Microsoft AI Leaks 100 MILLION users' Medical Records!

[@DanielBoctor]

To try everything Brilliant has to offer -free- for a full 30 days, visit 👉 brilliant.org/DanielBoctor/. You'll also get 20% off an annual premium subscription! THANKS FOR WATCHING ❤ JOIN THE DISCORD! 👉 discord.gg/WYqqp7DXbm 👇 Let me know what type of content you would like to see next! 👇 Thank you for all of the support, I love all of you

[@YodaWhat]

Does BRILLIANT teach all the technical and cognitive methods that programmers MUST USE to stop themselves from making these continual stupid programming errors? If so, then a proper course of BRILLIANT lessons should be REQUIRED as PREREQUISITES for all programmers seeking jobs, as well as those already employed. How's that for progress?

[@Matelight_IT]

I don't recommend BRILLIANT, I bought it, but I wasted my money. Brilliant is for idiots that what to feel like their are smart, just basics of basics for every topic. You just read text for 90% of time, there is not even text to speech option. I tested my self on topics that I confident to know well, and well, I had notice that questions are often supper ambiguous, and where all answers are somewhat valid you must select only one?! And if learning platform claim that you will remember everything and don't have some sort of SRS, they just lying.

[@AQDuck]

"Why are you so worried about Microsoft and Google having all your personal data?" Me:

[@Tannerlegasse]

Well you don't have anything to hide, right? What do you care? 😂 (sarcasm)

[@ecMathGeek]

Yeah, I see this and I think "And they expect us to believe Recall AI is going to be secure?"

[@Tannerlegasse]

@@ecMathGeek yo, they started rolling out recall in beta and I immediately transitioned 100% to Linux. I do not play with Microsoft, and as little as humanly possible with Google (Android).

[@amigalemming]

In Germany they started an opt-out solution to putting all private health data into the cloud. They are proud that only few citizens actually opt out.

[@Valerius123]

Honestly, this is negligible to the real issue with them having all your personal data. They create psychology profiles on you and force feed you propaganda that aligns with their political interest in order to sway elections.

[@tristonhoang3881]

Why on earth would a health application need to execute remote JavaScript from client to server? Most of these bugs wouldn't exist if this feature hadn't been implemented in the first place

[@user-ks1oh2wx6o]

My question exactly. It's literally a health bot (which I presume you ask about health concerns and such), not a programming assistant.

[@lucmon98]

🎉 well, I got on the "path traversal" was the most complicated one, really? Exactly this Input would be caught by any proper pentesting/fuzzy program. All exploits are basic (at most) compared to the state of the art. Thus, I have to expect that they deployed a service with access to health data without any proper testing (?) Fix in production mentally 😂🎉

[@Otherfox-be9up]

ran out of money for hiriny offsecs

[@jacklimestone2559]

As an old Medical Software developer, requests to have an ability to execute arbitrary code is pretty common unfortunately. The best we do is to prevent WHO can do that, is to limit it to sysadmins, but ya.

[@ChromecastM8]

Cheap 3rd world programming, how else.

[@weshuiz1325]

The real question is "who trusted Microsoft with healthcare data"

[@Peaches-i2i]

The average person who barely understands the magic box they hold in their hands.

[@zehph]

@@Peaches-i2i Well in this instance this was by more than one health provider, these cloud offerings abstract everything from the clients consuming, they might be forced by management to integrate AI in their offerings and contracted an “enterprise” solution to not have to deal with exactly this kind of bs that is not hard but tedious to setup and maintain.

[@cosmotraumatika7474]

Pretty much and all HR executives in any corporation if it was offered to reduce costs.

[@gschgvt2956]

Those last 3 words were unnecessary.

[@JeremyAndersonBoise]

Amazon bought the second largest healthcare provider in the US two years ago. Doom.

[@Graverman]

200k is not a fair price. Even if microsoft stock only fell down 5% after leaking 100 million *medical* data, this would cost them 162 billion. This is equivalent to paying someone a dollar for protecting your millions... after you mess up.

[@YT7mc]

such is fair market 🤷‍♂️ it all comes down to capitalism and end of the day this makes them the most money.

[@itech40]

I agree...

[@nikkiofthevalley]

​@@YT7mcThe problem is less capitalism and more that companies are allowed to pay to change the laws. They've slowly, insudiously, obliterated all protections for customers and the public in general.

