Latest / Tech Talks With Kinsoft / Canva - The Feedback Tool With a Key to the CRM, and the Regulator That Went First

Transcript

Canva - The Feedback Tool With a Key to the CRM, and the Regulator That Went First · Tech Talks With Kinsoft

0:00
So, I mean, whenever a really major corporate
0:02
data breach hits the headlines, you know, we
0:04
kind of have this tendency to visualize it like
0:06
a blockbuster bank heist. Oh, yeah, totally.
0:10
Like lasers and vaults. Right, exactly. You picture
0:13
this sophisticated crew of threat actors battering
0:17
down the digital front door, you know, bypassing
0:19
biometric scanners and just making off with the
0:22
gold bullion while all the alarms are playing.
0:24
Yeah, which is a great movie plot, but... It
0:27
really assumes this centralized, fortified perimeter,
0:31
like this binary state where the wall is either
0:34
intact, keeping everyone out, or it's breached.
0:36
But, I mean, stepping into the actual reality
0:39
of a modern enterprise tech stack today, that
0:42
whole bank vault analogy just completely falls
0:44
apart. We aren't really dealing with single fortresses
0:47
anymore. No, not at all. You're looking at a
0:50
digital supply chain that is, by design, fundamentally
0:53
porous. Yeah. I mean, the modern enterprise doesn't
0:56
really have a single perimeter. It has thousands
0:59
of micro perimeters. They're all woven together
1:01
by, you know, API connections and OAuth tokens
1:04
and third party integrations. The walls aren't
1:07
walls. They're like a membrane. Exactly. A very
1:10
permeable membrane. And so that brings us to
1:13
the core of today's deep dive. We're looking
1:15
at this fascinating cybersecurity event from
1:17
September 2026 involving Canva. Which is just
1:21
a massive global design juggernaut. Right. And
1:25
we're pulling from some really stellar technical
1:27
analysis out of Kinsoft that breaks down how
1:29
they found themselves in the middle of this massive
1:31
data exposure. But the twist here, the part that
1:34
really forces you to reevaluate your own systems,
1:37
is that Canva's actual platform was never breached.
1:40
Yeah, that's the wild part. The attackers didn't
1:44
touch a single pixel of Canva's core design data.
1:46
Nothing. They didn't compromise the user accounts,
1:49
no passwords, no identity access management,
1:52
none of that internal infrastructure. So for
1:55
everyone listening who, you know, manages their
1:57
own SaaS sprawl, the big question is, how does
2:01
one of the world's most recognizable software
2:03
companies get their sensitive data stolen without
2:06
a single hacker touching their actual platform?
2:09
And to understand that, you really have to look
2:11
away from the main fortress. You have to look
2:13
at the integrations. Right, the side doors. So
2:16
Canva uses Salesforce as its CRM, which makes
2:19
sense. Yeah, standard architecture. You use a
2:21
heavyweight CRM to hold your major enterprise
2:24
contracts, order forms, contacts, all that administrative
2:28
lifecycle stuff. Okay, but where the vulnerability
2:30
actually came in was through this third -party
2:33
customer feedback tool called Kani. Canva connected
2:36
Kani to their Salesforce environment. And, I
2:38
mean, the operational logic makes total sense,
2:40
right? You want a feature request in Kani to
2:43
automatically map to the specific enterprise
2:45
customer in Salesforce. Sure. You want the tools
2:48
to talk to each other. But this feels a bit like,
2:51
I don't know, hiring a dog walker and accidentally
2:53
giving them the master keys to your safe. Why
2:56
on earth does a customer feedback widget have
2:58
the permissions to read sensitive master service
3:00
agreements and invoices in the first place? Well,
3:03
what's fascinating here is that this touches
3:05
on probably one of the most persistent structural
3:07
flaws in cloud integrations today. Which is?
3:10
The over -provisioning of OAuth scopes. Oh, right.
3:14
Yeah. So when an IT admin or like a product manager
3:16
goes to set up a connection between two SaaS
3:18
products, they're usually just presented with
3:21
a set of default permission requests. The API
3:24
needs authorization to read and write to the
3:27
CRM to actually work. And let me guess, those
3:29
default permissions are basically never granular?
