Microsoft offers $100k to hack its custom Linux OS

https://www.theverge.com/2020/5/6/21249038/microsoft-azure-sphere-bug-bounty-security-hacking

by doener • 6 years ago

136 58 6 years ago

Businesses like Starbucks are rolling out Azure Sphere to secure its store equipment, which feeds back data points on the type of beans, coffee temperature, and water quality for every shot of espresso.

I understand detailed feedback on huge multi-million dollar industrial machines where proactive maintenance based upon massive ML datapoints can save unexpected downtimes with millions in damage, but on coffee machines?!

krageon• 6 years ago

You could subtly vary these factors remotely (and per shop), then use a customer feedback form per shop to see which one makes people most happy. Perhaps you could combine this with the hardness/composition of the water so you get the right coffee every time.

giancarlostoro• 6 years ago

If it means a guaranteed perfect cup of coffee then by all means why not? I hate when I go to a place I am used to getting decent coffee at and it comes out tasting terrible.

Endlessly3• 6 years ago

(1) Food safety issues could literally kill Starbucks

(2) Starbucks business depends on having those measurements for quality control

(3) Starbucks gets lots of vendor deals from partner companies because they are a well know brand and having them on board helps land more deals

(4) Hacker using the machines might be able to sabotage the stories; food poisoning, fires, etc

(5) The smarter the tech in store — less training required per employee on site.

(6) Starbucks has other plans for it, such as enabling customers to use their network for IoT devices

(6) etc.

thefounder• 6 years ago

> The smarter the tech in store — less training required per employee on site

We know that the larger the attack surface the more likely is to get hacked so if Starbucks really cares about everything you said (i.e food safety issues) it should hire more people and less machines.

at_a_remove3• 6 years ago

I will offer an observation here: franchise production of food and drink relies upon homogeneity. Sometimes, people go out for something new, but often people want the same old thing. Someone across the country in a strange bed, where their accent sticks out, might want something familiar, and that is the experience of McDonald's in the United States. I could go from one corner of the country to another and the burgers would taste identical.

And so, people want replicable coffee drinks. And coffee can be a fickle beast to brew. Given that, unlike McDonald's which can freeze and ship, you must go from bean to drink on premise in a matter of minutes, I could see a focus on trying to ferret out a way to make that expensive cup taste the same from Portland, Oregon to Portland, Maine.

Endlessly3• 6 years ago

Oddly, globally, Starbucks around the world are not the same; for example, the percent of fat in the milk differs from region to region.

WhyNotHugo2• 6 years ago

McDonald has very different menus in different regions, as does starbucks.

I remember visiting NY and being fascinated by many of the options I've never seen in other countries.

ValentineC• 6 years ago

Given that, unlike McDonald's which can freeze and ship, you must go from bean to drink on premise in a matter of minutes, I could see a focus on trying to ferret out a way to make that expensive cup taste the same from Portland, Oregon to Portland, Maine.

There's a 2013 article on why 30% of Michelin-star restaurants went with Nespresso, which seems to have consistency down: https://www.grubstreet.com/2013/03/nespresso-sold-at-micheli...

nicesave• 6 years ago

I thought a lot of other large "fast food" retailers do the same for their equipment? Chik-fil-a does something similar for quality control and some predictive cooking if I recall correctly.

avianlyric2• 6 years ago

Well if your companies entire raison d'être is to serve coffee, then you’re gonna spend the cash to make sure your coffee machines are in tip-top shape.

It would be weird if Starbucks wasn’t investing in their coffee machines. Make me wonder what they were spending their money on.

dqv• 6 years ago

I think this might be a barista thing. A while back an espresso machine with open source software was posted here.[0] It has all kinds of data. And I've seen baristas wanting very specific parameters for making coffee (e.g. making pour-over coffee with exact weights, volumes, temperatures, bean grind durations). I imagine (but of course could be wrong) there are baristas at the top in Starbucks who find this data important.