[@hydra4370]

200k is not enough for a bug like this, but a guy who can do this casually, four times in a row, is probably making that a year already

[@DeltaNovum]

Class... Action... Lawsuit!

[@ciscodisco9155]

Should have gotten way more than 200k for something this severe…

[@AQDuck]

Personal data is only valuable when databrokers gets their greasy hands on it.

[@magfal]

200M would be fitting given the situation.

[@ciscodisco9155]

@ imagine the damages if those records got out, would be in the tens of billions easily

[@coletcyre]

Goes to show much value they assign to people's privacy compared to how much they make selling our data

[@ciscodisco9155]

@@coletcyre puts the $ in M$

[@H33t3Speaks]

Wow, giving user interactive chat robots Root Privileges hasn't worked out well. Who would have thought. Please, let us hold hands in stunned silence.

[@RickySupriyadi]

is this azure even Linux?

[@DaveEeEeE-hu7gu]

@@RickySupriyadiit’s a hypervisor dude, can run anything

[@RickySupriyadi]

@@DaveEeEeE-hu7gu ok thanks

[@BoringLoginName]

I'm out of stunned silence. Can I use bewildering contempt instead?

[@thatnerdyuncle]

@@BoringLoginNameI’ve been practicing my shocked look just so I could use it when needed…😱. How’d I do?

[@logananderon9693]

Leave it to Microsoft to do something so stupid it boggles the mind.

[@Ilovecruise]

Heck we have a saying in our team, as long as it’s data being managed by vendor, it’s not our responsibility. (Password managed in self hosted open source key manager with compliant encryption and security - not OK, password stored in OneNote in plaintext - not so good but OK)

[@battokizu]

Well, (chuckles to self), your using microsoft products so of course its unsafe! This includes the entirety of the medical industry so idk. Were all doomed.

[@nomore6167]

@@battokizu "Well, (chuckles to self), your using microsoft products so of course its unsafe!" - It's not like the alternatives are safe. They MAY not be as bad as Microsoft, but that "may" is doing a LOT of heavy lifting.

[@adrianspikes6454]

It ain't just MS they all seem to be slightly more incompetent that previously thought but I blame JS more than anything.

[@enermaxstephens1051]

Anyone else notice that bug bounties often have a habit of not paying? You'll find the bug and they'll say "Oh we already knew about that" then patch it and act like its no big deal.

[@argyelanadam]

That's not a great practice because bug hunters can easily just exploit the vulnerabilities and sell private data instead of getting paid.

[@d76458]

HackerOne got exposed for doing this but the employees would steal the money. Wonder if it ever stopped

[@nielsbishere]

We once reported a GPU bug that could crash your entire pc if you run a shader. They said it wasn't a problem and then without telling us fixed it in an update. We suddenly weren't able to repro it

[@lopiklop]

I think a better question is why does Microsoft AI have access to private medical records.

[@BlackMatt2k]

Medical institutions use 3rd-party developers for their apps, and hire vendors to upload or stream data to cloud services for them to load. There are more rules and paperwork than you can imagine to keep things compartmentalized and "safe", theoretically, but current dev culture attitudes and perverse corporate incentives undermine it daily. My anxiety level has dropped substantially since leaving that industry, cuz you either fight your conscience or fight literally everyone on the call over obvious stuff like this, every day.

[@Silarus]

So they can sift all the data to sell the info to big pharma to better keep people sick so they can make more sales :P

[@nomore6167]

@@BlackMatt2k "There are more rules and paperwork than you can imagine to keep things compartmentalized and 'safe'..." - The problem is that many of those rules don't apply to third-party vendors/data processors. And also, of course, that fines for violating rules are a drop in the bucket compared to the profit made by violating those rules.

[@the-programing]

Microsoft CEO even announced last week that they would replace the entire azure product line with only ai "agents" where the bots would be able to create, update and delete all data on your services on azure...

[@HideBuz]

Nuclear ROLF!

[@lilshippo2799]

what could go wrong? :3

[@TheGunnarRoxen]

AAAAAAAAAAAAAHHHHHH! Screaming ensues.

