Cisco Talos, a key partner in ongoing security research, recently published findings discovered in the development environment for Azure Sphere devices. After reviewing the findings on TALOS-2021-1341 and TALOS-2021-1344, Microsoft believes the approach described is implemented by design and does not present a security risk to customer production environments. These findings are unique to the development environment experience, which requires physical access to a device. Neither Cisco Talos nor Microsoft security experts have been able to reproduce the findings in the managed pre-production or production environments. We do not consider these particular findings to be vulnerabilities that affect customers with deployed devices at this time. Customers do not need to be concerned about devices in production: once a device moves from development mode to production mode, all applications are erased.
The Cisco Talos findings have value in describing the Azure Sphere system and in inspiring future researchers who may investigate this part of the system. We encourage their publication. As part of our dedicated processes for security assurance, we work with security researchers to help us uncover any potential vulnerabilities in our products and services. This partnership started with our Azure Sphere Security Research Challenge in 2020, in which Cisco Talos submitted the highest number of bounty-eligible cases. Cisco Talos has been an excellent partner and has continued to uncover vulnerabilities in Azure Sphere even since the conclusion of the Azure Sphere Security Research Challenge; vulnerabilities we’ve eagerly fixed and for which have issued CVEs.
Azure Sphere is a solution that combines hardware, a security-hardened operating system, and cloud-based security. The Azure Sphere pre-production and production environments are managed environments in which a device is subscribed to an application feed for which only signed OS and application updates are permitted to run on a device. Separate from these cloud environments, a device can only be claimed once to a tenant and only a developer with the right access privileges, such as admin or contributor, can put the device into development mode. When a device is unlocked for development, we do permit developers to exchange signature validation components in order to troubleshoot issues from expired packages or from future packages that would otherwise not pass validation. Devices can only be unlocked into development mode when physical access is available, and any changes would affect only that singular device. All applications—temporary or not—installed by the app developer are deleted upon reboot as a function of the OS itself when a device is reverted from development mode.
Microsoft and Azure Sphere continue to invest in the important work of security researchers such as Cisco Talos as part of our commitment to continually evaluating our security promise. Engaging with security researchers to uncover vulnerabilities is just one part of our holistic approach to cybersecurity: we continually assess our ability to help our customers manage risk and keep their businesses protected over time.
