mag00

3 ปีที่แล้วdiscuss

> E.g address X sends $100MM worth of bitcoin to two addresses, with ~$1k going to address Y and the rest going right back to address X.

What you are likely looking at is not fraudulent and is a characteristic of bitcoin's UTXO design in almost every transaction that doesn't deplete a wallet. If it didn't send the remaining BTC to itself, it would be the "mining fee". So you see these transactions where you see the remaining change is sent back to the same wallet.

mag00

9 ปีที่แล้วdiscuss

If you're a OneLogin customer trying to figure out what you're supposed to do now, this is what you're supposed to do:

https://support.onelogin.com/hc/en-us/articles/115002695483?...

(A logged out and "won't be updated" version: https://pastebin.com/2eAtMyEv)

Take special note of the "secure notes" feature.

Do your engineers store infrastructure secrets, (like AWS Access Keys / Secrets) within it?

The instructions indicate that these "Secure Notes" are likely compromised and an adversary has the ability to decrypt them. If your answer was yes, a bad guy has easy access to your environment.

Additionally, if you're feeling extra cautious, you should look into malicious activity within any dashboards or logs provided by apps you authenticate with OL into. For instance, any sort of "recent logins" feature.

Lastly: It's sort of unclear to me what the exposure for any potentially leaked multifactor integrations might be. For instance, a DUO integration + secret key, if they leaked, and if a credential roll for MFA integrations need to happen.

mag00

10 ปีที่แล้วdiscuss

Yep, fixing

mag00

10 ปีที่แล้วdiscuss

I don't like the idea of keeping secrets in ENV and limiting it to config, though it's the kind of thing I'd ask other folks about myself to understand any tradeoffs. I see Kubernetes and other things supporting secrets in env variables so unsure how common it is.

The big win is simply keeping secrets out of source code, out of an general engineer's copy/paste buffer, and with errors not going to a logging platform with single factor access. Your likelihood of a short term incident decreases dramatically. Especially if those secrets have well segmented access, (IE, not a single AWS key with `AdministratorAccess` everywhere).

mag00

10 ปีที่แล้วdiscuss

Hi, I wrote this!

To continue a discussion:

  - How does your engineering team track new "debt" after releasing code? (if at all, and why not)
  - Do you pay anyone for centralized logging, or wish you didn't? Are you making it useful?
  - Do you feel like your company is good at managing access when hiring / firing people?

Otherwise thanks for any feedback, I enjoy writing these!

mag00

11 ปีที่แล้วdiscuss

I'm curious how typo and bit squatting would come into play here, and if attacks leveraging them could collect private keys at a dangerously high rate before people can patch their clients.

Products like heroku, or the stripe CTF, or other things that come to mind that operate over SSH going rogue a bit scarier. If one were to be compromised it would be a case where mass amounts of private keys could leak. AWS, github, all cloud VPS providers, etc.

Multifactor is relevant as a defense with a vulnerability like this.

Submissions

A Decade of Account Takeover

comments