{"id":21614,"date":"2023-03-30T16:10:50","date_gmt":"2023-03-31T00:10:50","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2023\/03\/30\/news-15345\/"},"modified":"2023-03-30T16:10:50","modified_gmt":"2023-03-31T00:10:50","slug":"news-15345","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2023\/03\/30\/news-15345\/","title":{"rendered":"“BingBang” flaw enabled altering of Bing search results, account takeover"},"content":{"rendered":"

Researchers from Wiz have discovered a way to allow for search engine manipulation and account takeover<\/a>. The research in question focuses on several Microsoft applications, with everything stemming from a new type of attack aimed at Azure Active Directory<\/a>.<\/p>\n

Azure Active Directory is a single sign-on and multi-factor authentication service used by organisations around the world. In Microsoft’s own words, “Governance ensures the right people have access to the right resources, and only when they need it”.<\/p>\n

Unfortunately, a misconfiguration in how Azure was set up resulted in a collection of potentially serious issues. According to Wiz, once the team started scanning for exposed applications, no fewer than 35% of the apps they scanned were vulnerable to authentication bypass.<\/p>\n

Perhaps the most striking example of this particular attack is how an exposed admin interface tied to Bing allowed any user to access it. Bypassing authentication resulted in a functional admin panel for the search engine. The researchers were able to not only change returned results for searches like “Best soundtrack”, but also take things quite a bit further.<\/p>\n