You had one job!

Recently, it was reported Weebly suffered a massive data breach that included usernames and password hashes.  But the good news is the passwords were hashed using bcrypt with a work factor of 8.  While I would have preferred to have seen a stronger work factor there is no faulting the team that is responsible for storing passwords since they used a very secure hashing algorithm to store passwords.  Kudos to the team at Weebly that was responsible for storing passwords.  You had one job!  And congratulations, you did it very well.

A common response from developers is “if our network gets penetrated then we are already screwed so why should I worry about validating input coming from this internal source?”  Every application, whether it’s homegrown or 3^rd party, is part of a larger ecosystem in an organization.  Whether it’s a firewall, a file sharing application, or a billing system, these all provide an opportunity for a hacker to penetrate an organization.  As long as the rest of the ecosystem is hardened a hacker won’t be able to penetrate further.  This is what is meant by “you had one job!”  Developers need to develop their applications assuming the rest of the ecosystem will be compromised at some point.  Assuming your organization’s ecosystem is hostile is not a mindset most developers have.  Awareness training is great to get this point across but a better method to demonstrate how these attacks can occur is threat modeling the application which includes being attacked from within the application’s ecosystem.  Showing how malicious data can be spread from a compromised application to other applications is a great scenario to work out.  Get your Red Team involved to develop proof of concepts.  Record these proof of concepts so the videos can be viewed by anyone wanting a demonstration of how these attacks occur.  Seeing an attack in your own ecosystem is much more effective than reading about an attack against another organization’s application.  

The Weebly team responsible for password storage is breathing a sigh of relief today because they did their job.  They aren’t having an uncomfortable conversation with the security team because they improperly hashed the passwords.  More importantly, the users can rest assured knowing their passwords are still safe.  Do your job and the rest will take care of itself.