Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

strix.ai

Post reply on HN
Print view View original

71–80 of 112 posts

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#71

Post by PenguinCoder »

krisoft wrote: post #25
beambot wrote: post #6

Earlier quoted context omitted.

Andreessen-Horowitz, who most people (and they themselves) refer to as a16z and have the eponymous domain name (a16z.com). They're one of the top VC firms on the planet -- exceedingly relevant to HN audiences and commonly discussed here.

> you'd rather say Andreessen-Horowitz, which is just as arbitrary as a16z Yes. I know Andreessen-Horowitz and I don’t know a16z. Reading the title i thought it will be about the cryptography serialisation specification. Turns out i was mixing it up with ASN.1. > Their website is literally a16z.com I hear now. Before this if pressed i would have guessed that they probably have a website indeed. If you would have twis…

> Yes. I know Andreessen-Horowitz and I don’t know a16z.

So the world needs to adapt to your knowledge instead of you learning to adapt to a often used, and well-known moniker?

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#72

Post by Terr_ »

pcthrowaway wrote: post #52
bdangubic wrote: post #30

Earlier quoted context omitted.

email security@company

Sure that is perhaps a good way to inquire about the appropriate channels to disclose a security vulnerability, but email is not a secure communication method for sending the details about a security vulnerability

It's kind of insane to think that the state of email encryption is still so bad in The Future Year 2026.

No flying cars? Okay. Nobody traveled much beyond the orbit of the Moon? Dang. But email? We didn't even get reliable privacy separate from identity?

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#73

Post by chrisss395 »

mcoliver wrote: post #46

I've seen this at so many startups (and worked to patch the gaps and put in best practices) including those backed by top tier VCs. The problem is that it is rare for startups to have security minded people. It's usually designers, people who can raise money, and generalists who can stitch together apis. It's not generally platform, db, or security minded people. The proliferation of things like vercel and supabase h…

In your opinion, is the lack of attention on security due to speed-bias or not having the expertise? For a startup / sole entrepreneur with very limited resources, what would be your advice?

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#74

Post by cyberax »

Terr_ wrote: post #72
pcthrowaway wrote: post #52

Earlier quoted context omitted.

Sure that is perhaps a good way to inquire about the appropriate channels to disclose a security vulnerability, but email is not a secure communication method for sending the details about a security vulnerability

It's kind of insane to think that the state of email encryption is still so bad in The Future Year 2026. No flying cars? Okay. Nobody traveled much beyond the orbit of the Moon? Dang. But email ? We didn't even get reliable privacy separate from identity?

> Nobody traveled much beyond the orbit of the Moon?

Oh, don't think that outer space will let you escape the misery of email:

> "I have two Microsoft Outlooks and neither one is working": Artemis II astronauts

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#75

Post by luminati »

off-topic, but I've become quite intrigued with AI pentesting, after being very unhappy with the various pentest firms we've used in the past, that rip us off or do very mediocre tests (of course yeah yeah the really good ones exist but even then they're not going to match the speed at which we are claude coding now).

Tried a bunch of open source pentesters, including strix (though we never managed to get strix to actually complete.) this project called shannon was the only one that we managed to get working reliably and it definitely smoked the output of one of the $10K pentests we did, (we had just discovered shannon after we had gotten the pentest firm's report, so it gave us a good baseline comparison). caveat: this was white box and our pentest firm did greybox, but neverthless I was still very unimpressed by what I got from the pentest firm. $50 vs $10K is not even a comparison lol with far far better results and sent our cto into near heart attack mode.

i think the days of pentesting firms are over - especially with mythos/5.5-cyber etc like capability coming into play. very exciting times ahead!

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#76

Post by fragmede »

The_Blade wrote: post #62
mcoliver wrote: post #46

I've seen this at so many startups (and worked to patch the gaps and put in best practices) including those backed by top tier VCs. The problem is that it is rare for startups to have security minded people. It's usually designers, people who can raise money, and generalists who can stitch together apis. It's not generally platform, db, or security minded people. The proliferation of things like vercel and supabase h…

> So you get people deploying API keys client side and dbs without rls. Or deploying service keys client side when they should be anon. I mean really basic stuff. Claude Code will do this, and actively encourage bypassing any verification before pushing to prod. I saw that first hand with its attempted handling of a major CIAM provider, and then Vercel using whatever OAuth provider in the ol' transitive breach That i…

Yeah but Supabase yells really loudly if you have RLS turned off with their own AI agent, plus you can ask Claude to red team the platform to have it lock it down.

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#77

Post by fragmede »

tardedmeme wrote: post #27

I wonder if this is how Handala group recently stole the list of service members. How do people find these vulnerabilities within the immense scope of the whole internet? Are they going around with some kind of generic API scanner that discovers APIs?

Yes. http://shodan.io

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#78

Post by hansvm »

chrisss395 wrote: post #73
mcoliver wrote: post #46

I've seen this at so many startups (and worked to patch the gaps and put in best practices) including those backed by top tier VCs. The problem is that it is rare for startups to have security minded people. It's usually designers, people who can raise money, and generalists who can stitch together apis. It's not generally platform, db, or security minded people. The proliferation of things like vercel and supabase h…

In your opinion, is the lack of attention on security due to speed-bias or not having the expertise? For a startup / sole entrepreneur with very limited resources, what would be your advice?

IME it's always lack of experience, at least at the level being described here. It's the same kind of person adding CORS handling to a pure backend service for "security" reasons. They just don't know any better and don't have a good enough mental model of how it all fits together to be able to recognize when they need to research more. The insecure patterns being chosen instead usually aren't even easier or faster to implement.

I don't have any concrete recommendations other than that one really good senior+ engineer is more important than a legion of juniors early on. Basic security doesn't require an extra hire; it requires somebody experienced enough to build your product right.

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#79

Post by throwaway523401 »

mcoliver wrote: post #46

I've seen this at so many startups (and worked to patch the gaps and put in best practices) including those backed by top tier VCs. The problem is that it is rare for startups to have security minded people. It's usually designers, people who can raise money, and generalists who can stitch together apis. It's not generally platform, db, or security minded people. The proliferation of things like vercel and supabase h…

I used to work at a startup that handled medical records. A HIPAA breach would have wiped out the company through reputation damage — because our customers were also subject to HIPAA and couldn't possibly hire a startup with a track record of HIPAA breaches.

In my personal assessment some individuals within leadership at this startup were highly risk-tolerant. I speculate that had those individuals been in leadership at other companies not subject to HIPAA, security practices would have been as lax and irresponsible as what's being described as the norm in this thread.

However, because of HIPAA, security practices at this company were fair-to-middling. There were certainly weak areas and mindless box-checking a la SOC-2, but it wasn't a complete shitshow. Those of us in the engineering deparment who cared were able to raise concerns and not have them dismissed, and were generally allowed to do things the right way.

My takeaway: when there are actual severe penalties for privacy breaches, startups may not be so cavalier with your data.

Post reply on HN