Slashdot Mirror
Huddle's 'Highly Secure' Work Tool Exposed KPMG And BBC Files (bbc.com)
Chris Foxx, reporting for BBC: The BBC has discovered a security flaw in the office collaboration tool Huddle that led to private documents being exposed to unauthorised parties. A BBC journalist was inadvertently signed in to a KPMG account, with full access to private financial documents. Huddle is an online tool that lets work colleagues share content and describes itself as "the global leader in secure content collaboration." The company said it had fixed the flaw. Its software is used by the Home Office, Cabinet Office, Revenue & Customs, and several branches of the NHS to share documents, diaries and messages. "If somebody is putting themselves out there as a world-class service to look after information for you, it just shouldn't happen," said Prof Alan Woodward, from the University of Surrey.
"Huddles contain some very sensitive information."
That just seems odd... 20 milliseconds is a long time when it comes to computers, and having the same "auth code" which can get one user to have another user's token seems like piss-poor design. This never should have been done in the first place.
The cloud is just someone else's servers.
It's amazing how much people trust other people's servers. Some are good: both google ana amazon for example have a good reputation when it comes to the security of the core infrastructure.
But they are large frequently attacked and have been around a while. It's amazing how much trust people will put in a company that simply talks a good game but doesn't really have anything to back that up.
SJW n. One who posts facts.
Anyone that exposes "very sensitive information" to the internet is a fool.
Period
End of Message
Collaboration doesn't imply "clouds" but it does networks.
In British business English, a "diary" is a calendar. Just in case you were wondering why businesspeople were writing their diaries on workplace cloud services.
Take off every 'sig' !!
... Brute?
It little behooves the best of us to comment on the rest of us.
https://www.youtube.com/watch?...
Even that doesn't always help. If the system is complicated enough you can still be hacked. Here is a bug we found in one of our systems where the files where encrypted and the process handling the data could only access one particular users data. Also the output of the system could only send an email to the active user. Somewhere in the processing of the data a javascript function was called with the data. In the javascript we were able to redefine one of the functions so that it acted correctly on the current users data but then stored that users in an array. The malicious user could put this code in their own data. It would then run normally for every other user but when the malicious user data was processed again it would email back everyone's data. The exploit was in a kendo grid framework, five layers removed from the person who did the database securing. I'm 100% sure that we could have found other bugs but this was just an example of why all these fancy layers and tools make security impossible.
If it's running in Javascript, Kendo UI, it's client-side. Whoever was responsible for the server-side developing ALSO fucked up here - the server should *NOT* have trusted a client input without validating it. If it had been validated on the server, this would have been impossible. When the Kendo Grid returned values, the API or handler should have checked that those values were correct for the logged in user.
You are correct that a myriad of tools/frameworks makes security more difficult, but most companies still don't invest in security. It's difficult, not impossible.
Even that doesn't always help. If the system is complicated enough you can still be hacked. Here is a bug we found in one of our systems where the files where encrypted and the process handling the data could only access one particular users data. Also the output of the system could only send an email to the active user. Somewhere in the processing of the data a javascript function was called with the data. In the javascript we were able to redefine one of the functions so that it acted correctly on the current users data but then stored that users in an array. The malicious user could put this code in their own data. It would then run normally for every other user but when the malicious user data was processed again it would email back everyone's data. The exploit was in a kendo grid framework, five layers removed from the person who did the database securing. I'm 100% sure that we could have found other bugs but this was just an example of why all these fancy layers and tools make security impossible.
I found your problem!
Guess we should quickly have a look at those KPMG files... Might contain more damning information of tax evasion and money laundering like The Gupta Leaks emails exposed in South Africa. I know it's a bit of an off topic rant but as I live there I'm pretty incensed at KPMG and their dirty tricks which they pulled for 'President' Jacob Zuma (knobhead of the century).
if you ever access huddle using public computer huddle desktop app it will never end s session even after you reboot your computer
session cookie is always there
There go all my BBC pics :(