[@ali32bit42]

imagine a car company doing this, " hello customers ! here at lamborgini, we have decided that steering wheels and cup holders and speedometers and breaks are out dated. so in a brave and innovative move all our future cars including the one you already own will be converted to have no steering wheels . to steer your car simply convince our automatic driving assistance to steer for you at every turn. our agent will swiftly connect to our web server to compute your steering amount for you ! "

[@rory_o]

AI and nodejs. Name a more iconic duo of security terribleness.

[@LeetHaxington]

I’m surprised the microsoft patch wasnt to just ban his ip and then have bugfixes to add his new ip every time

[@rayzlenka4135]

Bruh

[@golvistavarez9946]

Probably was due to AI code being used for the backend! People don’t understand how many security vulnerabilities are to come out from all the AI code being written!

[@daveb3910]

Yup! I work in the HIPPA field and it's surprising how many people want to use AI code, luckily in my business we can't, so it's easy for me to say no, as i can't validate a black box, which step by step validation is required for our data since it directs health decisions, but other fields can and it will continue to produce large vulnerabilities. It's honestly scary

[@slomnim]

And yet google openly says something like 60%+ of its code now is ai generated...

[@RoryEckel]

AI code is fine but it needs an experienced reviewer

[@MaakaSakuranbo]

@@daveb3910 wdym, validate a blackbox. AI code means code you generated via AI, not using AI to write code live? The generated code isn't a black box

[@JasonAtlas]

Its just so much faster to do my own coding then try and catch all of the insane things and ai code might do. Like 95% of the time it's fine 4% it's broken and the last 1% it's doing something genuinely insane. I know what mistakes I tend to make and where to look for them. I've spent a long time learning good practise. The ai has every mistake in recorded history at it's finger tips and usually it's the stuff reviewed enough to not immediately be obvious. Ai coding is a big gamble.

[@arkorat3239]

as if i wasnt already worried by the whole "copilot takes screenshots of your computer"

[@YodaWhat]

Say more on this. And WHICH versions and variants of Copilot? Only the web versions? If so, in which browser(s) does these TOTAL BS exploits occur? Does it also affect the Copilot running inside Skype?

[@arkorat3239]

​@@YodaWhat Been a while ago, but i think its just ordinary copilot. the same that comes with windows 11. Its not really an exploit, its how microsoft desinged it. And it sparked quite the contreversy when word got out, a few years ago.

[@YodaWhat]

@@arkorat3239 - Ah, thanks. I don't use Windows 11 or any of that extra crap even in Windows 10. First thing I do with a new Windows machine is turn that $hit off as much as possible.

[@Silarus]

@@YodaWhat Microsoft Recall will take a screenshot of your Windows 11 pc every 5 seconds and log every keystroke you make. ITS ALL FOR YOUR BENEFIT SO JUST IGNORE IT. - Bill Gates

[@happyducky9872]

Isnt this Recall and not Copilot? Copilot can leverage Recall tho.

[@aaroncarney7733]

Why the hell was it connected to the medical data in the first place?

[@pseudomemes5267]

Selling "insights" about people to ad networks. It's not just knowing what people like anymore. It's knowing all medical conditions to better target them.

[@lopiklop]

Thank YOU! Yes. Hello. These are private medical records.

[@lopiklop]

@@pseudomemes5267 You say that as if they have the right.

[@lopiklop]

@@pseudomemes5267 At which point during my doctor visit did I agree to such a thing? How does it go from a doctor visit to building artificial intelligence? So they're benefiting from my interaction. How much value does MY MEDICAL RECORDS generate for THEIR product?

[@ARockRaider]

​​@@lopiklop it's probably included as part of the Windows EULA, something like "if you have ever used windows for any reason we have the right to gather and sell any information about you" this is obviously a joke, but also not out of the scope of what mega corps think they can get away with through their EULAs (remember that Disney tried to say the EULA for a free trial of their streaming service ment they couldn't be sued for a lethal allergic reaction at one of their parks)

[@V3racious3]

I can't wait to cash my $2.49 check after the lawyers suck all the value out of the class action data breach lawsuit.

[@Some1_Some1_Some1_Some1]

Running arbitrary code on a machine with sensitive data sounds like a recipe for disaster, even when sandboxed... They should definitely give the "running javascript" bit to some other server that only does this. That server can then be isolated from the rest, making any breach somewhat useless.

