#HITB2023HKT D2T2 - Breaking ML Services: Finding 0-days In Azure Machine Learning

This talk presents security research into Azure Machine Learning (AML) service, discovering multiple critical vulnerabilities in cloud-based ML infrastructure. The speaker, Nes from Trend Micro, structured findings across four chapters of investigation.

**Overview and Motivation** The research began after observing a pattern of Jupyter Notebook-based service vulnerabilities across major cloud providers. The speaker investigated Azure Machine Learning—a widely-deployed ML-as-a-service platform underlying Microsoft's cognitive and applied AI services—revealing multiple classes of credential exposure and authentication bypass issues.

**Key Vulnerabilities Found**

1. **Credential Logging in Clear Text**: Storage account primary access keys appeared in Azure Batch startup task error logs and authorization logs. These credentials were also stored as environment variables (named PASWD) in agent configuration files, accessible because the default azure-user has sudo privileges without password requirement.

2. **JWT Token Exposure**: User authentication tokens appeared in URL parameters during Jupyter terminal requests and were logged in plain text in nginx access logs. These tokens could be captured via network traffic inspection and belonged to the compute instance owner.

3. **Network-Adjacent Information Disclosure (mlc)**: The DSi Mount Agent running as root exposed an unauthenticated API on port 46802 within virtual networks. Network-adjacent attackers could enumerate installed services and access their logs, including commands executed via sudo that contained embedded credentials for mounting file shares.

4. **Managed Identity Token Extraction from Non-Azure Environments**: The speaker demonstrated that certificate and private key files from compute instances, combined with environment variable configurations, enabled extraction of Azure AD tokens for managed identities from outside Azure environments. This contradicted documented design principles stating only Azure resources should fetch such tokens. Both system-assigned and user-assigned managed identity tokens were obtainable.

5. **Persistent Storage Account Access After Key Rotation**: Even after rotating storage account keys, attackers possessing the certificate, private key, and environment files could continue accessing workspace secrets. The workspace automatically synchronizes new keys, making traditional rotation ineffective against this threat model.

**Technical Architecture Details** Compute instances are managed Ubuntu VMs in Microsoft subscriptions running multiple agents for mounting, monitoring, and identity management. Authentication flows through Azure Active Directory to generate ARM tokens, subsequently generating AML tokens. Data stores use credential-based authentication (storage account name plus primary key) to mount Azure File Shares across all compute instances by design. The nginx proxy on port 44224 handles incoming requests and forwards them based on the XMS-Target-Port header without logging sensitive information.

**Compromise Chain and Risk Model** The speaker presented a scenario where a single compute instance breach could expose: other users' notebooks and scripts (stored in shared file shares by design), storage account credentials enabling full workspace access, managed identity tokens for lateral movement, and audit trails that appear identical for legitimate and malicious access patterns.

**Research Attempts Without Finding Exploitable Vulnerabilities** The speaker also explored container escape in Azure Jobs, cross-tenant scenarios, dependency confusion attacks, and Jupiter implementation misconfigurations (beyond JWT logging) without discovering additional vulnerabilities.

**Microsoft's Remediation** Addressed issues included masking credentials in logged commands, preventing JWT tokens from reaching compute instances, restricting DSi Mount Agent port exposure through nginx proxy and certificate verification, and implementing additional authentication requirements.

**Key Recommendations** Deploy through virtual networks and private endpoints, enable comprehensive cloud logging and monitoring, scope managed identities to least privilege principles, monitor for unauthorized certificate usage, implement threat modeling for cloud environments using frameworks like Atlas for AI systems, and follow defense-in-depth strategies acknowledging the shared responsibility model.