Pentagon and Microsoft are investigating leak of military emails

I remember reading about this big Pentagon cloud contract a few years ago. I recall thinking to myself how this was going to end, well, kinda like this:

The Defense Department and Microsoft are investigating an error that exposed at least a terabyte of military emails including personal information and conversations between officials, people familiar with the matter said, an episode that highlighted the security risk of moving sensitive Pentagon data to the cloud.

Pentagon and Microsoft are investigating leak of military emails

The emails contained conversations between Pentagon officials as well as completed SF-86 forms, which government employees are required to fill out to obtain security clearances.

www.stripes.com

Really? You put the entire DoD's sensitive data out in the world in a cloud owned and controlled by a commercial business. And Microsoft of all companies. What could possibly go wrong? I wouldn't trust Amazon much further had they won. Maybe with Google they might have stood a chance.

The exposure may have resulted from a configuration error with Microsoft’s server that left it publicly accessible, two of the people said. They had differing assessments on who was at fault, with one saying it was the fault of a Pentagon employee and another saying Microsoft was to blame.

How long until hackers do it again? They made it super easy for them this time.

 

[PeoplesElbow]

Not sure there is any truth to it, but I have heard of contractors cloud servers being in India, that sounds secure.

 

[DaSDGuy]

"Maybe with Google they might have stood a chance."

Bwaaahaaaahaaaa!!!!!

And I have some land just south of Point Lookout for sale, cheap.

 

[3CATSAILOR]

I remember reading about this big Pentagon cloud contract a few years ago. I recall thinking to myself how this was going to end, well, kinda like this:

Pentagon and Microsoft are investigating leak of military emails

The emails contained conversations between Pentagon officials as well as completed SF-86 forms, which government employees are required to fill out to obtain security clearances.

www.stripes.com

Really? You put the entire DoD's sensitive data out in the world in a cloud owned and controlled by a commercial business. And Microsoft of all companies. What could possibly go wrong? I wouldn't trust Amazon much further had they won. Maybe with Google they might have stood a chance.



How long until hackers do it again? They made it super easy for them this time.

Nothing sent electronically is really safe. People are a fool to believe it is. Even if it has a "https", the S meaning secure. Government so called "secure" web sites are hacked all the time. Most attempts fail. Other attempts do not. Sometimes it is noticed right away and corrected. Other times it is not. The recent Chinese balloon over our Nuclear sites may very well have planted a virus in the launch codes and other electronic components of our nuclear silos without else ever knowing it. In fact, we could never realize it until it is "too late". Our electrical grid is another concern that should have been far better protected decades ago. For whatever reason, as a Nation we are more concerned about propping up other Nations at U.S. taxpayer expense rather than to fortify our own power grid and our own defense. We give hundreds of billions to Ukraine and perhaps other Countries, not advertised as much. However, we leave ourselves weak and vulnerable. The glaring weaknesses is now so obvious over the long term as it has been, it is starting to appear intentional.

 

[David]

More:

The U.S. Department of Defense secured an exposed server on Monday that was spilling internal U.S. military emails to the open internet for the past two weeks.

The exposed server was hosted on Microsoft’s Azure government cloud for Department of Defense customers, which uses servers that are physically separated from other commercial customers and as such can be used to share sensitive but unclassified government data. The exposed server was part of an internal mailbox system storing about three terabytes of internal military emails, many pertaining to U.S. Special Operations Command, or USSOCOM, the U.S. military unit tasked with conducting special military operations.

But a misconfiguration left the server without a password, allowing anyone on the internet access to the sensitive mailbox data inside using only a web browser, just by knowing its IP address.

Sensitive US military emails spill online | TechCrunch

A security researcher told TechCrunch that a government server was exposing military emails to the internet because no password was set.

techcrunch.com