[@aajas]

One of the great things about being American: I ain't been to a doctor in decades, you got nothin on me

[@jaysonrees738]

Honestly, I wouldn't go that often even if it was free. All they do is try to push pills on me and do a crappy job of finding potential problems. The best medicine is not eating trash, getting some exercise, and enjoying time with friends. That stuff doesn't net piles of money though, so they never bring it up.

[@laulaja-7186]

Couldn’t afford to visit a doctor, same as the rest of us? That can only last so long…

[@jackthehacker05]

*cough cough* free Luigi *cough cough*

[@PanchoPU88]

"AI WiLl RePlAcE SoFtWaRe EnGiNeErS!"

[@paca3107]

the biggest lie of the recent years

[@_Billy]

YoU aRe veRy ShOrt siGhtEd

[@nateh379]

At the same time, Alexnet was just 2012. And ChatGPT was just 2022. Imagine what another 10 years will do.

[@PanchoPU88]

@@nateh379 I'm sorry man but anyone that says that either can't code for sh1t or doesn't realize that if human ingenuity is replaced by AI then all engineers can be replaced by AI, not just the software ones...

[@hello19286]

​@@nateh379 That's all that you can do, imagine. Extrapolating technological breakthroughs doesn't make sense, they don't follow some linear or exponential timeline, they are breakthroughs.

[@snudget]

It seems like QA and security is irrelevant today. The only thing that matters is getting out a semi-broken thing as fast as possible

[@HamidKarzai]

if you take the time to do that stuff right then minimum viable product move-fast-and-break-stuff crowd will eat your lunch with their rapid results and problems that don't show up until later down the line. And since you've now sold a product that constantly breaks you can now as a bonus get even more money out of expensive maintenance/support contracts! how's that for a win-win! disruptive capitalist innovation at its finest

[@TheGreatNoticing00]

MS developers are generally a different flavour today. Same goes for Google. I'd expect less and less from them going forward, as they continue to hire based on "appearance" rather than talent. Maybe I'm a bit salty, but it's true nonetheless.

[@happygofishing]

@@TheGreatNoticing00 They are too busy "doing the needful"

[@vaakdemandante8772]

In a way it has always been like that in the business. In the old days of software, there wasn't so much competition on the market, so you could've focused a bit more on quality, but every established market with competition sooner or later reaches a stage, where you can't spend too much money on perfection and need to earn income ASAP. Software has reached this milestone about a decade or two ago.

[@entropycat]

Microsoft removed all QA teams years ago.

[@Richard-gs6oq]

Sound like a HIPPA violation!

[@your_new_sjw_waifu]

Nah doesn't apply if you have enough money

[@nekonikku]

Don’t be a hippo, it’s HIPAA.

[@yoyoma2831]

What i was thinking too

[@CryptidBuddy]

They have plenty ways around that even if they do actually hold the information. Microsoft isn’t a healthcare provider so they can do what they want.

[@matt_milack]

tHErE wiLL Be nO SuCH thINg aS teCH joBS BY 2030!!!

[@andybaldman]

There will be no people left by 2030

[@coladict]

Oh, once they start using AI-generated code it will get a lot worse. A lot, a lot worse. Security? Never heard of it!

[@Silarus]

@@coladict Wait until AI security is armed with weapons :p

[@Zera-l6x]

​@@Silarus your AI doorbell gonna be fiddling with whether to let the 8ft tall guy with squirrel mask pass your front door or not at 4am

[@CUBEZCUBEZCUBEZCUBEZ]

@@Silarus water

[@test-rj2vl]

Personally I would never ask AI for any serious health issues, even if they were 100% private and 100% secure because if AI happens to hallucinate then I can easily end up on 10x worse situation than I started with. If there is something I don't know how to deal with I would rather go to doctor and get some real advice than for example trying to heal flu by standing uv light and drinking mercury.

[@Winnetou17]

Yup! At least, after the doctor recommends you to stand in UV light and drink mercury, there's a tiiiiny chance it will do some jail. While on the other case, people will just say you didn't put the correct prompt.

