Hacker News Reader

Comment by Full_Clark | Hacker News Reader

I feel like a step is missing. How does one go from having access to Slack channels to exfiltrating scads of sensitive data?

Did they impersonate the software development manager in order to steal credentials? Did Disney integrate their sensitive data storage with Slack?

View on HN

Disney is almost certainly using SSO for their Slack auth. there's a high chance the Disney staffer was signed into a browser profile with active cookies for Disney ('s auth provider). assuming the game mod gave them filesystem access, they've got the cookies and can use them elsewhere. job done.

Oh yikes.

So the industry has basically just gone and reinvented the very premise Google built BeyondCorp to mitigate, starting back in 2009.

IIUC the baseline premise was to move away from "login to the VPN and you're inside the corporate network and you can access everything". It was incredibly convenient but a logistical nightmare in practice.

The BeyondCorp approach was to integrate authentication into each product so that the access control could be managed on a case by case basis.

Google standardised on OAuth across the board, and had a centralised login protocol/API with a WAF etc, but each product called out to this, and policy was decided by the calling application. This approach shines through to the whole Login with Google ideology.

Thinking about it, I wonder how much corporate/enterprise/even SOHO OAuth is effectively the inverse of this approach - login to eg Auth0 once and you immediately have access to all your apps.

That approach isn't technically broken, but it feels a bit like there's an antipattern here in the encouragement of centralised policy management. That just encourages everyone to think about "login once!" just like the old VPNs.

And it's just hilarious how everyone's just... wandered in this direction. First VPNs, then "centralised access bad", then BeyondCorp, then OAuth, then "login once!", and back to the beginning.

At least the web gives you the tools to setup siloed authentication per app. VPNs don't provide that level of slicing and dicing. So it's easier to fix, and merely a (complex) security design problem now.

Amazon is no different, needs a $bigCorp in your story there

Is Amazon on the "built a BeyondCorp clone" side, or the "Auth0 is the new VPN!" side?

> a logistical nightmare in practice

Could you elaborate? I'd like to learn from the errors of the past

[assuming you're using best practices etc] having your users log into a centralized VPN means that you've got all your different on-prem/DC services and services all in well-designed tightly-controlled VLANs with pinhole access network ACLs between them. additionally, you've got your VPN users in tightly-controlled role-specific VPN groups in their own IP pools that are again additionally tightly-controlled via network ACLs. all of this takes time to setup, run and monitor. unless you run a tight ship with automation helping many of these steps and layers, it can be a logistical nightmare. maybe that's GP meant.

I don't see how Slack is not the prime example of BeyondCorp approach? No VPN or firewall, all access control is done via centralized system. I don't know what Disney was using for identity, but it could have even been Google.

After all, what could have been done differently? Require password retype/MFA multiple times per day? This would drive people crazy, and if the computer ia infected then credentials could be stolen anyway.

"LOL" said Windows. "LMAO"

Pretty much every company I've worked for had credentials and other sensitive information easily discoverable on Slack, making it a massive headache to clean up.

Slack has all kinds of integrations built-in. For example, paste a google docs link into slack, and you can preview and download the doc right there. There are all kinds of file sharing and app tie-ins.

    Now talking in #ds_it_helpdesk
    RoyD: hi guys this is roy. i have trouble with logging on says my password is wrong. i double checked it multiple times but it doest let me in. can you reset it to Mickey123?
    MarkP: hi. reset it for you, check now?
    RoyD: works now thanks

This is a work of fiction. Names, characters, places and incidents either are products of the author's imagination or are used fictitiously. Any resemblance to actual events or locales or persons, living or dead, is entirely coincidental.

If it was real RoyD would have asked for it to be reset to Mickey1928. Anything else and MarkP would have known it was a scam.

The user probably had permissions to add Slack apps, which can then read anything.

Given Slack is mentioned I'd guess credentials to some remote machine were regularly posted in a channel as a means to notify about periodic password changes.

Reply on news.ycombinator.com