News for hackers. Stuff that matters.

A comment on Abusing Entra OAuth for fun and access to internal Microsoft applications. Parent comment

Re:Abusing Entra OAuth for fun and access to internal Micros... by michaelt on Sunday August 10, 2025 @08:44AM (#44854812)
In the bad old days, if your company-internal tools were full of XSS bugs, fixing them wasn't a priority, because the tools could only be accessed with a login and VPN connection.

So outside attackers have already been foiled, and insider threats have a million attack options anyway, what's one more? Go work on features that increase revenue instead.

In principle the idea of "zero trust" was to write your internal-facing webapps to the same high standards as your externally-facing code. You don't need the VPN, because you've fixed the many XSS bugs.

In practice zero trust at most companies means buying something extremely similar to a VPN.

[ Parent | on HN ]
Re:Abusing Entra OAuth for fun and access to internal Micros... by nicce on Sunday August 10, 2025 @03:04PM (#44857411)
> In principle the idea of "zero trust" was to write your internal-facing webapps to the same high standards as your externally-facing code. You don't need the VPN, because you've fixed the many XSS bugs.

But why stop there? If these apps are not required to be accessed from public world, by setting up VPN you need to exploit both VPN and and the service to have an impact. Denial of specific service is harder and exploiting known CVEs is harder.

[ Parent | on HN ]
Re:Abusing Entra OAuth for fun and access to internal Micros... by Thiez on Monday August 11, 2025 @02:21AM (#44861227)
Because the protection that the VPN provides decreases the risk of having bugs to the point where they won't get prioritized, ever.
[ Parent | on HN ]
Re:Abusing Entra OAuth for fun and access to internal Micros... by nicce on Monday August 11, 2025 @08:42AM (#44863518)
That is just bad management, to be fair. Companies need to intentionally increase risks before they can fix them?
[ Parent | on HN ]
Re:Abusing Entra OAuth for fun and access to internal Micros... by pixl97 on Monday August 11, 2025 @10:17AM (#44864355)
Eh, at the same time VPNs can be a huge mess of problems on top of all the other problems that exist. Async routing is always a fun one in complex topologies.
[ Parent | on HN ]