The Many Roads to a Cybersecurity Career: How These Experts Found Their Way Part 1October 7, 2020
Create New Revenue Opportunities with Intelligent Wi-FiOctober 7, 2020
Cisco Talos reports 16 vulnerabilities in Microsoft Azure Sphere’s sponsored research challenge.
By Claudio Bozzato and Lilith [-_-]; and Dave McDaniel.
On May 15, 2020, Microsoft kicked off the Azure Sphere Security Research Challenge
, a three-month initiative aimed at finding bugs in Azure Sphere
. Among the teams and individuals selected, Cisco Talos conducted a three-month sprint of research into the platform and reported 16 vulnerabilities
of various severity, including a privilege escalation bug chain to acquire Azure Sphere Capabilities, the most valuable Linux normal-world permissions in the Azure Sphere context.
The Azure Sphere platform is a cloud-connected and custom SoC platform designed specifically for IoT application security. Internally, the SoC is made up of a set of several ARM cores that have different roles (e.g. running different types of applications, enforcing security, and managing encryption). Externally, the Azure Sphere platform is supported by Microsoft’s Azure Cloud, which handles secure updates, app deployment, and periodic verification of device integrity to determine if Azure Cloud access should be allowed or not. Note however, that while the Azure Sphere is updated and deploys through the Azure Cloud, customers can still interact with their own servers independently.
The post 90 days, 16 bugs, and an Azure Sphere Challenge appeared first on Cisco Blogs.