Recently, it was reported Weebly suffered a massive data
breach that included usernames and password hashes. But the good news is the passwords were
hashed using bcrypt with a work factor of 8.
While I would have preferred to have seen a stronger work factor there
is no faulting the team that is responsible for storing passwords since they
used a very secure hashing algorithm to store passwords. Kudos to the team at Weebly that was responsible
for storing passwords. You had one
job! And congratulations, you did it
very well.
A common response from developers is “if our network gets
penetrated then we are already screwed so why should I worry about validating
input coming from this internal source?”
Every application, whether it’s homegrown or 3rd party, is
part of a larger ecosystem in an organization.
Whether it’s a firewall, a file sharing application, or a billing
system, these all provide an opportunity for a hacker to penetrate an
organization. As long as the rest of the
ecosystem is hardened a hacker won’t be able to penetrate further. This is what is meant by “you had one
job!” Developers need to develop their
applications assuming the rest of the ecosystem will be compromised at some
point. Assuming your organization’s
ecosystem is hostile is not a mindset most developers have. Awareness training is great to get this point
across but a better method to demonstrate how these attacks can occur is threat
modeling the application which includes being attacked from within the
application’s ecosystem. Showing how
malicious data can be spread from a compromised application to other
applications is a great scenario to work out.
Get your Red Team involved to develop proof of concepts. Record these proof of concepts so the videos
can be viewed by anyone wanting a demonstration of how these attacks
occur. Seeing an attack in your own
ecosystem is much more effective than reading about an attack against another
organization’s application.
The Weebly team responsible for password storage is
breathing a sigh of relief today because they did their job. They aren’t having an uncomfortable
conversation with the security team because they improperly hashed the passwords. More importantly, the users can rest assured
knowing their passwords are still safe.
Do your job and the rest will take care of itself.
