Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

strix.ai

Post reply on HN
Print view View original

61–70 of 112 posts

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#61

Post by c2h5oh »

mcoliver wrote: post #46

I've seen this at so many startups (and worked to patch the gaps and put in best practices) including those backed by top tier VCs. The problem is that it is rare for startups to have security minded people. It's usually designers, people who can raise money, and generalists who can stitch together apis. It's not generally platform, db, or security minded people. The proliferation of things like vercel and supabase h…

More often than not security minded people are encouraged to focus on things that get the product to market faster instead.

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#62

Post by The_Blade »

mcoliver wrote: post #46

I've seen this at so many startups (and worked to patch the gaps and put in best practices) including those backed by top tier VCs. The problem is that it is rare for startups to have security minded people. It's usually designers, people who can raise money, and generalists who can stitch together apis. It's not generally platform, db, or security minded people. The proliferation of things like vercel and supabase h…

> So you get people deploying API keys client side and dbs without rls. Or deploying service keys client side when they should be anon. I mean really basic stuff.

Claude Code will do this, and actively encourage bypassing any verification before pushing to prod. I saw that first hand with its attempted handling of a major CIAM provider, and then Vercel using whatever OAuth provider in the ol' transitive breach

That is common knowledge now, right? Or am I just smoking yellow tops

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#63

Post by SkyGuard_Lead »

janice1999 wrote: post #20

Finally the AI security startup hustlers will keep the other tech startup hustlers in line. Maybe the era of devastating leaks and total disregard for user privacy will come to an end (doubtful).

Wait until we understand the depth of the current Mythos zero day situation. We already have an overall idea of what’s to come but I don’t think we can grasp the high level implications the vast array of these vulnerabilities have in store for us. I don’t see/ say this in a doomsday-ish way nor the world coming to an end. It will sting a bit but overall it’s way overdue and spells opportunity for all, imo.

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#64

Post by bigyabai »

BowBun wrote: post #54
mcoliver wrote: post #46

I've seen this at so many startups (and worked to patch the gaps and put in best practices) including those backed by top tier VCs. The problem is that it is rare for startups to have security minded people. It's usually designers, people who can raise money, and generalists who can stitch together apis. It's not generally platform, db, or security minded people. The proliferation of things like vercel and supabase h…

Yep, this has been my experience over 15 years in startups as well. There are barely any punishments, so there is no incentive for startups to change how they operate.

Same here. I've witnessed horrifying security bugs that were basically flagged as WONTFIX internally because it was too much work to fix until it was exploited.

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#65

Post by bdangubic »

pcthrowaway wrote: post #52
bdangubic wrote: post #30

Earlier quoted context omitted.

email security@company

Sure that is perhaps a good way to inquire about the appropriate channels to disclose a security vulnerability, but email is not a secure communication method for sending the details about a security vulnerability

start there and handle everything once you get in contact with appropriate people

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#66

Post by giannicmptr1000 »

SkyGuard_Lead wrote: post #63
janice1999 wrote: post #20

Finally the AI security startup hustlers will keep the other tech startup hustlers in line. Maybe the era of devastating leaks and total disregard for user privacy will come to an end (doubtful).

Wait until we understand the depth of the current Mythos zero day situation. We already have an overall idea of what’s to come but I don’t think we can grasp the high level implications the vast array of these vulnerabilities have in store for us. I don’t see/ say this in a doomsday-ish way nor the world coming to an end. It will sting a bit but overall it’s way overdue and spells opportunity for all, imo.

it won't end at mythos, that's just the one everyone knows about and obvious. think of what's going on behind the scenes, that's the real gold rush

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#67

Post by stephbook »

Tenant scoping is important. Just ask Microsoft, didn't they have one right at bing.com? Oh, just every Bing user is vulnerable to have all Microsoft data (o365 emails for example) hacked. No biggie.

https://www.wiz.io/blog/azure-active-directory-bing-misconfi...

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#68

Post by ok123456 »

beambot wrote: post #6
DougN7 wrote: post #3

Would it be possible to stop using aXXb nomenclature within the titles? Some of us aren't hip enough to know what all of them mean.

Andreessen-Horowitz, who most people (and they themselves) refer to as a16z and have the eponymous domain name (a16z.com). They're one of the top VC firms on the planet -- exceedingly relevant to HN audiences and commonly discussed here.

Sorry, I come here for hacker content.

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#69

Post by yellowapple »

tardedmeme wrote: post #27

I wonder if this is how Handala group recently stole the list of service members. How do people find these vulnerabilities within the immense scope of the whole internet? Are they going around with some kind of generic API scanner that discovers APIs?

Probably based on insider info to some degree; if you already do any sort of work for the DoD, then that tends to help narrow the scope of the search for vulnerable things to exploit.
Post reply on HN