Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

strix.ai

Post reply on HN
Print view View original

91–100 of 112 posts

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#91

Post by maccard »

mcoliver wrote: post #46

I've seen this at so many startups (and worked to patch the gaps and put in best practices) including those backed by top tier VCs. The problem is that it is rare for startups to have security minded people. It's usually designers, people who can raise money, and generalists who can stitch together apis. It's not generally platform, db, or security minded people. The proliferation of things like vercel and supabase h…

Honeastly though, I get it. If you have headcount for two people, do you want one of those people to be a DBA and another to be a platform architect? Whos going to actually make the app.

I genuinely think the problem is that frameworks don't do this for you. Why should you need a DBA and platform architect to make a multi tenant CRUD app, pretty much every one does the same thing..

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#92

Post by nixpulvis »

maccard wrote: post #91
mcoliver wrote: post #46

I've seen this at so many startups (and worked to patch the gaps and put in best practices) including those backed by top tier VCs. The problem is that it is rare for startups to have security minded people. It's usually designers, people who can raise money, and generalists who can stitch together apis. It's not generally platform, db, or security minded people. The proliferation of things like vercel and supabase h…

Honeastly though, I get it. If you have headcount for two people, do you want one of those people to be a DBA and another to be a platform architect? Whos going to actually make the app. I genuinely think the problem is that frameworks don't do this for you. Why should you need a DBA and platform architect to make a multi tenant CRUD app, pretty much every one does the same thing..

Security minded generalists exist. They might move slower than you expect of a MFBS (move fast break shit) engineer, but you might also end up with fewer issues later.

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#93

Post by tgv »

sailfast wrote: post #44
codegeek wrote: post #24

"There was no meaningful organization scoping, no tenant isolation, and no permission check preventing a low-privilege user from accessing other organizations' records." Let me guess though. They are SOC2 and ISO compliant right ?

One hopes not as this stuff would have come up in even a cursory audit of the product - but it’s kinda like Ratings Agencies / Moody’s in 2008 right now until a big breach that occurs post-cert and they lose their credibility.

There have been a bunch. Did any auditor lose a license, credibility, or even a night's sleep? Even accountants aren't held to their standards, and they are supposed to guard the holiest of holiest: shareholder money.

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#94

Post by miki123211 »

mcoliver wrote: post #46

I've seen this at so many startups (and worked to patch the gaps and put in best practices) including those backed by top tier VCs. The problem is that it is rare for startups to have security minded people. It's usually designers, people who can raise money, and generalists who can stitch together apis. It's not generally platform, db, or security minded people. The proliferation of things like vercel and supabase h…

And auth checks on the frontend. Or sometimes on the backend, but only on list pages. Or tables that still use INTEGER PRIMARY KEY AUTOINCREMENT in 2026 (which is one way to definitely disprove your statements about 1000x growth).

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#95

Post by miki123211 »

bigfatkitten wrote: post #88
cyanydeez wrote: post #59

Earlier quoted context omitted.

You could even say they're paid even more to "move fast and break things".

While simultaneously wondering why software development being treated as a discipline of engineering is such a controversial subject.

Because, unlike bridges, software can easily be bought, including from countries that don't have such regulations.

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#96

Post by gnz11 »

miki123211 wrote: post #95
bigfatkitten wrote: post #88

Earlier quoted context omitted.

While simultaneously wondering why software development being treated as a discipline of engineering is such a controversial subject.

Because, unlike bridges, software can easily be bought, including from countries that don't have such regulations.

Governments can certainly regulate imports.

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#97

Post by dijksterhuis »

nixpulvis wrote: post #92
maccard wrote: post #91

Earlier quoted context omitted.

Honeastly though, I get it. If you have headcount for two people, do you want one of those people to be a DBA and another to be a platform architect? Whos going to actually make the app. I genuinely think the problem is that frameworks don't do this for you. Why should you need a DBA and platform architect to make a multi tenant CRUD app, pretty much every one does the same thing..

Security minded generalists exist. They might move slower than you expect of a MFBS (move fast break shit) engineer, but you might also end up with fewer issues later.

> Security minded generalist

there’s always some senior-ish person in the interview pool who is interested in security. hire them, let them figure things out and then give them permission to call bullshit on what you’ve done so far.

avoid hiring the “fanatics” tho. you don’t need E2EE everywhere.

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#98

Post by skinfaxi »

moron4hire wrote: post #90
zbentley wrote: post #50

Earlier quoted context omitted.

The number of FISMA-HIGH, ATO’d/RMF’d, security audited government systems I’ve seen with equivalent security issues is…substantially nonzero. I have come to believe that most security audits, even ones conducted through widely-reputed groups or under strict standards, are much worse than useless. Audits are a thing that can theoretically be done well/in a value-adding way, but rarely are, for the same reasons that m…

I've been trying to figure out what exactly or IT Security Team does. Because all they seem to do is create stupid impediments that actually push people into making work arounds that make everything less secure. For example, they won't create for me an MS Entra ID App Registration for our internal project Because Security Reasons (they literally won't tell me why). So instead, I use Integrated Windows Authentication,…

> I still want to know why--when we're wanting to run services like Document Intelligence and Azure OpenAI in Azure GCC High, a FedRAMP-High approved environment with these services claiming DoD Impact Level 5 compliance--our IT Security department thinks that can't be used for CUI. They say we need to spend 2 years and $2 million doing some kind of review of Azure itself before it can be approved for CUI.

Don't you still have to get program-specific authorization for IL5?

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#99

Post by hobofan »

codegeek wrote: post #24

"There was no meaningful organization scoping, no tenant isolation, and no permission check preventing a low-privilege user from accessing other organizations' records." Let me guess though. They are SOC2 and ISO compliant right ?

ISO compliance tells you almost nothing about the security of the product being developed, just about the processes in place at the company developing the product.

Re: Securing a DoD contractor: Finding a multi-tenant authorization vulnerability

#100

Post by moron4hire »

skinfaxi wrote: post #98
moron4hire wrote: post #90

Earlier quoted context omitted.

I've been trying to figure out what exactly or IT Security Team does. Because all they seem to do is create stupid impediments that actually push people into making work arounds that make everything less secure. For example, they won't create for me an MS Entra ID App Registration for our internal project Because Security Reasons (they literally won't tell me why). So instead, I use Integrated Windows Authentication,…

> I still want to know why--when we're wanting to run services like Document Intelligence and Azure OpenAI in Azure GCC High, a FedRAMP-High approved environment with these services claiming DoD Impact Level 5 compliance--our IT Security department thinks that can't be used for CUI. They say we need to spend 2 years and $2 million doing some kind of review of Azure itself before it can be approved for CUI. Don't you…

I don't know. I've been a software engineer for 25 years, but this is my first DoD job in 20. We didn't have this when I was a junior developer and I don't have the time to learn about this particular part of the process.

We have plenty of program contracts that require IL5. I think you only need ATO to go to IL6 and above (which would be Secret and would require working in a SIPRNet connected network isolated from our corporate network). For just CUI data, I thought you didn't need special authorization.

What I really need is someone I can trust who can come in and tell me what we should be doing, because whatever our IT Security team is telling me sounds ludicrous. There are a whole host of problems with our IT systems that indicate to me that they don't really know what they are doing.

Edit: note, I'm not talking about certifying our own software for use with CUI. That's a ball of wax that our leadership has told us to defer until next year, since for this particular project we don't have any clients yet. I'm talking about our IT dept won't let us send CUI through existing, should-be-approved services in Azure GCC High right now, even from our laptops inside our CUI-approved corp network.

Post reply on HN