3:32
Seldom. I mean... SaaS vendors want their integrations
3:36
to be totally frictionless. If they restrict
3:38
the API scopes too tightly, things break. And
3:41
then you get angry support tickets. Exactly.
3:43
It frustrates the user. So they just request
3:45
this really broad read and write access. And
3:49
the Canva admin clicks authorize. And suddenly,
3:52
this lightweight feedback tool has a persistent,
3:55
authenticated token. Wow. So it's just got a
3:57
backstage pass to the CRM's deepest administrative
4:00
databases. Pretty much. The principle of least
4:03
privilege is just completely sacrificed for operational
4:05
speed. You just want it to work. Which perfectly
4:08
sets the stage for the actual compromise. So
4:10
let's trace the timeline here, because I think
4:13
the speed of this is what really redefines modern
4:15
incident response. It's incredibly fast. Yeah.
4:18
So on August 28th, a completely different Canny
4:21
customer, the social platform VRChat, they get
4:24
notified by Canny about some unauthorized access
4:27
to Canny's internal systems. Right. Then the
4:29
next day, August 29th, CanE notifies Canva that
4:32
they're investigating a breach. And Canva actually
4:35
reacts immediately. They revoked CanE's access
4:37
to their Salesforce environment in minutes. Yeah,
4:40
I mean, cutting that token authorization that
4:42
quickly is textbook. It's the perfect incident
4:44
response. Identifying the compromised pipeline
4:47
and killing the session is exactly what their
4:49
security operations center should be doing. But
4:51
they didn't dodge the bullet, did they? Not at
4:54
all. Because in the physical world, if you catch
4:56
a guy breaking into your office and kick him
4:57
out three minutes later, he can only physically
5:00
carry so many files out the door. Right. He's
5:02
dropping folders on the way out. But an API operates
5:05
more like a digital printing press hooked up
5:07
to a fire hose. It's a matter of machine speed
5:10
exfiltration. We aren't dealing with a human
5:13
manually clicking through folders here. Right.
5:15
An attacker who has compromised Kani's internal
5:18
infrastructure can leverage that trusted API
5:20
token to just... script automated database queries
5:24
against canvas salesforce because to salesforce
5:26
it doesn't even look like an attack does it exactly
5:29
to salesforce it just looks like canny doing
5:32
its normal job the api requests are fully authenticated
5:35
they bypass all the external firewalls and intrusion
5:38
detection systems because that trust was explicitly
5:41
granted man So a scripted query can just blast
5:45
through thousands of records in, what, milliseconds?
5:47
Milliseconds. Parsing and extracting names, emails,
5:50
attached documents. By the time Canva got the
5:53
alert on the 29th and revoked the token, the
5:56
data transfer was already completely done. So
5:59
they slammed the door shut, but the room was
6:00
already emptied out. Basically, yeah. Okay, so
6:03
the connection gets severed, the bleeding stops,
6:06
and then silence. Yep, total radio silence. For
6:10
weeks. The public hears... Absolutely nothing.
6:13
Which brings us to what I think is the most fascinating
6:15
geopolitical angle of this whole thing. Oh, the
6:17
regulatory nightmare. Yes. Because if you're
6:20
an Australian tech giant dealing with a data
6:22
exposure, you kind of assume you control the
6:24
timeline, right? You prep the legal team, you
6:26
draft the holding statements, you privately inform
6:29
your big clients. You manage the narrative. Right.
6:31
But instead, the entire story gets broken on
6:34
September 16th by a government regulator in Ankara.
6:37
The KVKK. Yeah. The KVKK just publishes a public
6:42
notice detailing the whole breach notification
6:44
they got from Canva. They even outlined that
6:46
424 Turkish organizations were affected. Which
6:49
is wild. It is. So a Turkish media outlet runs
6:54
a story on the 17th. And meanwhile, Australian
6:57
financial media didn't even catch wind of a massive
7:00
homegrown company's breach until September 21st.