[@bunnywar]

It doesn't hallucinate, it's a product not a sentient being. It just uses stolen data based on statistics regardless of accuracy

[@yura34054]

"Little Bobby Tables we call him"

[@Fasteroid]

My name is "help im stuck in a drivers license factory"

[@stevesteve8098]

Simple , it's Microsoft.... they write their programs to just do things... security, safety and non-crashing come later... I went to a MS conference once with their programming team... where they outlined their programming development and internal "mantra" when i left I was completly shocked at how lax they were... They basically write software with as few checks and balances as possible, it just matches the spec & that is it.. when they have to modify the systems for other uses.. they just make changes & fix what visibly breaks

[@YodaWhat]

Are you suggesting that is any different from how ALL big companies write the CRAP they pass off as software?

[@CryptidBuddy]

The Todd Howard mantra I’m guessing

[@howardstern9764]

These Lawsuits need to be far more punitive, there needs to be drastic consequences for exposing and harming so many people!

[@Silarus]

Microsoft is more valuable and important than any human.

[@SeRoShadow]

4:50 - using query code that is not read-only / execute is a security issue

[@era_s]

And it's like ... the FIRST security issue you learn about!! This is truly fucking baffling, but as I've said a million times, this type of thing will only get more and more common as the C-suite MBAs in charge of tech companies trick themselves into thinking they don't need developers any more.

[@privateness.network]

"Can't fix stupid" theory confirmed

[@amigalemming]

In Germany the Bug Hunter would have been sent to jail because of the Hackerparagraph and the bugs would persist.

[@autohmae]

Microsoft has a bug bounty program, my guess is that should keep you safe from that, but I'm not up to date on these specific laws in Germany

[@amigalemming]

@@autohmae No, there is currently a case with the keyword "Modern Solution". A contractor was paid for finding security issues and found unprotected unrelated data. He is officially accused for breaking the law.

[@autohmae]

@@amigalemming I guess if the same could happen, Microsoft would need to report the security researcher to the police. Anyway, crazy stuff.

[@michaelweaver4439]

These are super basic level mistakes, that would never pass a security audit. I am more concerned about the info sec standards of the healthcare organisation that they worked with.

[@watsonwrote]

Healthcare orgs in the US are somewhat notorious for bad info sec, at least compared to the seriousness of the data they own. There have been many instances of them being victims of ransomware attacks and actually needing to pay the ransoms because they had no way to recover the data. IT is often put on the back burner as they don't seem themselves as IT organizations but as communities of health care providers and patients, a brick-and-mortar entity primarily of people interacting with people, which is fair but the technology is moved down the budget hierarchy in ways often disproportionate to its importance in sustaining the organization. At least that was my observation.

[@CryptidBuddy]

I read that something ridiculous like 50% of medical records in existence have already been leaked

[@bitmau5]

So, it's basically like hunting for open folders, in 1997, to dump MP3's on unsecured FTP servers in order to share music. Gotcha.

[@QXY01]

All doctors that dared to upload personal info were compelled. Who is going to pay for this? I would say all corporations and doctors must pay.

[@cassusgames]

Imagine if a certain legend asked for help removing a specific cylinder…

[@commander3494]

Amazing reference

[@jacobeii]

seems rather imperative that it remains unharmed.

[@banukaii]

bro is never gonna be let off the hook for that

[@WiseWeeabo]

Whoever worked on this must be borderline non-functional. Was this whole project just 1 dude? How did not a single person on the team call out this insanity? Insane.

[@aar0n709]

It was made by AI. That’s the thing with AI you can’t sue it or fire it so it just gets away with it.

[@VelociraptorX]

That's why I don't use gadets to monitor my health, our data is incredibly valuable.

[@JeremyAndersonBoise]

People: Why don’t you trust AI tools? Me:

[@jsonstea]

while the services of M$ have been becoming broader and more sophisticated, the quality really keeps going down the toilet.

[@KAZVorpal]

Apostrophe fail.

[@wakedxy]

Well explained. Amazing work

[@DanielBoctor]

Thanks 😊

[@Amipotsophspond]

hackers are such nice people, that hacker could have made everyone's medical records say they tested positive for aids. it's wonderful we have bug bounties and they are paid, hard work was do to earn that small sum of money and the whole world benefits.

[@Itsgone99]

not at all a huge potential conflict of interest down the line if not already...