[0] https://decentespresso.com/downloads

loltyler1• 6 years ago

Soooo much money, what a time to be a sec-expert! </s>

kabes• 6 years ago

If you manage it in a day... Even if you take a month.

Problem with these kind of things is you never know how much time you're gonna spend. I was pretty active in this scene when I was going to University and had nothing better to do. But now I don't want to risk a month of my time and potentially end up with nothing. I guess people who compete in these things already have an exploit at hand to start with.

zerr• 6 years ago

This reminds me about pentesters being jailed awhile ago.

polskibus• 6 years ago

Azure Sphere OS source code doesn't seem to be on GitHub. You can find it here though (filter for Azure Sphere) https://3rdpartysource.microsoft.com/

0xJRS• 6 years ago

https://github.com/crpietschmann/AzureSphereOS

A4ET8a8uTh02• 6 years ago

I am amused that MS has its own Linux flavor, but I won't make a joke about it. I won't mention previous attempts at embrace, extend and extinguish.

I want to focus on the IoT part.

Do not get me wrong. I am glad MS tries to show they care about security in IoT space. Heavens know I don't want to see Starbucks microwave botnet in 2021.

erikbye3• 6 years ago

I won't mention previous attempts at embrace, extend and extinguish.

Except you did, and it's really trite.

fattire• 6 years ago

Is it trite to mention the Halloween documents?

https://en.m.wikipedia.org/wiki/Halloween_documents

fortran77• 6 years ago

So I guess you don't believe in truly open source and free software. Where everyone, regardless of motive or position, has equal access to it.

linuxftw• 6 years ago

Everyone has equal access, but that doesn't imply we ever have to trust anyone that uses or creates free software. You're free to make it, we're free to never use it and not trust you, and if there's anything of value, we'll ensure it gets into the hands of people we trust, and not you. (The use of 'you' here is in the imaginary 3rd person, not you specifically).

A4ET8a8uTh02• 6 years ago

I did not argue that. I like their current efforts. But as with most things, best predictor of what people do is checking what they have done in the past. In this case, they have attempted to capture an emerging competing OS and effectively destroy it. I would be silly for me to simply forget the past.

They have access. I am not arguing against it. I have memory of what they have done. Should I just forget it?

rstuart4133• 6 years ago

It might well be embrace, extend, extinguish. But if so, in this instance it isn't Microsoft's doing it.

The embrace started long ago, with things like Samba, a free implementation of vfat, Wine and Active Directory. Extend also started long ago, with things like, getting gcc to run on it, cygwin, the LAMP stack, Firefox - lots of things that let Windows do things only Linux boxes could do, and for free.

Then came extinguish. WinCE followed by WinPhone, and now 1/2 of Azure runs Linux boxes which I guess pretty much signals the fate of Windows on the server arena. Whereas two decades ago most computers an end user interacted with run Windows now they don't.

fnord1232• 6 years ago

Win win. Flag not captured: MSFT is secure! Flag captured: Linux is insecure.

INTPenis2• 6 years ago

It's actually a specific offer regarding two Microsoft initiatives, "the Pluton security subsystem or Secure World sandbox".

Almost as if they assume Linux can be breached, but not their fabulous software. ;)

munchbunny• 6 years ago

That's really cynical. It could also just be that bounties like this are a useful way to improve security of software.

Linux's security isn't in question anymore, certainly not among developers who would be choosing whether to use Azure Sphere. Linux has been battle-tested for decades, and Linux already won. This is Microsoft embracing it, for better or for worse. And frankly I'd rather have a Microsoft Linux distro on my fridge than a slimmed down version of Windows.

I'd rather just have a plain old fridge, honestly, but we're talking about IoT OSes right now.

fnord1232• 6 years ago

That's really cynical.

Of course. This is Microsoft. The memory of the culture of Gates and Ballmer is not erased.

And frankly I'd rather have a Microsoft Linux distro on my fridge than a slimmed down version of Windows

Referencing security of fridges reminded me of this https://www.youtube.com/watch?v=BnKpNVHw-TQ :)

INTPenis2• 6 years ago

Clearly they've put a lot of work into this and are willing to pay out for a "3rd party audit" so to speak.

