Wiz Blog

This deal isn't about security, it's about data.

Google already have one of the best security teams in the industry - Project Zero [0]. They don't need Wiz's "enterprise" expertise for security.

This deal is about DATA. Wiz, as a cybersecurity vendor, have full remote access to their customers cloud compute storage (EC2 EBS volumes, etc) in the name of "security scanning" - this is actually part of their unique selling point - "agent-less scanning" which is unlike traditional security tools that require an agent installed in the OS. Instead, Wiz is able to just clone your full data volume and scan it locally in their cloud accounts/VPC.

With this deal Google has bought a ton of confidential data from Wiz's customers without their explicit knowledge or approval, and they will use it to improve Google's AI models like Gemini and probably several other products.

A year ago Google struck a $60M/yr deal with Reddit to exclusively license their content [1] for the same reason, and that data is probably much smaller and less valuable than the data Wiz has access to from their customers, which include companies like Morgan Stanley, DocuSign, Slack, Plaid, and others. [2]

Sources:

0: https://googleprojectzero.blogspot.com

1: https://www.reuters.com/technology/reddit-ai-content-licensing-deal-with-google-sources-say-2024-02-22/

2: https://www.wiz.io/customers

"Not really true"?! TRUE AS HELL! "Outlook New" LITERALLY DOES THAT! It's an infostealer. Microsoft gets your login info and downloads your mails, contacts and calenders to its own servers!

How this app is legal and not marked as malware is beyond me! It's the biggest information heists in history!

https://www.heise.de/en/news/Microsoft-lays-hands-on-login-data-Beware-of-the-new-Outlook-9608798.html https://cybernews.com/privacy/new-outlook-copies-user-emails-to-microsoft-cloud/

> If they betray trust on such a scale, and we find out, they'll be out of business.

The decision makers don't care. They could eat children and they still would buy from them.

https://www.wiz.io/blog/storm-0558-compromised-microsoft-key-enables-authentication-of-countless-micr

There are so many that it's just not funny. :(

• https://www.nbcnews.com/tech/security/scathing-federal-report-rips-microsoft-shoddy-security-insincerity-res-rcna146177

• https://www.wiz.io/blog/bingbang

• https://www.theverge.com/2023/7/12/23792371/security-breach-china-us-government-emails-microsoft-cloud-exploit

• https://www.wiz.io/blog/midnight-blizzard-microsoft-breach-analysis-and-best-practices

These are just the first few I've found for the last 12 months.

There are more if you go back even 12 months further, and I'm pretty sure the above aren't the complete list for the last year anyway.

Microsoft are actually really bad at this Cloud "security" thing. :( :( :(

Here are few big ones from the past 12 months.

https://www.wiz.io/blog/bingbang

https://www.theverge.com/2023/7/12/23792371/security-breach-china-us-government-emails-microsoft-cloud-exploit

https://www.wiz.io/blog/midnight-blizzard-microsoft-breach-analysis-and-best-practices

I would agree, the Windows OS has really matured since XP, from a security perspective at least.

I would definitely expect better than this from a tech giant like MS. When was the last time Google, Meta, or Apple got breached like this?

Edited to add, I think them open sourcing some security training is good, it benefits everyone whether or not MS themselves are a great example of a secure company.

I found these references to Mullvad and TeamPCP

>The whole operation ran primarily from Mullvad VPN exit nodes and virtual private server infrastructure, with little effort made to blend in. This was a high-tempo, low-stealth campaign designed to extract as much value as possible, as fast as possible.[1]

>Wiz CIRT observed the bulk of TeamPCP’s activity originating from Mullvad Virtual Private Network (VPN) exit nodes and virtual private server hosts such as InterServer.[2]

1: https://www.oligo.security/blog/teampcp-campaign-the-evolution-of-modern-supply-chain-attacks

2: https://www.wiz.io/blog/tracking-teampcp-investigating-post-compromise-attacks-seen-in-the-wild

Found following from the links from the post:

2023-07: Hackers stole a Microsoft Azure Active Directory certificate which gave them full access to basically all Microsoft cloud services including Outlook, Office, SharePoint, Teams, "Login with Microsoft", and so forth. (MS blog entry [1], Source[2], German source)

Also the following:

https://infosec.exchange/@briankrebs/110820474957163710

Quite damning if true.

[1]: https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/
[2]: https://www.wiz.io/blog/storm-0558-compromised-microsoft-key-enables-authentication-of-countless-micr