3 ms·

It's always a little unexpected when the security vulnerabilities are in the tools we use to build software instead of just in the software. I suppose it's a cl

It's always a little unexpected when the security vulnerabilities are in the tools we use to build software instead of just in the software. I suppose it's a class of supply chain vulnerability. In this particular class of impersonation problem (the Gitlab issue is about running a pipeline as another user), sometimes I find it unnerving how much an attacker could accomplish in a software company by being able to impersonate an arbitrary Slack user. We are taught to be cautious around incoming email, but I've yet to see a security training around "how do you know that your instant messages are genuine."

thejosh 3y ago
session tokens are a fun one, that's how Linus Tech Tips (tech Youtuber) and other Youtubers got their accounts yoinked.
- zx8080 3y ago
  Mind sharing links on what's happened?
  - FirmwareBurner 3y ago
    Someone from the staff opened a pdf with malware sich stole their Session tokens and bam.
    - Operyl 3y ago
      Wasn’t a PDF, straight up just regular exe. Their business unit aren’t “techies” per se like the rest of them.
      - blackjpi 3y ago
        In fairness, it was file extension spoofed[1] exe made to look like a PDF file. When sent to someone who frequently downloads and opens PDFs as part of their job, it would be a very easy mistake to make, especially for the unaware to this attack vector. [1] https://www.malwarebytes.com/blog/news/2016/09/lesser-known-tricks-of-spoofing-extensions https://www.malwarebytes.com/blog/news/2016/09/lesser-known-...
        Operyl 3y ago
        Yup, just clarifying that it wasn’t some crazy PDF reader exploit (which would have been kinda amazing).
        tyingq 3y ago
        > some crazy PDF reader exploit One of those: https://6point6.co.uk/insights/abusing-pdf-files/ https://6point6.co.uk/insights/abusing-pdf-files/
deleted 3y ago
[deleted]
kawsper 3y ago
This happened to us using Flowdock (a Slack competitor), they had a main DB failure, and when a new one was promoted the state was bad, and so "new" employees from another company started appearing in our organisation replacing our own employees, they could then read our private messages and access our rooms. https://web.archive.org/web/20220704223244/https://flowdock-resources.s3.amazonaws.com/legal/Flowdock-RCA-For-Incident-On-2020-04-21.pdf https://web.archive.org/web/20220704223244/https://flowdock-... It was really hard for me to find a responsible from Flowdock/Broadcom/Rally Software/CA Technologies to report the leak, but in the end they killed the servers until they got the issues under control. Because of this I mostly share encrypted files over chat, using OpenPGP, but the user experience is terrible for most :(
- wiktor-k 3y ago
  Wow, that's really disturbing. > Because of this I mostly share encrypted files over chat, using OpenPGP, but the user experience is terrible for most :( Agreed. Even with builtin OpenPGP support in Thunderbird the UX is still bad for regular users (well, for technical ones too).

thejosh 3y ago

session tokens are a fun one, that's how Linus Tech Tips (tech Youtuber) and other Youtubers got their accounts yoinked.

zx8080 3y ago
Mind sharing links on what's happened?
- FirmwareBurner 3y ago
  Someone from the staff opened a pdf with malware sich stole their Session tokens and bam.
  - Operyl 3y ago
    Wasn’t a PDF, straight up just regular exe. Their business unit aren’t “techies” per se like the rest of them.
    - blackjpi 3y ago
      In fairness, it was file extension spoofed[1] exe made to look like a PDF file. When sent to someone who frequently downloads and opens PDFs as part of their job, it would be a very easy mistake to make, especially for the unaware to this attack vector. [1] https://www.malwarebytes.com/blog/news/2016/09/lesser-known-tricks-of-spoofing-extensions https://www.malwarebytes.com/blog/news/2016/09/lesser-known-...
      - Operyl 3y ago
        Yup, just clarifying that it wasn’t some crazy PDF reader exploit (which would have been kinda amazing).
        tyingq 3y ago
        > some crazy PDF reader exploit One of those: https://6point6.co.uk/insights/abusing-pdf-files/ https://6point6.co.uk/insights/abusing-pdf-files/

deleted 3y ago

[deleted]

kawsper 3y ago

This happened to us using Flowdock (a Slack competitor), they had a main DB failure, and when a new one was promoted the state was bad, and so "new" employees from another company started appearing in our organisation replacing our own employees, they could then read our private messages and access our rooms. https://web.archive.org/web/20220704223244/https://flowdock-resources.s3.amazonaws.com/legal/Flowdock-RCA-For-Incident-On-2020-04-21.pdf https://web.archive.org/web/20220704223244/https://flowdock-... It was really hard for me to find a responsible from Flowdock/Broadcom/Rally Software/CA Technologies to report the leak, but in the end they killed the servers until they got the issues under control. Because of this I mostly share encrypted files over chat, using OpenPGP, but the user experience is terrible for most :(

wiktor-k 3y ago
Wow, that's really disturbing. > Because of this I mostly share encrypted files over chat, using OpenPGP, but the user experience is terrible for most :( Agreed. Even with builtin OpenPGP support in Thunderbird the UX is still bad for regular users (well, for technical ones too).