But my schadenfreude is hoping for an outcome similar to what happened to an old co-worker of mine back in 2005.

He was a Windows nut and we were always in a friendly competition about which ecosystem was the better one. One time he had done a bunch of modifications to his own laptop OS, IDS, and tweaking services to have a slimmed down install with a web server. When he was happy he told me "tell your hacker buddies to try and hack this website hehe" :D

He had put up a simple website offering 1000 USD for hacking into the server it was hosted on. His own personal work laptop, with a bunch of other sensitive stuff on it.

I said, ok... And posted it on a certain mailing list that I won't mention.

We sat opposite each other and within 10 minutes I saw him bend down towards the screen with a worried look on his face. Tapping frantically on the keys.

Within another 10 minutes he had disconnected the computer from the internet and said the challenge was off. :D

Apparently his IDS had been throwing up warnings about md5 checksums being changed left and right. That's all we figured out about it. I was 16 years younger so he didn't want to share much more with me.

graham_paul• 6 years ago

Any chance I can get the name of that mailing list via PM?

irishcoffee• 6 years ago

Can I piggy back off this request as well?

erikbye3• 6 years ago

How about we stop using HN's comment section to tell irrelevant-to-the-story personal anecdotes? This is basically the top/most upvoted comment of every article. Surely I can't be the only one to notice this trend?

wtetzner• 6 years ago

I don’t see why it’s a problem. If it’s the most up-voted, then clearly people find it interesting.

vorpalhex• 6 years ago

HN is generally focused on thought provoking discussion. Anecdotes can be very thought provoking.

duxup4• 6 years ago

I feel like his choices by using a device that is for work ... kinda automatically makes me question what if anything we can learn from a technical perspective.

If his judgment is that bad on a basic level, how bad must it be on a technical level?

wahern• 6 years ago

Many people confuse absence of evidence (of insecurity) with evidence of absence (of insecurity). Just look at the SARS-CoV-2 reporting in January and February, where every major media outlet copied stories about how the flu is much worse and that we should really be worrying about the flu. It was patently ridiculous to be making such assertions as the only thing certain at the time was the depth of our uncertainty.

The dilemma is that equating absence of evidence with evidence of absence is actually a good long-term strategy in our day-to-day lives. Without this strategy we'd be paralyzed by our own ignorance; particularly, paradoxically, those aware of their ignorance. It's a meta-skill to be able to identify when the heuristic should be discarded in favor of more rigorous analytical thinking. A capacity for analytical thinking isn't sufficient by itself, thus making such an error in judgement doesn't necessarily imply an absence of strong analytical thinking skills. (At least, that's what I tell myself ;)

gentleman11• 6 years ago

Did not know they offered a custom Linux OS.

What is the strategy here, to make a Chromium like play where the project is open but for practical purposes everyone just uses Chrome? That might not be terrible for the ecosystem

xnyan• 6 years ago

Multiple custom Linux OSes at this point. WSL2 is a custom, mostly transparent Linux VM tailored to fit nicely on desktop windows for developers.

The play (as I see it) was that losing mobile really shook them, and now they have no sacred cows to protect. Developers want and need to develop on linux, so microsoft is making that happen so that they can keep selling software.

duxup4• 6 years ago

How do they usually run these?

Folks apply and then does MS provide each accepted applicant a separate target and some level of access to verify if they were successful?

egberts12• 6 years ago

So it’s based on Ubuntu 19.1.

Mmmmmm.

CraftThatBlock2• 6 years ago

Can you provide a source? I could find any references looking at the source. Also, that's not an Ubuntu version

egberts12• 6 years ago

https://github.com/crpietschmann/AzureSphereOS

Ubuntu.

nickysielicki• 6 years ago

Yocto-based. Nice, at least they're doing that part right.

Microsoft offers $100k to hack its custom Linux OS

Related Stories