[@crusher9z9]

they should've added "tested positive for nothing" to all records

[@ggsap]

no, the data is inputted by the customer into azure for their ai services. azure does not access the data directly

[@PunishedFelix]

Wow I can't find a job but these clowns can

[@resekai]

Total Recall and CopePilot+

[@mr.rabbit5642]

Oh wait, hold on, Microsoft doesn't know what the fuck they're doing? With AI?? Noo that can't be right. Again?!?

[@SayfSentinel]

can someone explain exploit 2, specifically the part where the bug hunter modify the underscore module "_.indexOf()", how did he modify it on the azure instance ?

[@What_do_I_Think]

Isn't that also the corporation, which "promises" that making photocopies of your screen all the time does not break privacy?

[@GauteAnimationNorway]

This makes me just think about co-pilot. Microsoft is getting greedy with their data stealing.

[@laulaja-7186]

The omniscient AI has certified that the code was secure. Oops that was a hallucination. Okay delete/ fire that AI and try uploading a new one… which is almost identical, and trained on the same data set. It’s just good business.

[@bigboiexpress]

I wonder if they could have made more then 200k if they would have placed a short position on the stock and informed an hacker group about the holes.

[@alexturnbackthearmy1907]

And also sell the data separately cause more money is always better.

[@thiswillprobhrt]

Can’t help but think the term “updationing” was part of conversations during development of this.

[@classico42]

In case you forget, Microsoft will help you Recall this instantly!

[@quill-j6s]

Videos like these just leave me in awe of how little I know about programming

[@kygagaming]

Omg the vids are back!!!

[@RicoTrevisan]

Brilliant video, thanks!

[@mattp7437]

Welcome back!

[@DanielBoctor]

[@maelcloutier]

Dude i just discovered your channel today and speedrun all your vids, love the content and the way you go in details without losing anyone that know a little abt cybersecurity, definitly got a sub keep up with that content and youll become big we feel your passion and that what make it special! Hope you have a great day my dude !

[@AK-vx4dy]

But this story is not about AI anyway.... AI bot not leak anything, stupid platform architecture and stuipd developers (who maybe were expert in AI but not not in other areas)

[@matt_milack]

Imagine how dumb AI is if leading AI expert developers, engineers and architects are this dumb.

[@Winnetou17]

Yeah, good point! While I'm sure AI will introduce same-level-of-terrible bugs and vulnerabilities, on these 4 in particular it was just bad developers.

[@ChampionMobile]

Nothing can go wrong, go wrong, go wrong

[@Zuranthus]

god these companies are stupid. they want AI to be a thing so bad that consequences be damned

[@yoyoma2831]

Very interesting. Underrated channel, you earned a new sub!

[@boines]

that wild bc most basic thing for sql is to prevent the moving of going back .. as well as doing a ls of a dir row colm etc. failed huge.

[@knarfxd4071]

I know little about software engineering n this kind of crap, but god I love your vids explaining it so clearly. Keep up the amazing work m8!

[@DanielBoctor]

much appreciated, will do

[@talli-studios]

How was the underscore module modified remotely??

[@tylerkauffman589]

Internet Computer: solves this problem permanently

[@SBTRIS]

My take away from this is that nodejs is not secure by default, and needs some careful design and hardening to make it production grade. Compounded with dynamic and super flexible JIT nature of node, it sounds like a nightmare.

[@ShaunHolt-f1c]

*Yep. Mine was stolen and the medical field still tries to harrass me, when they can't even protect my confidential information.*

[@oportbis]

Please make more videos, I'm getting addicted to your explanations

[@mwdiers]

This is straight up malfeasance. It is not caused by AI, but is an classic injection attack using APIs that are not engineered, by design, to sanitize inputs and enforce data permissions regardless of how the LLM calls the agent tool. It's like everything they learned about securing data APIs went out the window as soon as they put the API behind a chatbot.

[@ImperialRoads]

No way the legend is uploading again!!!

[@ultimatums1]

no way people make some unrelated remark about the video.

[@DanielBoctor]

we back

[@howardfairbanks8337]

Excellent video, editing, sound design. You deserve more views (:

[@DanielBoctor]

glad you liked it!

[@T404-i9w]

Why haven't I heard about this? No other videos relating to this topic

[@atxhooligan]

This must be why my organization sprang new AI rules on us recently regarding using AI with any sensitive medical or org info.

[@danny12-j9r]

Remember, when you adopt a package/technology, you adopt all it's flaws.

