Devops and password tests

-
"Umm... could you test to login to  X and see if it works the same for you as it worked for me? I'm a bit confused right now."

Tried to login with my own account and with the admin account. Worked just fine.

"No no no. Correct login works. But if you'll input password with x spaces, how it works then?"

Tried my own account + one space as the password. Then with two. Then tried my colleagues account with various number of spaces. And then switched to test with various admin accounts.

No, it shouldn't work like this. If the password was empty, we got the normal reply that the login failed, or if the password was actually wrong. But with only one or more spaces in the password field we got in. No matter what was the account.

My colleague created a ticket to the manufacturer, because we still weren't sure if this was due to misconfiguration or something else.

Things started to escalate quite rapidly. And not long after they had asked some more details, we got a call from quite high level executive of that company. "Umm... It's better if you deny access to the login page for now. And could you please not to speak about this publicly for a little while? We are making a fix for this ASAP...."

They fixed it. And my colleague got some money from their bug bounty program.

Naturally they didn't share with us what was the actual reason for this behavior, but I have some thoughts after discussing with various people.

I don't know how this system does the authentication internally, but for example with LDAP this error is almost too easy to do, so perhaps something similar was going on? The system was connected to a properly configured LDAP but the issue appeared also with the internal accounts.

  1. Check if the password is empty, and return failed login if it is.
  2. Strip spaces before and after the password string -> password is now an empty string
  3. Check if the account is valid by using the provided login details to bind to LDAP. If the bind works, account is valid.
  4. And forgot that if the password is empty string, it's probably binding anonymously, which is quite often allowed by default in LDAP systems. So, bind works -> login allowed with the provided account name.
I'm not sharing any details of the system, because it doesn't matter which it was. What matters is that even global big IT security companies can have this kind of bugs in their successful products.

Unfortunately not many companies are publicly sharing their findings[1]. It would be really interesting to know how this kind of a bug got through their development process, and it would be good that others could learn from that!

So, if you are working in software development, please check that your software test processes (hopefully automated by devops processes....) will really check various login use cases.

[1] Visma is wonderful exception, when they got targeted in cyber espionage campaign in 2017-18 https://www.visma.com/press-releases/intelligence-report-visma/

Comments

Post a Comment

Popular posts from this blog

The only constant is change

-
"I'm leaving next week. I'll change to company Y." This comment from my coworker caused quite many feelings and put my thoughts in motion. "Company Y.... Umm... I have heard it few times, and I know persons who have joined them, but I have no clue what they actually are doing. Let's see what their website shows. Oh. They seem to have an open position, which would be a direct match for me." At this point I had been in my position a little less than three years. Those years had been absolutely incredible, from the experience (and also CV...) point of view. When you are working in a global enterprise as the product security engineer/cyber security architect for a product line whose products are used globally in critical infra related use cases, it's quite unique place to gather experience and hopefully also knowledge & know-how.  There were multiple really interesting projects going on, which would give even more experience around how to secure 40 y...
Read more

Passion is a fruit

-
 "What if we educate them and they leave?"  "Well, what if we won't and they won't leave?" "Hi, there will be a big security conference in Helsinki next February. I'm going there. Can I use work hours for that or should I use my vacation days?" This is how I presented the trip to Disobey to my boss last autumn.  Disobey is quite a unique event, and presentations are not The Thing(tm) for this event, even though they are also awesome. Meeting people and discussions with them are among the reasons to go there.  This year the following presentations were nominated to my top list. Not all of them will be released on Youtube, but I can recommend any of those which will be released. Antti Kurittu: Story of Vastaamo (Keynote) Juho Jauhiainen: Losing My Mental Health in Cyber Security Jussi Eronen: Vulnerability Handling for the Masses Helinä Turunen: Cyber Comms 101 - What to Say When Cyber Hits the Fan (workshop) Lea Viljanen: Hacking the Audit Int...
Read more

Hack the Box, CTF, challenges, and ethical hacking (+ some thoughts about courses)

-
During last few years I've bought some Udemy courses when some person has suggested them. Mostly they are related to security and hacking, because that's the high level topic in ICT which interests me most. Yes, I've bought them. And hadn't started any. Until this summer. In the past if you wanted to learn some new skill in the ICT world, you usually attended some 3-5 day long course which normally costs some thousands of euros. Quite costly, too much information in short time span, and it required many days off from work + traveling. Then came the online courses. They cost less, you can follow the videos as you wish with your own schedule and you'll get community reviews for courses before buying them. I'm not fully sure but I suppose that the instructors get some amount of money for every attendee and no one wants to use their money (or time) to poorly made course. Thus every instructor has an incentive to make their course as good as just possible. At the mo...
Read more