7:03
Yeah, Canva essentially got scooped on its own
7:06
crisis by a foreign regulator. Which has to just
7:09
completely upend the traditional corporate communications
7:12
playbook, right? It destroys it. Historically,
7:15
a company could contain the PR fallout while
7:17
they, you know, spent 30 days doing a forensic
7:20
investigation to find the exact blast radius.
7:22
Just keeping it under wraps. Right. But if we
7:24
connect this to the bigger picture, you just
7:27
cannot do that anymore when you're operating
7:29
under the fragmented realities of global data
7:32
sovereignty laws. Because all these different
7:34
regulators have totally different mandates on
7:36
transparency. Exactly. The regulatory landscape
7:39
is just a minefield of conflicting obligations
7:42
now. Under frameworks like GDPR or the KVKK in
7:46
Turkey, the notification windows are incredibly
7:49
tight, like 72 hours tight. Wow. And crucially,
7:53
some of these bodies view their primary mandate
7:55
as public protection, not your corporate confidentiality.
7:59
So they will take your mandatory confidential
8:01
disclosure and just publish it directly to their
8:04
national registry to warn their citizens. So
8:06
it basically renders the whole PR embargo thing
8:09
completely obsolete. Totally obsolete. If you're
8:12
a multinational, you just have to assume that
8:15
the moment you file a compliance disclosure in
8:17
Europe or the Middle East, you've basically just
8:20
published a global press release. That is such
8:23
a huge takeaway for anyone listening. You lose
8:25
the narrative control. Your crisis plan has to
8:27
assume that local disclosures are going to leak
8:29
globally before your own forensics team is even
8:31
done. If your incident response plan relies on
8:35
media silence while you investigate, your plane
8:38
is just structurally broken. Okay, let's shift
8:41
gears from the PR fallout to the actual payload,
8:43
because we need to talk about what they walked
8:45
away with before that API was severed. Right,
8:48
the data itself. So the Turkish regulator and
8:51
Canva's own communications eventually clarify
8:53
that the hackers grabbed staff names, business
8:56
emails, workplace locations, and work phone numbers
8:59
for employees at Canva's enterprise clients.
9:01
Which is bad enough on its own. Yeah, but more
9:04
critically, they exfiltrated order forms, data
9:07
protection agreements, master service agreements,
9:10
and historical invoices. And that, the exfiltration
9:14
of those MSAs and historical invoices, that is
9:17
a massive escalation in risk for those enterprise
9:19
partners. And we should mention, things got pretty
9:21
theatrical in late September, didn't they? Oh
9:23
yeah, the dark web claims. Right. So there's
9:26
this threat actor group calling themselves the
9:29
Seven Deadly Sins. They list Canva on an extortion
9:32
leak site, and they're claiming to have three
9:34
gigabytes of data, like two million Salesforce
9:36
records and 200 million rows from a data warehouse.
9:40
Yeah, but we have to put a massive caveat on
9:42
that based on the source analysis. Right, because
9:44
these claims are completely unverified, aren't
9:46
they? Totally unverified. There is no CVE vulnerability
9:49
score tying them to a specific technical exploit
9:52
on Candy's end yet. And honestly? Those numbers
9:55
vastly exceed the scope of the API exposure that
9:58
Canva has actually acknowledged. So why do they
10:00
make these huge claims? Just for attention? It's
10:03
extortion marketing. Threat actors on these leak
10:06
sites frequently inflate their inventory. It's
10:09
totally psychological. By claiming 200 million
10:12
rows, they're trying to force a panic -induced
10:14
settlement from the company. Or they just use
10:17
those inflated metrics to build credibility with
10:19
other cybercriminals. So basically, until forensic
10:22
telemetry actually validates it, treat it with
10:24
a grain of salt? Treat it as marketing. Okay.
10:27
So putting the unverified 200 million rows aside,
10:30
let's look at the verified payload. They didn't
10:33
get passwords. They didn't breach the graphic
10:35
designs. Right. They just got business contact
10:37
details, MSAs, and some invoices. And I think
10:41
there's this common assumption that, you know,
10:42
if the intellectual property and the passwords
10:44
are safe, it's kind of a low -impact breach.
