Hacker News Reader

Comment by corndoge | Hacker News Reader

Did I misread the article, or is this not really saying anything? I think most comments here think that this means locally overriding policies leads to elevated access on the server, but what is demonstrated is only enabling certain UX features that are disabled per server side policy by lying to the client. For example, the video demonstrating "bypassing cloud storage restrictions" only enables the client side button to add providers other than SharePoint, but this has no effect serverside. Similarly, bypassing editing and deleting policies client side is shown but with no mention of whether this has any effect on the server or is just a cosmetic effect on the client.

Another blog post could be written titled "I wrote my own teams client where I'm allowed to edit messages locally", would that be a security issue?

In other words there is not really anything of note, if I read the post correctly.

View on HN

Unfortunately I feel like this is the new standard for security "researchers."

Bug bounty programs and flashy brand name vulnerabilities have created this ecosystem where lots of security "researchers" publish long blog posts about so called "vulerabilities" they have discovered, hyping them up to be way more than they are. In hopes of getting bug bounties or hired as contractors I assume.

I had to unsubscribe from reddit's r/netsec and r/blackhat due to the number of borderline false posts like this.

There's like this intense pressure of people in security to network it seems. In the rare times I would post on netsec/blackhat to correct a misconception I'd get reached out to to connect on linkedin and whatnot.

Of course there is still some tremendous security researchers out there, like those at Google ProjectZero, but this industry seems to also attract a lot of borderline grifters.

There's nothing at all new about marginal security researchers making mountains out of molehills; it's a time-honored tradition. But you're miscalibrated if your threshold for good researchers is P0. There's plenty of bounty randos doing tremendous work as well.

I guess, personally it just feels like there is an uptick in security "researchers" making mountains out of molehills, or more common mountains out of literally nothing, such as this "vulerability."

This is akin to saying fakeroot gives you root capabilities, or claiming to get root by doing "export PS1='# '"

I never said P0 is my threshold, I just used them as an example of good security researchers. I don't doubt there are plenty of randos doing good work. I'm just finding the signal to noise ratio is getting worse.

I think the introduction to the article describes something that's not just a UI thing:

> While I was working with the previous version (v0.4.4) of AADInternals Teams functions I noticed an interesting thing: I was able to edit and delete chat messages using AADInternals as a guest even when it was not allowed.

I agree however that the rest of the article doesn't really make any attempts to show a server-side issue.

Exactly this. This is a situation where user input is only being sanitised client-side, not server-side. That's what's being (poorly) reported.

In the unlikely event that someone reading this doesn't understand why server-side sanitation of any user input is always required, xkcd.com/327 provides an amusing take.

Seems like a surface hack that makes people think something bad happens. I hate these kinds of issues as they will prompt emails from non-technicals who think it’s a real threat.

Agree. The backend tells you what is allowed and you override it and it shows that it is allowed now :)

The real issue would have been if the user did these actions and there was no backend validations on them. The video does not cover this.

Yip I am struggling to see where the security risk is. If the policies are still applied server side(I am assuming this is the case since they did not demo server side vulnerabilities). Then all you are doing is getting to a part of the UI that has no functionality. The same can be done with many other UI's by editing the local configuration.

I’m even more confused. In the video I see him doing something completely different from what he says in the article.

Neither the article nor the video prove that it does anything more than limit the display options client-side though. The source of truth is still the server and nothing here speaks to that...

He's suggested on twitter the enabled client functions do actually work:

https://twitter.com/NestoriSyynimaa/status/13211346867149537...

(But hasn't offered any evidence to back this up)

Yeah, this seems equivalent to "people who have rooted their phones can take secret screenshots of your snapchats!"... which is solidly on the "well yeah, obviously" side of the security-outrage boundary.

If it does change server data, yea - significant news. But that doesn't seem to be implied, except by omission of a claim that it does not.

He claims there are no server-side checks, but fails to demonstrate that this is the case.

The article is not saying that this is a security issue. It's saying that admin control of these policies is circumventable and so don’t depend on them. That's useful to know.

If you can't preform the action associated with the interface element, the policies are not circumvented though. Being able to see the interface elements, and being able to preform the action associated with the interface element, are different things.

But it seems like nothing actually depends on these policies except some cosmetic stuff in the client. So it's literally nothing.

Reply on news.ycombinator.com