3 ms·
This kind of information seems like it should have a CVE and a responsible disclosure process. Kidding, mostly, but wow that's a hell of a vulnerability.
by hiddencost 2y ago
This kind of information seems like it should have a CVE and a responsible disclosure process.
Kidding, mostly, but wow that's a hell of a vulnerability.
- notepad0x90 2y agoIt is not a vulnerability, you literally pay for this feature. I really don't want to defend Crowdstrike but HN keeps making it hard not to.
- hiddencost 2y agoStoring secrets in unsecured environments in plaintext is literally a vulnerability. One of the most famous examples can be seen in the NSA slide at the top of this article: https://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html https://www.washingtonpost.com/world/national-security/nsa-i...
- notepad0x90 2y agothe security tools' storage system is always considered a secured environment.
- j4coh 2y agoWithout even having to secure it?
- throw_a_grenade 2y agoYes, but also No. So there's this thing called "Threat model" and it includes some assumptions about some moving parts of the infra, and it very often includes assertion that a particular environment (like IDS log, signing infra surrounding HSM etc.) is "secure" (they mean outside of the scope of that particular threat model). So it often gets papered over, and it takes some reflex to say "hey, how we will secure that other part". There needs to be some conciousnes about it, because it's not part of this model under discussuon, so not part of the agenda of this meeting... And it gets lost. That's how shit happens in compliance-oriented security.