Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

strix.ai

Post reply on HN
Print view View original

81–90 of 112 posts

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#81

Post by ungreased0675 »

orthogonal_cube wrote: post #43
neilv wrote: post #36

Two questions prompted by this disclosure: 1. I didn't see mention of a bug bounty program giving limited authorization. How do independent researchers do this with legal safety? Especially when DoD is involved? 2. If a researcher discovered a vulnerability at a DoD contractor, and the contractor didn't seem to be resolving the problem, is there a DoD contact point that would be effective and safe for the researcher…

To answer the first question, a number of veteran independent researchers probably wouldn’t have touched such a system. Plenty of companies will send their lawyers after you if you tell them that you’ve discovered a vulnerability of some sort and wish to responsibly disclose. Even if you do things in good faith, the company has zero reason to assume the best from you and can hold a sword over your head by citing poor…

The line between security research and espionage seems really thin.

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#82

Post by jrumbut »

hansvm wrote: post #78
chrisss395 wrote: post #73

Earlier quoted context omitted.

In your opinion, is the lack of attention on security due to speed-bias or not having the expertise? For a startup / sole entrepreneur with very limited resources, what would be your advice?

IME it's always lack of experience, at least at the level being described here. It's the same kind of person adding CORS handling to a pure backend service for "security" reasons. They just don't know any better and don't have a good enough mental model of how it all fits together to be able to recognize when they need to research more. The insecure patterns being chosen instead usually aren't even easier or faster t…

Yeah, in most cases these security vulnerabilities are also regular bugs too.

I'll bet at some point someone contact this company and said "hey I'm being shown the wrong course" or "I can't access the material I just uploaded."

I've never seen anyone who got the basics right compromised because of some esoteric security issue. I'm sure it happens and probably will happen more now that it can be automated but it's usually a case of a system being left wide open.

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#83

Post by pocksuppet »

WaitWaitWha wrote: post #56
bryancoxwell wrote: post #11

> Their initial reply from the CEO: "I would love to hear what the vulnerability is, but I assume you want to get paid for it. Is that the play?" Well that’s pretty damning.

i have even more damning ones. When the "good Samaritan" do not go to the vendor, they go to the client (i.e., they do not contact the DIB company, they contact the Gov agency). I have seen government contractors getting pilloried, losing their livelihood when this happened. And, yes there is always a "quick fix offer" by the "good Samaritan" to the vendor and promised re-assurance to the Gov agency, only if this mis…

That just sounds like good old business to me. When outside of public view, good businessmen are extremely cut-throat and unethical.

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#84

Post by reassess_blind »

bryancoxwell wrote: post #11

> Their initial reply from the CEO: "I would love to hear what the vulnerability is, but I assume you want to get paid for it. Is that the play?" Well that’s pretty damning.

The number of spam "I found a vulnerability" emails you get as a SaaS operator is ridiculous, they never offer any proof of a vuln and just want you to confirm you have a bug bounty program (in which case they'll start scanning afterwards), or to pay ahead of time for the information or they'll threaten to release it.

Their response isn't damning to me. It sounds like they just assume they're one of these spammers.

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#85

Post by NegativeK »

sailfast wrote: post #42
lixtra wrote: post #19

Earlier quoted context omitted.

Yes, there are also many other lucrative illegal activities.

How is it illegal? It’s information available to the public.

If you sell something to someone and they do computer crimes, you're going to have to prove that you couldn't've known that they're a computer crimer.

It's the same thing with selling general offensive security tools. You have to proactively make it clear that it's for testing and not criminal use. Otherwise, cops are going to assume you're complicit and make things shitty.

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#86

Post by eskibars »

luminati wrote: post #75

off-topic, but I've become quite intrigued with AI pentesting, after being very unhappy with the various pentest firms we've used in the past, that rip us off or do very mediocre tests (of course yeah yeah the really good ones exist but even then they're not going to match the speed at which we are claude coding now). Tried a bunch of open source pentesters, including strix (though we never managed to get strix to ac…

I know the space is starting to get crowded, but I've been building one and I'd love to get feedback if you have time

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#87

Post by mcoliver »

chrisss395 wrote: post #73
mcoliver wrote: post #46

I've seen this at so many startups (and worked to patch the gaps and put in best practices) including those backed by top tier VCs. The problem is that it is rare for startups to have security minded people. It's usually designers, people who can raise money, and generalists who can stitch together apis. It's not generally platform, db, or security minded people. The proliferation of things like vercel and supabase h…

In your opinion, is the lack of attention on security due to speed-bias or not having the expertise? For a startup / sole entrepreneur with very limited resources, what would be your advice?

