6 ms·

> To figure out if a system is vulnerable, Atlassian advised Confluence users to search for accounts with the following information: User: disabledsystemus

by koolba 4y ago

> To figure out if a system is vulnerable, Atlassian advised Confluence users to search for accounts with the following information: User: disabledsystemuser Username: disabledsystemuser Email: dontdeletethisuser@email.com Why does this even exist at all? It doesn't even seem like a default admin user. Is this for automated testing and somehow ended up part of the deployed codebase?

flatiron 4y ago
i dunno how a security audit of a staging environment wouldn't pick this up. what security professional wouldn't go "hmm lets see what users this thing created and their permissions" as one of the top 10 things... i dunno maybe i'm in the wrong field but at least i would check that out.
- resizeitplz 4y ago
  Very well could have, and then someone said "Yeah but we neeeeeed it"
- btown 4y ago
  I feel like many security professionals could have thought "this is necessary for some internal system operation so I won't touch it, and it's not like it has a hardcoded password or anything" and yet it has a hardcoded password.
- hsbauauvhabzb 4y ago
  I’m a security auditor. I dont think many security auditors think like that.
  - dylan604 4y ago
    That's a really sad statement, and proves to me that security audits are just another scene within the grand play that is security theater
    - phpisthebest 4y ago
      Having been in a number of audits (it, insurance, financial, etc) over the the years.... all audits are theater
      - dylan604 4y ago
        Yeah, but security theater is the only one that makes you take all of your stuff out of your bags and then take off your shoes.
        other_herbert 4y ago
        Audience participation! ………..
        ineedasername 4y ago
        Yes, in air travel alone it has given us the war on liquid volumes above 3.4oz and the war on shoes. Luckily by 2009 the fervor & public willingness to go along had died down a bit so we all go to keep our underwear after NWA Flight 253.
    - hsbauauvhabzb 4y ago
      I don’t think it’s theatre. It’s difficult to audit applications when you lack context, it could also be seen and assumed benign / intentional. I think that the industry is immature and severely conflicted on the quality:profit ratio.
      - dylan604 4y ago
        Looking at the capabilities of the default users created by the software after fresh install is difficult to wonder if it should be audited to ensure nothing hinky has occurred? Fuck me, if that's truly the case, we're all doomed. If the system modified anything, then those modifications should obviously be checked out to have done exactly and only what they were expected to have done. Installers typically have elevated privileges, and are known vectors for oopsies let alone maliciousness. Hell, Zoom left an elevated binary because it was simply easier for them to do things vs malicious. To have an "audit" not inspect these things is such an obvious error on the auditor's behalf.
  - mhh__ 4y ago
    Security people seem to vary from proper devs with an interest in security to "I used to be a marine now I'm a security contractor" methodology-obsessed types. My faith in the former is strong, the latter category worries me.
    - hsbauauvhabzb 4y ago
      I came from dev. I agree.
    - darkerside 4y ago
      The ideal is you have both types taking different approaches
    - Hizonner 4y ago
      Actually, "devs" are typically not technically qualified either. You have to really understand how things work, not just be able to write a program. But you're basically right. And now there seems to be a meme going around that it's elitist and inappropriate to expect people to have any technical understanding at all before they start dictating technical decisions around security, and all you need is a willingness to learn the alphabet soup of requirements and mindlessly apply the checklists.
      - mhh__ 4y ago
        I said proper devs, in my defense. The people I hang around with tend to know how things work.
- tedunangst 4y ago
  Security audit means someone ran Nessus and checked that the version strings were in the acceptable versions spreadsheet.
  - viraptor 4y ago
    No, it doesn't. You're trivialising a whole industry of a whole range of skills and professionalism. Security audit means what you agree on between your and the contractor / agency / your internal team. (Specifically, if you don't want the service just for the corporate checkbox, you can find a company which will do what you're after) Similarly if I say I'm a bank and you should give me money, it doesn't mean that the whole concept of banking is a scam.
    - beckingz 4y ago
      It's correct, AND trivializing a whole industry.
      - refulgentis 4y ago
        Do you have a source on this? This is quite an accusation, doubling down on it must indicate some certitude...
        TexanFeller 4y ago
        It’s just absolutely true in my experience. Special agents that gave talks to us in grad school, FBI directors that spoke at security conferences I’ve been to, the people I grew up with that went into security - all morons! The professor I had that was into security and invited some of these people was relatively legit, but literally zero people I’ve met in industry are. One of my heuristics is people that use the word “cybersecurity” don’t know what they’re talking about.
        parkerduckworth 4y ago
        This is both hilarious and alarming
- Aeolun 4y ago
  Why would you expect a “questions for confluence” plugin to create a user, or have the ability to create a user…
AdmiralAsshat 4y ago
I'd agree, most likely part of the seed data that's needed for install or bootstrapping.
- gjsman-1000 4y ago
  I have disabled users in my project as well - it works great for an importer when something just doesn't quite import as a resource belonging to something (flukes happen). However, why is it so hard to make sure that a disabled user is actually disabled... I mean, even just setting the password to NULL would result in no possible SHA-256 hash matching (and I use hashing more advanced than SHA-256 alone BTW, just saying for sake of argument here). Instead, some idiot set the password to disabled1system1user6708 hoping that nobody would ever figure it out. Which might have somehow still actually worked because reversing a hash is hard, had they not left it in plain text in the package.
deleted 4y ago
[deleted]
SturgeonsLaw 4y ago
Does that also mean that whoever owns email.com could reset the password to that account?
- thunfischbrot 4y ago
  https://nitter.42l.fr/fluepke/status/1550471087560982531 https://nitter.42l.fr/fluepke/status/1550471087560982531 or anyone who signed up for this previously not existing email account...
Too 4y ago
The user name is so bad you would almost think it is designed to intentionally mislead. Anyone with the right sense of mind would otherwise call this functional-user-questions-plugin. On the other hand, if someone intentionally wanted to mislead they would have named the user James to mislead even more.

