4 ms·
My favourite issue caused by a corporate firewall was when it altered an AJAX request to replace a specific combination of digits (in a long product ID) by aste
by pilif 4y ago
My favourite issue caused by a corporate firewall was when it altered an AJAX request to replace a specific combination of digits (in a long product ID) by asterisks.
Turns out that a substring of that product ID matched the client company's phone number and their security theatre intercepting proxy was replacing all occurrences of "sensitive" strings sent to the internet with asterisks.
The irony is, of course, that as the people running the site, I didn't know (and would never have wanted to know) the user's phone number until this incident.
How I loathe security theatre.
- deleted 4y ago[deleted]
- HPsquared 4y agoDid you let them know? They of course need to patch this vulnerability by blocking anything containing 11 consecutive digits.
- pstuart 4y agoThat's crazy! The right thing would be to add a lookup function to first verify the phone number is in use and then call the number to ask for permission to use it; followed by a webhook to send a confirmation back to the database to cache that info because this needs to be efficient! /s
- alexvoda 4y agoHow do you propose to tackle the cache invalidation challange? /s
- deleted 4y ago[deleted]
- deepsun 4y agoNow the other site knows the phone number (they know what was sent, and they see what was replaced by asterisks). And now they can exfiltrate all the sensitive phone numbers -- just sending clients (you) long strings of numbers, and see what was replaced.
- deleted 4y ago[deleted]
- slt2021 4y agothis is because you deployed your somewhere in the public cloud and testing it from your workstation over public Internet? This is policy violation, and you need to learn how to develop and test properly over secure channels. Reach out to your Director of Engineering and request proper instructions how to develop and test software. public Internet facing channel is rightfully scanned and screened for these kind of patterns to prevent unauthorized data loss
- ornornor 4y agoYou must be fun to work with.
- slt2021 4y agoHad to deal with too many interns who go to company server and start updating packages and installing random stuff from internet using wget | sudo bash, like it is their college laptop, just to run some of crappy python snippet they found over at Stackoverflow
- Xelynega 4y agoWhy are you giving interns root access to production servers?
- Fredej 4y agoOr, hear me out ... Get a different job.
- pilif 4y agoI think you misunderstood my tale. I'm running a SaaS business and one of our customers users had this issue when they were interacting with the site because that end user's proxy server was arbitrary altering AJAX requests made by their browsers. This is a end user making a request to an online shop and the POST request to "add product 123456 to the basket" gets changes to "add the product 12***6 to the basket" by a security* proxy between the end user and the web site. This isn't specific to the site we run. This would have happened on any site they were posting to.
- pandaman 4y agoThey have just implemented this protocol http://bash.org/?244321 http://bash.org/?244321