Attached: 1 image
So, Microsoft is silently installing Copilot onto Windows Server 2022 systems and this is a disaster.
How can you push a tool that siphons data to a third party onto a security-critical system?
What privileges does it have upon install? Who thought this is a good idea? And most importantly, who needs this?
#infosec #security #openai #microsoft #windowsserver #copilot
No enterprise is going to want to deal with that and realistically they’re the only ones with the pockets to fight that battle. Hope I’m wrong though. Microsoft needs a swift kick in the ass.
Or if CoPilot starts exfiltrating data to Microsoft so their server farms can ‘analyze’ it.
I’m not heavily involved in the space, but I’m given to understand that MS isn’t very clear about what happens to your data or how it gets used or shared.
Perhaps Microsoft will be smart enough not to allow the general public to query trade secrets or government data that’s been pulled via unwanted copilot integration.
But maybe the ongoing Russian hack of Microsoft will make it irrelevant, because the servers can be accessed directly.
Or perhaps at some distant time, Microsoft will roll out features or technologies developed using an internal version of CoPilot that has access to all data - including proprietary information from competitors.
And that’s not even counting what ISP’s will do if they find a way to analyze copilot traffic, or what state actors will do if they can set up MitM attacks for Copilot.
Honestly, I sort of fear the repercussions, but I look forward to the lawsuits.
There’s no need to degrade performance to get a lawsuit, the simple fact of extrading data can get you in a tribunal, especially from customers with high privacy requirements, or with European sovereign clouds certifications
That’s a lawsuit waiting to happen.
No enterprise is going to want to deal with that and realistically they’re the only ones with the pockets to fight that battle. Hope I’m wrong though. Microsoft needs a swift kick in the ass.
If introducing Copilot to server degrades service enough to trigger an SLA downstream, you can absolutely bet lawyers will get involved.
Or if CoPilot starts exfiltrating data to Microsoft so their server farms can ‘analyze’ it.
I’m not heavily involved in the space, but I’m given to understand that MS isn’t very clear about what happens to your data or how it gets used or shared.
Perhaps Microsoft will be smart enough not to allow the general public to query trade secrets or government data that’s been pulled via unwanted copilot integration.
But maybe the ongoing Russian hack of Microsoft will make it irrelevant, because the servers can be accessed directly.
Or perhaps at some distant time, Microsoft will roll out features or technologies developed using an internal version of CoPilot that has access to all data - including proprietary information from competitors.
And that’s not even counting what ISP’s will do if they find a way to analyze copilot traffic, or what state actors will do if they can set up MitM attacks for Copilot.
Honestly, I sort of fear the repercussions, but I look forward to the lawsuits.
I thought the Microsoft technologies designed to allow anyone to access your servers were called Exchange and Active Directory.
Please explain more.
I’m not confident they are authoritative on the matter.
Don’t consider me to be, either, but I have more details in my response to them.
https://lemmy.sdf.org/comment/10635782
I read their message as a joke that AD was an easy vector for an adversary
Yeah… I realized that like an hour later, and couldn’t figure out how to respond appropriately. Then I forgot all about it because ADHD.
But yeah. I definitely got whooshed here.
In my defense, I guess I wasn’t expecting to see a joke in the thread, so … well, I didn’t see one.
There’s no need to degrade performance to get a lawsuit, the simple fact of extrading data can get you in a tribunal, especially from customers with high privacy requirements, or with European sovereign clouds certifications