3 ms·
Once in a past life I discovered that the asset tracking system I was maintaining had no actual security on any of the data it returned. Once you'd logged in as
by taneq 5y ago
Once in a past life I discovered that the asset tracking system I was maintaining had no actual security on any of the data it returned. Once you'd logged in as one user you could just change the URL to access whatever user's data you wanted.
I raised the issue with my manager, we had a meeting about security, I explained that I wasn't a security expert but that this was a big problem and we needed to do a full security audit. I guesstimated 3 months to go through the codebase looking for security holes (in hindsight, a huge underestimate) and they said it was too expensive. Talking to fellow ex-employees the issue was still there 10+ years later.
- foobiekr 5y agoNot to scare you, but I know a power plant operator who has that issue on its plant operations system. It's pretty amazing. I know another company where anyone in the company, anyone at all with a login into account in the Active Directory SSO of any privilege at all, even a janitor, can sign any code they want with the release keys. Nobody cares.
- R0b0t1 5y agoIn a way this is similar security to what you get at a single office with no internal security. For the vast majority of history it worked.
- concordDance 5y agoThe wonders of a high trust environment. The vast vast majority of people will not exploit security holes.