201–210 of 459 posts
> We did not want to contact FlyCASS first as it appeared to be operated only by one person... It seems pretty remarkable that airlines are buying such a security sensitive piece of software from a one person shop. If you make it very far into selling any piece of SaaS software to most companies in corporate America, at the absolute minimum they're going to ask you for your SOC2 audit report. SOC2 is pretty damn easy…
The "airlines" that are using something like FlyCASS are themselves smaller operations and typically running on razor thin margins (if not just unprofitable and wishfully thinking that money will suddenly appear and make their business viable). Literally everything on their backend is held together with more duct tape than the average small business. You could be an "airline" by purchasing a couple of older airliners…
Earlier quoted context omitted.
Part of the reason why Crowdstrike have access, why MS wasn't allowed to shut them out with Vista was a regulatory decision, one where they argued that somebody needs to do the job of keeping Windows secure in a way that biased Microsoft can't. So, I guess you could have some sort of escrow third party that isn't Crowdstrike or MS to do this "audit"? Or see this for a much better write up: https://stratechery.com/202…
MS could have provided security hooks similar to BPF in Linux, and similar mechanisms with Apple, rather than having Crowdstrike run arbitrary buggy code at the highest privilege level.
That's not the default option for kernel drivers on Windows, so this was an explicit choice on Crowdstrike's part.
Why do people even attempto to disclose this? These guy are going to end up with some serious federal charges.
Hilarious that the entire TSA system is vulnerable to the most basic web programming error that you generally learn to avoid 10 minutes into reading about web programming- and that every decent quality web framework automatically prevents. It is really telling that they try to cover up and deny instead of fix it, but not surprising. That is a natural consequence of authoritarian thinking, which is the entire premise…
There are oodles and oodles of apps like this powering our daily lives.
To be clear, I really hope they don’t, but they are also clearly trying to spin this in a way at odds with the researchers, and I’d hate to be in a position where they want to have leverage over me if I’d done this.
Brave that they did so though and I do think the severity of the vuln warrants this.
Little Bobby Tables strikes again: https://xkcd.com/327/
really feels like SQL should have never been written in such a fundamentally insecure manner, or immediately fixed once it was discovered that it was
Earlier quoted context omitted.
In practice, most commercial attestations/certifications contain enough weasel language that the certifier isn't responsible for anything missed (i.e. reasonable effort only). But yes, there are many standards for this (e.g. SOC Type 2 reports). In defense of their utility, the good ones tend to focus on (a) whether a control/policy for a sensitive operation exists at all in the product/company & (b) whether those co…
We're talking about getting a judgement in the court of public opinion not a court of law, and no one is exempt from the former.