[dead]
Securing a DoD contractor: Finding a multi-tenant authorization vulnerability
101–110 of 112 posts
Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability
#102Initial take: as vulnerability stories go, this is a pretty boring one; what they have here is a target that was secured largely by the fact that few people knew about it. The most work done in this blog post is establishing that a training platform deployed by DoD might be much more sensitive than the same kinds of applications which are ubiquitous throughout corporate America and which are generally boring targets.…
> It's interesting if AI systems can "spot" these, in the sense of autonomously exercising the application and "understanding" obvious failed authz check patterns. But it's a "hm, ok, sure" kind of interesting.
I think that misses the bigger point: automated scanners have gotten better and the floor for issues has risen. Security@ mailing groups are going to be getting more messages that aren't just noise from people running automated scanners.
Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability
#103Earlier quoted context omitted.
To answer the first question, a number of veteran independent researchers probably wouldn’t have touched such a system. Plenty of companies will send their lawyers after you if you tell them that you’ve discovered a vulnerability of some sort and wish to responsibly disclose. Even if you do things in good faith, the company has zero reason to assume the best from you and can hold a sword over your head by citing poor…
The line between security research and espionage seems really thin.
Would spies disclose their findings?
Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability
#104Earlier quoted context omitted.
The number of FISMA-HIGH, ATO’d/RMF’d, security audited government systems I’ve seen with equivalent security issues is…substantially nonzero. I have come to believe that most security audits, even ones conducted through widely-reputed groups or under strict standards, are much worse than useless. Audits are a thing that can theoretically be done well/in a value-adding way, but rarely are, for the same reasons that m…
I've been trying to figure out what exactly or IT Security Team does. Because all they seem to do is create stupid impediments that actually push people into making work arounds that make everything less secure. For example, they won't create for me an MS Entra ID App Registration for our internal project Because Security Reasons (they literally won't tell me why). So instead, I use Integrated Windows Authentication,…
I work with a "global systems integrator" that has IT security policies so insane that it takes 1 to 2 months to onboard a developer and finally get their work laptop set up. Meanwhile, they are basically twiddling their thumbs getting billed out at ~$200/hour, unless they happen to have their own laptop. Some of them just stay working on their own laptops because it's so much more productive.
Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability
#105"There was no meaningful organization scoping, no tenant isolation, and no permission check preventing a low-privilege user from accessing other organizations' records." Let me guess though. They are SOC2 and ISO compliant right ?
ISO compliance tells you almost nothing about the security of the product being developed, just about the processes in place at the company developing the product.
Yes thats why I also added SOC 2. I have gone through an ISO audit for our company so I know the process. The point is that these certifications are mostly a joke but you have to play the game to win "enterprise" deals.
Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability
#106Earlier quoted context omitted.
In your opinion, is the lack of attention on security due to speed-bias or not having the expertise? For a startup / sole entrepreneur with very limited resources, what would be your advice?
Yeah what was said below. Lack of experience. A lot of people just don't know to ask about it or think through data flows. Running your code base through an llm asking it to act as a l7 security auditor, take it's time, think from first principles, and look for data leaks and potential security gaps in the code and architecture is a good start. Also don't ignore supabase when it gives you suggestions on things to fix…
[flagged]
Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability
#107Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability
#108Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability
#109Earlier quoted context omitted.
> I still want to know why--when we're wanting to run services like Document Intelligence and Azure OpenAI in Azure GCC High, a FedRAMP-High approved environment with these services claiming DoD Impact Level 5 compliance--our IT Security department thinks that can't be used for CUI. They say we need to spend 2 years and $2 million doing some kind of review of Azure itself before it can be approved for CUI. Don't you…
I don't know. I've been a software engineer for 25 years, but this is my first DoD job in 20. We didn't have this when I was a junior developer and I don't have the time to learn about this particular part of the process. We have plenty of program contracts that require IL5. I think you only need ATO to go to IL6 and above (which would be Secret and would require working in a SIPRNet connected network isolated from o…
You need an ATO for any government software, not just IL6 and higher. What you're experiencing is cloud service providers only get a provisional ATO for their services. Full compliance with IL5 isolation requirements involves controls both on Microsoft's side and on your side. They have some rough documentation here (https://learn.microsoft.com/en-us/azure/compliance/offerings...) and here (https://learn.microsoft.com/en-us/azure/azure-government/doc...). If you can figure out what you need to do from reading that, well, you're better qualified than I am. It's complicated. I don't think this is on your IT team. The government makes this hard.
If you've been out of the game a while, things got significantly more difficult ten years ago around the time of the OPM breach. CMMC2 requirements got a lot stricter. The only bright side here is everyone is subject to the same bullshit, so you're not at any competitive disadvantage. I get how frustrating it is. We've all been there. But go easy on your own team. It's just as frustrating for them.
Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability
#110Earlier quoted context omitted.
Honeastly though, I get it. If you have headcount for two people, do you want one of those people to be a DBA and another to be a platform architect? Whos going to actually make the app. I genuinely think the problem is that frameworks don't do this for you. Why should you need a DBA and platform architect to make a multi tenant CRUD app, pretty much every one does the same thing..
Security minded generalists exist. They might move slower than you expect of a MFBS (move fast break shit) engineer, but you might also end up with fewer issues later.
Later can never come.