by koolba 4y ago

flatiron 4y ago

i dunno how a security audit of a staging environment wouldn't pick this up. what security professional wouldn't go "hmm lets see what users this thing created and their permissions" as one of the top 10 things... i dunno maybe i'm in the wrong field but at least i would check that out.

resizeitplz 4y ago
Very well could have, and then someone said "Yeah but we neeeeeed it"
btown 4y ago
I feel like many security professionals could have thought "this is necessary for some internal system operation so I won't touch it, and it's not like it has a hardcoded password or anything" and yet it has a hardcoded password.
hsbauauvhabzb 4y ago
I’m a security auditor. I dont think many security auditors think like that.
- dylan604 4y ago
  That's a really sad statement, and proves to me that security audits are just another scene within the grand play that is security theater
  - phpisthebest 4y ago
    Having been in a number of audits (it, insurance, financial, etc) over the the years.... all audits are theater
    - dylan604 4y ago
      Yeah, but security theater is the only one that makes you take all of your stuff out of your bags and then take off your shoes.
      - other_herbert 4y ago
        Audience participation! ………..
      - ineedasername 4y ago
        Yes, in air travel alone it has given us the war on liquid volumes above 3.4oz and the war on shoes. Luckily by 2009 the fervor & public willingness to go along had died down a bit so we all go to keep our underwear after NWA Flight 253.
  - hsbauauvhabzb 4y ago
    I don’t think it’s theatre. It’s difficult to audit applications when you lack context, it could also be seen and assumed benign / intentional. I think that the industry is immature and severely conflicted on the quality:profit ratio.
    - dylan604 4y ago
      Looking at the capabilities of the default users created by the software after fresh install is difficult to wonder if it should be audited to ensure nothing hinky has occurred? Fuck me, if that's truly the case, we're all doomed. If the system modified anything, then those modifications should obviously be checked out to have done exactly and only what they were expected to have done. Installers typically have elevated privileges, and are known vectors for oopsies let alone maliciousness. Hell, Zoom left an elevated binary because it was simply easier for them to do things vs malicious. To have an "audit" not inspect these things is such an obvious error on the auditor's behalf.
- mhh__ 4y ago
  Security people seem to vary from proper devs with an interest in security to "I used to be a marine now I'm a security contractor" methodology-obsessed types. My faith in the former is strong, the latter category worries me.
  - hsbauauvhabzb 4y ago
    I came from dev. I agree.
  - darkerside 4y ago
    The ideal is you have both types taking different approaches
  - Hizonner 4y ago
    Actually, "devs" are typically not technically qualified either. You have to really understand how things work, not just be able to write a program. But you're basically right. And now there seems to be a meme going around that it's elitist and inappropriate to expect people to have any technical understanding at all before they start dictating technical decisions around security, and all you need is a willingness to learn the alphabet soup of requirements and mindlessly apply the checklists.
    - mhh__ 4y ago
      I said proper devs, in my defense. The people I hang around with tend to know how things work.
tedunangst 4y ago
Security audit means someone ran Nessus and checked that the version strings were in the acceptable versions spreadsheet.
- viraptor 4y ago
  No, it doesn't. You're trivialising a whole industry of a whole range of skills and professionalism. Security audit means what you agree on between your and the contractor / agency / your internal team. (Specifically, if you don't want the service just for the corporate checkbox, you can find a company which will do what you're after) Similarly if I say I'm a bank and you should give me money, it doesn't mean that the whole concept of banking is a scam.
  - beckingz 4y ago
    It's correct, AND trivializing a whole industry.
    - refulgentis 4y ago
      Do you have a source on this? This is quite an accusation, doubling down on it must indicate some certitude...
      - TexanFeller 4y ago
        It’s just absolutely true in my experience. Special agents that gave talks to us in grad school, FBI directors that spoke at security conferences I’ve been to, the people I grew up with that went into security - all morons! The professor I had that was into security and invited some of these people was relatively legit, but literally zero people I’ve met in industry are. One of my heuristics is people that use the word “cybersecurity” don’t know what they’re talking about.
        parkerduckworth 4y ago
        This is both hilarious and alarming
Aeolun 4y ago
Why would you expect a “questions for confluence” plugin to create a user, or have the ability to create a user…

AdmiralAsshat 4y ago

I'd agree, most likely part of the seed data that's needed for install or bootstrapping.

gjsman-1000 4y ago
I have disabled users in my project as well - it works great for an importer when something just doesn't quite import as a resource belonging to something (flukes happen). However, why is it so hard to make sure that a disabled user is actually disabled... I mean, even just setting the password to NULL would result in no possible SHA-256 hash matching (and I use hashing more advanced than SHA-256 alone BTW, just saying for sake of argument here). Instead, some idiot set the password to disabled1system1user6708 hoping that nobody would ever figure it out. Which might have somehow still actually worked because reversing a hash is hard, had they not left it in plain text in the package.

deleted 4y ago

[deleted]

SturgeonsLaw 4y ago

Does that also mean that whoever owns email.com could reset the password to that account?

thunfischbrot 4y ago
https://nitter.42l.fr/fluepke/status/1550471087560982531 https://nitter.42l.fr/fluepke/status/1550471087560982531 or anyone who signed up for this previously not existing email account...

Too 4y ago

The user name is so bad you would almost think it is designed to intentionally mislead. Anyone with the right sense of mind would otherwise call this functional-user-questions-plugin. On the other hand, if someone intentionally wanted to mislead they would have named the user James to mislead even more.