News for hackers. Stuff that matters.

A comment on Facebook Network Breach Impacts Up to 50M Users. Parent comment

Re:Facebook Network Breach Impacts Up to 50M Users by cbzoiav on Saturday September 29, 2018 @06:15AM (#18099613)
Meanwhile I work for a major US IB. While I don't work on anything customer facing our internal SSO infrastructure basically consists of a single cookie that gets access to almost everything.. And its really not difficult to sniff one from another user (like say getting them to visit a link like http://mydesktop.companyname.com/..).

Its so bad that for certain systems we check the origin of your connection and will only trust you if you've come from the DMZ rather than internal.

[ Parent | on HN ]
Re:Facebook Network Breach Impacts Up to 50M Users by ramchip on Saturday September 29, 2018 @09:47AM (#18100278)
Is the cookie not associated to a specific IP? SSO systems would normally flag the mismatch if you try to connect to a website and pass an SSO cookie issued for a different IP, so sniffing cookies wouldn’t help all that much.
[ Parent | on HN ]
Re:Facebook Network Breach Impacts Up to 50M Users by thefounder on Saturday September 29, 2018 @01:34PM (#18101635)
In the mobile space the IP address changes all the time, isn't it?
[ Parent | on HN ]
Re:Facebook Network Breach Impacts Up to 50M Users by ramchip on Saturday September 29, 2018 @10:13PM (#18104099)
It's unlikely to change between the SSO login page and the application's login page, and it doesn't matter if it changes later on since the app can issue its own session cookie which isn't tied to an IP.
[ Parent | on HN ]