41–50 of 71 posts
Earlier quoted context omitted.
Exactly, most PR professionals know about the damaging effect of the Streisand effect. There are better ways to ensure this isolated incident doesn't make it to the press, and deal with the independent researchers accordingly for not going through the proper channels.
The researchers did go through the proper channels, and were ignored.
Earlier quoted context omitted.
The researchers did go through the proper channels, and were ignored.
Would you feel the same way if it was your computer? Maybe you didn't believe the reported issue was real.
Earlier quoted context omitted.
By default cookies are scoped to the subdomain only, so while not impossible some other domain would have to go out if it’s way to screw that up
If any cookie is scoped to `microsoft.com` - wouldn't this subdomain be able to access them?
I need to start thinking more critically about my passwords being stored on ms edge. Now! These vulnerabilities are adding so much more fear to.life. I just got done neutralizing lastpass. And that took a while. I started that back in September.
I don't like the idea of consolidation. It's a bad security posture. People love to point out that "they" can secure your data better than you can, but always neglect to mention that a consolidated target has considerably more value. Credential theft results in compromised networks. If you host your own passwords, an attacker would have to start with access in order to steal credentials. If you put all your passwords on a 3rd party server that you can't audit, with millions of other passwords from millions of other customers, it's only a matter of time before they get leaked. In fact, it's almost guaranteed that it will leak, because the value of the prize is millions of times greater.
Why would I waste 3 months trying to hack one business to harvest credentials when I can spend 12 months hacking last pass to get a million passwords? It's a simple cost/ benefit calculation. And lazy administration to think anything different.
So go ahead, consolidate your whole business on infra you have no real authority over. The next major world conflict will result in 4 cloud providers being physically attacked with data centers destroyed and then you will be partly to blame when 90% of the free world's economy disappears overnight.
Isn’t Truffle Security opening themselves up to litigation from this? It’s harmless, but is the risk of having Microsoft’s army of lawyers throw CFAA at you really worth this?
Archive, because it has already been fixed by MS: https://archive.ph/DEzVW
Earlier quoted context omitted.
If any cookie is scoped to `microsoft.com` - wouldn't this subdomain be able to access them?
Ideally those cookies would also be httponly, so it's harder to get at them
HttpOnly only prevents session theft as you cannot read the cookie, but you can still use it. you can still perform actions by sending AJAX requests with cookies attached.
In a subdomain takeover you receive cookies on all requests, you can view these irrespective of httponly unless you are limited to controlling html and js of the subdomain (which I think is true of GitHub static sites).
HttpOnly is largely a failed mitigation, modern SPAs require access to JWT tokens which compounds that; the solution is to focus on appropriate scoping (to prevent subdomain hijacks having such implications) and preventing XSS.