3 ms·
It will be interesting to see how the access was gained. I wonder how well this administrative system was protected. Did they have basic controls like: 1) Ac
by gwittel 6y ago
It will be interesting to see how the access was gained. I wonder how well this administrative system was protected. Did they have basic controls like:
1) Accessible via corporate VPN only (requiring 2fa)
2) Admin panel protected by 2fa plus necessary authentication+authorization controls
3) Audit trails
Short of cooperative access (device handover), I could only see an outsider gaining access to the system due to poor security practices or a remote access trojan getting installed. Though more likely, Twitter lacked these basic controls.
Verified accounts could probably be subject to 2nd person controls so IF someone were to modify an account via admin panel, then a 2nd support person (preferably in a different location), would have to vet the change.
- kerng 6y agoMany startups and hip companies don't do VPNs anymore - unfortunately they also dont do Zero Trust (which would require machine certs for everything and be enforced) - so stuff is often available over Internet with password auth + maybe MFA. Attacker who gets hold of cookie or bearer token wins. And the best part, support personnel often doesnt have MFA, because its outsourced to countries where smart phones with Authenticator apps are not as common to own for the regular person. I'm not joking.
- ex3ndr 6y agoI don't see any issue with auth without VPN if TLS is terminated by owner
- deleted 6y ago[deleted]
- kerng 6y agoThe better answer/question is maybe more about what kind of auth?
- callamdelaney 6y agoTo be honest VPN's are a huge pain in the arse for everybody involved.
- kerng 6y agoYep, I'm actually not saying that VPNs are the right or only (no way) solution I just wanted to highlight that auth is complex and there are often loopholes.
- gwittel 6y agoYes, you're most likely right. While physical tokens are relatively cheap, MFA setup can be not the most straightforward outlay. Still a lot simpler given the many SSO companies out there these days. That said, tokens are probably simpler than zero trust network setup. Even if you had a zero trust network, you'd still want tokens in case an employee machine is compromised.
- texasbigdata 6y agoReally stupid question. A key employee leaves, with their personal 2FA. Is there a standardized corporate solution for this yet? Sorry if that’s weirdly worded
- deleted 6y ago[deleted]
- tmpz22 6y agoYa you disable and invalidate all credentials for the user. There's a reason IT usually has prior knowledge of any hiring/firing/leaving.
- yjftsjthsd-h 6y agoDisabling their account or altering their first factor makes the second factor irrelevant. Who cares if I have a TOTP code for my old account, if the account is deactivated and/or its password changed?
- kerng 6y agoThe best part are breakglass keys or certs! Who rotates them when someone who had access to one leaves the org? :)
- hnzix 6y agoThere are various vendor products that support automated deprovisioning when an employee is terminated in the master HR system. You're 1000x more likely to see them in a corporate setting than a startup.
- donkeyd 6y agoMy previous startup had a bit of both. My access to things like mail and Atlassian stuff was automatically revoked, while I could still access the production database months later.
- jacobsenscott 6y agoWith everyone working from home due to the pandemic I think these admin tools have never been more vulnerable. I would bet these tools were unavailable outside of a twitter office building until now. But now these tools are accessible from the homes of twitter admins. How many of them are running behind compromised home routers, etc? Everyone in the house has access - spouses, partners, teens, visitors. I bet twitter doesn't have a lot of extra security on their admin tools. They probably write straight to the production database. Those safeguards would really slow down day to day support and be expensive to build, and they probably assumed the physical security of the office building was good enough. I think the most like cause was a disgruntled employee working from home plus a little bribery.
- gwittel 6y agoYes, given increased working from home I'd expect more breaches to come. Especially if companies allow non-corporate machines to connect to their VPNs (or other once internal systems are on the open internet). Putting an admin tool on the internet places a lot of trust on your users and developers to be perfect. That also assumes any 3rd party dependencies are free of issues. Putting VPN and MFA on shouldn't slow down people much. They'd just have to spend a bit more time logging in each day. Annoying? Yes, but that's better than a breach.