51–60 of 131 posts
Attributed without evidence from what I could tell. So it doesn't reveal much at all.
Unusual velocity? Didn't the attacker have the oauth keys for months?
Earlier quoted context omitted.
It's ridiculed because its no protection on its own when an attacker is motivated. Its fine to add as an additional layer though if you want to make your space mildly custom to protect against broader attacks. I don't see how its necessarily relevant to this attack though. These guys were storing creds in clear and assuming actors within their network were "safe", weren't they?
TFA cites "env var enumeration", likely implying someone got somewhere they shouldn't and typed 3 characters, as the critical attack that led to customers getting compromised. My point is sensitive secrets should literally never be exported into the process environment, they should be pulled directly into application memory from a file or secrets manager. It would still be a bad compromise either way, but you have a…
A Vercel user had their Google Workspace compromised.
The attacker used the compromised workspace to connect to Vercel, via Vercel's Google sign-on option.
The attacker, properly logged into the Vercel console as an employee of that company, looked at the company's projects' settings and peeked at the environment variables section, which lists a series of key:value pairs.
The user's company had not marked the relevant environment variables as "sensitive", which would have hidden their values from the logged-in attacker. Instead of
DATABASE_PASSWORD: abcd_1234 [click here to update]
DATABASE_PASSWORD: ****** [click here to update]
And that's how the attacker enumerated the env vars. They didn't have to compromise a running instance or anything. They used their improperly acquired but valid credentials to log in as a user and look at settings that user had access to.
Why is this same story repeated over and over here? I get it, it's a big story ... but that doesn't mean it needs N different articles describing the same thing (where N > 1).
"Why do people use Vercel?"
"Because it's cheap* and easy."
*expensive
Why is this same story repeated over and over here? I get it, it's a big story ... but that doesn't mean it needs N different articles describing the same thing (where N > 1).
in fact, the sparse details had Barbara warming up her vocal chords
This article is solely overly wordy (probably ai) restatements of essentially just what vercel has publicly disclosed already
> The CEO publicly attributed the attacker's unusual velocity to AI Unusual velocity? Didn't the attacker have the oauth keys for months?
By far the biggest issue is being able to access the production environment of millions of customers from a Google Workspace. Only a handful of Vercel employees should be able to do that with 2FA if not 3FA.
> The CEO publicly attributed the attacker's unusual velocity to AI Unusual velocity? Didn't the attacker have the oauth keys for months?