161–170 of 171 posts
Earlier quoted context omitted.
That’s why they usually have backup keys that you physically keep in a safe place.
That sounds decent but I've not seen this a lot. Its often just "give us your phone number and we'll SMS you an access key when you log in"
I did a penetration test for $NATIONALINSURER and they had an FTP site with weak credentials where all the remote offices uploaded claims. Millions of records and scans of SSNs, home addresses, bank information, etc. Their mitigating controls were: we put it behind a firewall. Then again I didn't expect much, their MSSQL in prod had SA/SA credentials active.
I'm currently fighting against management dragging their feet on using 2FA. On HIPAA PHI. (I know HIPAA doesn't actually mandate 2FA, but it's recommended by many best practices and guides.) Apparently some tech folks don't like the inconvenience of 2FA.
Many of the recent attacks I've seen simply bypass it altogether in favor of phishing or other traditional techniques.
Clients (Ansible?) simply don't work with it or do it well, which leads to hacks that undermine your 2FA deployment anyway-- rogue admins opening reverse tunnels to allow file transfers, webshells, etc.
Earlier quoted context omitted.
I think this gets to the crux of the issue. It's not about using hard-to-guess UUIDs[0], but restricting access to the underlying data[1]. [0] https://en.m.wikipedia.org/wiki/Security_through_obscurity [1] https://en.m.wikipedia.org/wiki/Access_control
It's not really security through obscurity. In these case I understand the ids where related to data that the company was making available to users through email links. A cryptographically secure 128bit UUID is impossible to guess, no more than a cryptographic access token. Now of course, you would probably rather want to have an authentication scheme on top of that, but that comes at a support cost in term of custom…
And a side note: I wouldn't trust that the prng for your UUIDs are cryptographically secure. That's not a part of the spec.
Earlier quoted context omitted.
that is a good idea but most of the time I need to hand over my actual ID, and not just a scan of it
Yeah, like most doctors offices will take my license with my insurance card, and they scan them into their own systems to associate with my record. No opportunity to insert my own add on content. Just hope whatever SaaS based patient management system they have is iron-clad secure. (But it isn't)
Earlier quoted context omitted.
In my experience, many tables don't have a userid on the table that would be associated with the user. It would be a table join or two or three away. So the developer may think it is safe to say select value from stock positions left join account on account.id = stock position.id left join user_accounts on user_accounts.accountid == account.id left join users on user_accounts.userid == user.id where user.id == sessio…
If the cookie is spoofed and someone got another clients authorization token, then they would get any documents that user was authorized to see anyway. But you don’t do cookie.userid. You send the username and password to an authentication service which generates a token with a checksum. The token along with the username and permission is cached in something like Redis. On each request, middleware gets the user infor…
Where does one go to learn how to not cause this one day?
OWASP Top 10 list. OWASP's website is kind of a mess in my opinion, but there are numerous external write-ups about the top vulnerability types. https://www.cloudflare.com/learning/security/threats/owasp-t... Also this github repo maintained by OWASP seems pretty exhaustive. The cheatsheets directory has a lot of different vulnerability classes. https://github.com/OWASP/CheatSheetSeries/blob/master/cheats... This "In…
Programmers fault? Audits fault? Securities fault? Pentesters fault? It fault? Listen until C-level funds these programs properly and security is taken seriously by all issues like this will forever be in the news. I would be willing to bet their security like most have a long list of security gaps they cant get fixed because resource issues just hope they documented or it could fall on them. Most coding classes just…