music] Eminem – “No Love” Feat. Lil Wayne

General3 hours ago

Eminem – “No Love” Feat. Lil Wayne [LYRICS]

Music3 hours ago

[Music] Tatiana Manaois – Buzz Kill

General3 hours ago

Tatiana Manaois – Buzz Kill [LYRICS]

General3 hours ago

James Blunt – Goodbye My Lover [LYRICS]

General3 hours ago

Major Lazer – “Particula” Feat. Nasty C , Ice Prince, Patoranking & Jidenna [LYRICS]

General3 hours ago

James Blunt – You’re Beautiful [LYRICS]

General3 hours ago

Justin Timberlake – Mirrors [LYRICS]

General3 hours ago

[Music] Darey – “Pray For Me” feat. Soweto Gospel Choir

General3 hours ago

Eminem – “Love The Way You Lie” Feat. Rihanna [LYRICS]

General4 hours ago

Goldlink ft. Miguel – Got Friends [LYRICS]

General4 hours ago

Sia – I’m Still Here [LYRICS]

General4 hours ago

Yo Gotti ft. Nicki Minaj – Rake It Up [LYRICS]

General4 hours ago

Shane McMahon – Here Comes The Money [LYRICS]

General4 hours ago

Journey – Faithfully [LYRICS]

General4 hours ago

[Music] Journey – Faithfully

General4 hours ago

Eminem – Not Afraid [LYRICS]

General4 hours ago

[Music] Journey – Don’t Stop Believin’

General4 hours ago

Journey – Don’t Stop Believin’ [LYRICS]

General5 hours ago

21 Savage – Bank Account [LYRICS]

General5 hours ago

Demi Lovato – Sober [LYRICS]

General5 hours ago

Beyonce ft. Jay-Z – Apeshit [LYRICS]

General5 hours ago

Nasty C ft. ASAP Ferg – King [LYRICS]

General5 hours ago

Lil Wayne – Uproar [LYRICS]

Ed Sheeran
Lyrics5 hours ago

Ed Sheeran – Perfect [LYRICS]

General5 hours ago

[Music] Mo’Hits All Star – Close To You

General5 hours ago

Lil Dicky ft. Chris Brown – Freaky Friday [LYRICS]

Michael Jackson
Lyrics5 hours ago

Michael Jackson – Stranger In Moscow [LYRICS]

General5 hours ago

[Music] Celine Dion – I Drove All Night

General5 hours ago

Celine Dion – I Drove All Night [LYRICS]

General5 hours ago

Tatiana Manaois – Hey Little Lady [LYRICS]

Music6 hours ago

[Music] Tatiana Manaois – Live Better

Gnash (singer)
Music4 days ago

[Music] Gnash Ft Olivia O’Brien – I Hate you, I Love you

John Legend
Music1 day ago

[INSTRUMENTAL] John Legend – All Of Me

Alan Walker
Music5 days ago

Alan Walker – Faded [INSTRUMENTAL]

21 Savage
Music2 days ago

[Video] 21 Savage ft. Offset & Metro Boomin – Rap Saved Me

Wiz Khalifa
Music3 days ago

[Instrumental] Wiz Khalifa – See You Again ft. Charlie Puth

General6 days ago

[Music] Sapientdream – Pastlives

Salvation Ministry Choir Amen
Lyrics2 days ago

Salvation Ministry Choir – Amen [LYRICS]

General7 days ago

[Music] Don Omar – Danza Kuduro (feat. Lucenzo)

General5 days ago

[Music] The Chainsmokers – ‘Don’t Let Me Down’ Feat. Daya

General7 days ago

Ladé – Adulthood Anthem (Adulthood Na Scam) [Lyrics]

General7 days ago

[Music] Timbaland – Apologize ft. OneRepublic

Powfu (singer)
Music4 days ago

[Music] Powfu – Death Bed (Coffee for Your Head) Feat. Beabadoobee

General4 days ago

[Music] Wyclef Jean – “Sweetest Girl (Dollar Bill)” Feat. Akon, Lil Wayne, Niia

General3 days ago

[Music] Zayn Malik – Entertainer

Wiz Khalifa - See You Again ft. Charlie Puth
Music4 days ago

[Music] Wiz Khalifa – See You Again ft. Charlie Puth

Music3 days ago

[Music] Exalted Tribe (HICC) – We Dey Halla

Anna Kendrick
Music4 days ago

[Music] Anna Kendrick – Cups (Pitch Perfect’s “When I’m Gone”)

General2 hours ago

[Music] Diddy – Dirty Money – “Coming Home” Feat. Skylar Grey

General1 day ago

[Music] John Legend – Love Me Now

Right Said Fred
Music4 days ago

[Music] Right Said Fred – Stand Up (For the Champions)

Salvation Ministries Mass Choir
Music2 days ago

[Music] Salvation Ministries Choir – Chioma Me Eh(Good God)

General7 hours ago

[Music] Celine Dion – If That’s What It Takes

Salvation Ministries Mass Choir
Lyrics1 day ago

Salvation Ministries Choir – Chioma Me Eh(Good God) [LYRICS]

General8 hours ago

[Music] P!nk – Try

General6 days ago

[Music] Shaggy – Strength Of A Woman

General1 day ago

[Music] Jaden Smith – Goku

Music3 days ago

[Music] Wiz Khalifa – See You Again (Remix) Feat Charlie Puth, Eminem, Tyga, & Chris Brown

R. Kelly
Music4 days ago

[Music] R. Kelly – World’s Greatest

General1 day ago

Magic! — Rude [LYRICS]

General4 hours ago

[Music] Journey – Don’t Stop Believin’

General6 days ago

[Music] Justin Bieber – Love Me

General2 days ago

[Music] Cardi B – Bartier Cardi ft. 21 Savage

General7 days ago

[Music] Lionel Richie – Angel

General3 days ago

[Music] Tyga ft. Offset – Taste

General8 hours ago

[Music] P!nk – “Just Give Me A Reason” Feat. Nate Ruess

General6 days ago

[Music] BIG SHAQ – Man’s Not Hot

General2 days ago

[Music] 21 Savage ft. Offset & Metro Boomin – Rap Saved Me

General7 days ago

[Music] Shayne Ward – Breathless

General6 days ago

[Music] Post Malone – Candy Paint

General5 days ago

[Music] R Kelly – When A Woman Loves

ANE Billboard Hots



Join "ANE sabi" clique

Don't miss a thing, get ogbonge ANE latest updates to fuel your conversation daily.