[@primgrb]

Node js is a menace, dude

[@skyrimax]

Been saying it for years, JavaScript on the server was web development's original sin

[@jbird4478]

​@@skyrimax JavaScript was the original sin. Running it on servers was when we said screw it and let the devil take over.

[@conceptrat]

@5:55 I think you've either misinterpreted how the query injection works or the exploit you copied from wasn't documented correctly. Unless MS has made a mistake with implementation of building a quert. If this is even actually a reality. I feel like it's not. But first the query needs to be completed by providing an escaped ' and ) and then you can initiate the other escaping to insert the transversal and allow the query to be completed again.

[@aldproductions2301]

Why is the back-end in JS instead of a strongly typed language which would reject input and help require data be properly sanitized? Why is the database input not properly sanitized?

[@michaelh42]

Why doesn't NodeJS remove the SlowBuffer class from the Buffer module? It's been deprecated for 8 years and there has been 17 major versions since then. I don't get it.

[@Jeza921]

Data breaches are often the result of errors in system management or configuration, not “automated” AI. More importantly, the responsibility lies with the humans who design, deploy, and monitor the system, not the AI ​​itself.

[@Silarus]

No one has to worry about responsibility or consequences anymore. Broken politicians and legal system.

[@issamelarmi]

Somehow all these big tech companies don't pentest their products... Good for bughunters and black hats

[@voikalternos]

All of them came down to sanitizing input and isolating data... it didn't have to cost nearly as much as 200k , but props for the hacker

[@morthim]

how did they get 100 million records?

[@sown-laughter4351]

sounds like they are doing commands that microsoft does automated meaning microsoft is probably already selling that data

[@dreamhollow]

Microsoft try not to humiliate your entire company with terrible design challenge.

[@HarunFarah]

video qulaity and explanations are amazing ,

[@hannonsb]

Seems very similar to a modern version of SQL injection

[@ContagiousRepublic]

If a company with bad intent and a history of monetizing directly or using for AI training purposes data it doesn't own the rights to do that with? "My AI leaked it" and "this third world company used the leak data and provided us with this trained AI and or customer contact and needs data it said was legit and we used it for monopoly purposes". Well played M$!!

[@dangamez1230]

Personal information needs to be away from any automation. I am not surprised ai messed up.

[@Ad9911io]

This was fascinating

[@pointfrogg]

This sh*t has just been driving my anxiety through the mfing ROOF.

[@UNcommonSenseAUS]

Its not an accident. Wake up fools

[@era_s]

"I'm sure all these tech companies laying off ~10% of their developers will have no impact whatsoever, I mean it's not like those people did anything, right?"

[@qzwxecrv0192837465]

So once again, the super smart programmers of Microsoft allowed direct access to data, rather than buffering it, ensuring encrypted connection between intermediate server & data, as well as not keeping the AI software isolated from important data. Also, adding directory capabilities within a URL, rather than having the server or data server do the searching has been a known exploit/issue for decades. You never allow directory level execution or maneuvering at the URL level AND we have become so dependent on showing URL data, that this type of thing will happen due to sloppiness. as the old adage goes: it isn't the new guy that gets hurt (makes serious errors), it is the experienced person because he becomes so confident in his experience

[@aar0n709]

It was AI don’t blame the SWEs at MS for this

[@johnmarianhoffman]

This is criminally negligent. We, the people, need to hold companies and CEOs (corporations aren't people, but people run corporations) for software negligence. This data literally represents peoples lives, not bargaining chips for business deals.

[@johnmarianhoffman]

Its obvious our government doesn't understand enough to hold them properly responsible

[@nostalgicuser]

"a" hacker "A" hacker, several people have shown how easy it is to do

[@any1alive]

sooo, they wernt sanitisign inputs? still watchign,.t hats A ENTRY LEVEL SECIURITY ISSUE and bug

[@darshpatel6508]

Great video man! So cool that I know this guy in real life.

[@DanielBoctor]

LOL, what a guy

[@iGame3D]

Where do we sign up for the class action suit?

[@adziak]

Now imagine that government of Poland keeps data on Microsoft Azure cloud.

[@shapelessed]

"one of the highest paid bug bounties" - Have you seen NSO's payouts...?

[@brentsaner]

That is...certainly a way to pronounce "JavaScript" that I haven't heard before.