Yeah what was said below. Lack of experience. A lot of people just don't know to ask about it or think through data flows. Running your code base through an llm asking it to act as a l7 security auditor, take it's time, think from first principles, and look for data leaks and potential security gaps in the code and architecture is a good start. Also don't ignore supabase when it gives you suggestions on things to fix.

As a solo entrepreneur you really have to prioritize your time but spending an extra day or two to think through everything using something like Gemini thinking or pro and an llm with an eye on security before you start taking customer data is probably a really good use of your time and you'll learn a thing or three. Just keep asking why and think critically.

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#88

Post by bigfatkitten »

cyanydeez wrote: post #59
BowBun wrote: post #54

Earlier quoted context omitted.

Yep, this has been my experience over 15 years in startups as well. There are barely any punishments, so there is no incentive for startups to change how they operate.

You could even say they're paid even more to "move fast and break things".

While simultaneously wondering why software development being treated as a discipline of engineering is such a controversial subject.

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#89

Post by jxmesth »

luminati wrote: post #75

off-topic, but I've become quite intrigued with AI pentesting, after being very unhappy with the various pentest firms we've used in the past, that rip us off or do very mediocre tests (of course yeah yeah the really good ones exist but even then they're not going to match the speed at which we are claude coding now). Tried a bunch of open source pentesters, including strix (though we never managed to get strix to ac…

We've been thinking about testing this stuff out as well. Have you had a chance to look into stuff like XBOW/Horizon3?

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#90

Post by moron4hire »

zbentley wrote: post #50
sailfast wrote: post #44

Earlier quoted context omitted.

One hopes not as this stuff would have come up in even a cursory audit of the product - but it’s kinda like Ratings Agencies / Moody’s in 2008 right now until a big breach that occurs post-cert and they lose their credibility.

The number of FISMA-HIGH, ATO’d/RMF’d, security audited government systems I’ve seen with equivalent security issues is…substantially nonzero. I have come to believe that most security audits, even ones conducted through widely-reputed groups or under strict standards, are much worse than useless. Audits are a thing that can theoretically be done well/in a value-adding way, but rarely are, for the same reasons that m…

I've been trying to figure out what exactly or IT Security Team does. Because all they seem to do is create stupid impediments that actually push people into making work arounds that make everything less secure.

For example, they won't create for me an MS Entra ID App Registration for our internal project Because Security Reasons (they literally won't tell me why). So instead, I use Integrated Windows Authentication, which is about as secure as a hotel bar patron charging to "his" room.

They are insisting everyone start RDPing into a VM in Azure to do development work. Won't be able to get to the new source control system without it. Old system is losing its license, etc, etc. Oh, but the new system is not approved for storing CUI. So... what the actual fuck are our AFSIM developers supposed to do?

These VMs are 1/4 the hardware specs of my laptop in almost every dimension, yet still somehow car 50% more to rent per year than the entire purchase price of my laptop. Plus they are timesharing is in them, 4 developers per VM. It's not like we live in majorly different timezones. We're either all going to be on from 9am - 5pm EST or we're not.

Within these VMs, I have absolutely zero ability to install any software or modify any settings. Even the god damn clock is set to GMT+0 and I can't change it to local time. Sure would be nice if the must visible clock in my visual field accurately portrayed the current time when I have the RDP session running full screen, which is basically the only way to run it without wanting to hammer drill my brains out.

I have heard rumors that a lot of the other developers have started working from their personal devices, because otherwise they are at a complete work stoppage on their work computers due to the cockamamie IT setup. So congratulations, IT Security Team. Good job.

I still want to know why--when we're wanting to run services like Document Intelligence and Azure OpenAI in Azure GCC High, a FedRAMP-High approved environment with these services claiming DoD Impact Level 5 compliance--our IT Security department thinks that can't be used for CUI. They say we need to spend 2 years and $2 million doing some kind of review of Azure itself before it can be approved for CUI. Uhm, no? If it needs that, why would we spend that money and time? Why wouldn't Microsoft be the one to do that?

Post reply on HN