Re:SoftBank’s $375M bet on pizza went bad fast
by tal8d on Saturday February 15, 2020 @04:58PM
(#22338297)
The AFF back to back breaches were interesting because there were faults to found at every level.
* The breach included PII from a property they had already sold, but held onto for some reason.
* SHA1. A good choice if you want to slightly inconvenience somebody with a GPU, while also increasing the odds of your hashes getting uploaded in full to one of many distributed cracking projects.
* No effective user input validation. The exploit was one step in sophistication beyond those ancient IIS ../../hue.txt attacks.
* No attempt at anything resembling principles of least privilege, exec whatever wherever.
So, everyone failed - executives to DBAs. Screw pentests, start by implementing best practices that have been around for 40 years.
* The breach included PII from a property they had already sold, but held onto for some reason.
* SHA1. A good choice if you want to slightly inconvenience somebody with a GPU, while also increasing the odds of your hashes getting uploaded in full to one of many distributed cracking projects.
* No effective user input validation. The exploit was one step in sophistication beyond those ancient IIS ../../hue.txt attacks.
* No attempt at anything resembling principles of least privilege, exec whatever wherever.
So, everyone failed - executives to DBAs. Screw pentests, start by implementing best practices that have been around for 40 years.