Re:VW fired senior employee after they raised cyber security...
by torginus on Monday January 24, 2022 @05:31PM
(#30064977)
Security at a lot of large SW companies is a farce - I remember working on a huge piece of software, that had millions of lines written by 1000s of people. Everyone knew it was swiss cheese that anyone with a clue could easily exploit.
The firm hired some crack cybersecurity consultant - who was probably in on the joke. The guy mulled over the software, and found some Rube-Goldbergesque CVE-worthy exploit involving timing attacks, privilege escalation and what not. It was an impressive find, and they probably tried to insinuate, that the software was this hard to exploit.
A week later, I was debugging some memory leak - it turned out the app was hanging on to some authentication state objects, which among other things contained the username and plain-text password of every login attempt. Now, the software also had a feature of writing memory dumps when it crashed - another thing that was not terribly difficult to achieve. So the attacker could just walk up to the public computer, click around a bit, make it crash, then copy off the resultant dump file, and see everyones credentials who ever tried to log in.
I was a junior guy back then. When I told my boss, he realised that this was so embarassing, that we just fixed it - no bug ticket, no formal announcement, no nothing. This software handled very sensitive data.
The firm hired some crack cybersecurity consultant - who was probably in on the joke. The guy mulled over the software, and found some Rube-Goldbergesque CVE-worthy exploit involving timing attacks, privilege escalation and what not. It was an impressive find, and they probably tried to insinuate, that the software was this hard to exploit.
A week later, I was debugging some memory leak - it turned out the app was hanging on to some authentication state objects, which among other things contained the username and plain-text password of every login attempt. Now, the software also had a feature of writing memory dumps when it crashed - another thing that was not terribly difficult to achieve. So the attacker could just walk up to the public computer, click around a bit, make it crash, then copy off the resultant dump file, and see everyones credentials who ever tried to log in.
I was a junior guy back then. When I told my boss, he realised that this was so embarassing, that we just fixed it - no bug ticket, no formal announcement, no nothing. This software handled very sensitive data.