10:47
Yeah. A lot of people think that. But you're
10:49
saying an exposed MSA is actually more dangerous
10:52
than a hashed password. Without a doubt. This
10:55
raises a really important question about how
10:57
we value data. A compromised password can just
11:00
be neutralized. You force a mandatory reset,
11:03
you enforce multi -factor authentication, and
11:05
it's useless. True. But a compromised master
11:07
service agreement, that provides an adversary
11:10
with the exact architectural blueprints to bypass
11:13
technological defenses entirely and instead exploit
11:17
human trust. We're talking about business email
11:20
compromise here, right, BEC? Exactly. The mechanics
11:23
of modern BEC rely entirely on weaponized context.
11:27
Weaponized context. I like that phrase. Think
11:29
about a traditional phishing email. It's generic,
11:32
usually poorly formatted, and it gets flagged
11:36
by your email security gateway instantly. Or
11:39
just by the human eye. Yeah, the classic, dear
11:41
sir, please click link stuff. Right. But now,
11:44
place that stolen Canva MSA into the hands of
11:47
a sophisticated syndicate. They aren't going
11:50
to send a generic payment link. They're going
11:52
to engineer a scenario that seamlessly blends
11:54
into the victim's routine financial operations.
11:57
Exactly. They target the accounts payable department
11:59
of the enterprise client. And they draft an email
12:02
that flawlessly mimics the tone and formatting
12:05
of a routine Canva communication. Because they
12:08
literally have the old emails to copy from. Exactly.
12:14
dictates the payment terms. They attach a forged
12:16
invoice that reflects the precise billing cycle,
12:19
the correct internal vendor ID, and the exact
12:22
dollar amount the client is already expecting
12:24
to be billed that quarter. Wow. And the only
12:26
altered variable is the routing number at the
12:28
bottom of the invoice. Yep. Just quietly redirecting
12:32
that six -figure wire transfer to an offshore
12:34
account controlled by the syndicate. And the
12:36
account's payable clerk just authorizes it because
12:39
it matches every single internal validation metric
12:41
they have on file. Exactly. The security friction
12:44
is completely bypassed because the data they
12:46
used to build the fraud was entirely legitimate.
12:49
And this is why B2B administrative data is so
12:52
incredibly valuable on the criminal underground.
12:54
It enables scalable, high yield financial fraud.
12:57
It really does. It transforms a technical API
13:00
vulnerability into a direct financial liability
13:03
for every single enterprise connected to that
13:06
CRM. The blast radius extends way, way beyond
13:10
Canva's own balance sheet. So Canva now has to
13:13
aggressively educate its entire client base on
13:17
invoice redirection fraud because the bad guys
13:19
have the exact documents needed to pull it off
13:22
perfectly. They do. It forces everyone into a
13:24
proactive defensive posture. Man. So tying all
13:28
these threads together, I mean, this Canva incident
13:30
just provides such a visceral look at the fragility
13:33
of our modern infrastructure. It really forces
13:35
anyone listening to evaluate their own digital
13:38
perimeter or, I guess, their lack of one. Yeah,
13:41
there is no perimeter. We've established that
13:44
every connected app, every little third -party
13:46
widget, every authorized API token, they're all
13:49
load -bearing pillars in your security architecture
13:51
now. The ecosystem is literally only as resilient
13:55
as the least secure vendor you've granted access
13:57
to. Which is terrifying when you think about
13:59
it. It is. So for you listening, you know, you
14:02
have to audit those integration scopes. You have
14:05
to have the operational agility to kill a compromise
14:08
session in minutes, knowing that machine speed
14:10
exfiltration has probably already happened. Yeah,
14:13
speed is everything. And you have to build these
14:16
crisis communication frameworks that actually
14:18
anticipate foreign regulators publishing your
14:21
breach before your own PR team has even drafted
14:23
the memo. Right. You don't control the global
14:26
PR order anymore. Exactly. And above all, you
14:29
really have to recognize that administrative
14:31
business data, the contracts, the invoices. That
14:33
is the primary ammunition for the most devastating
14:36
financial exploits today. But, you know, I'd
14:39
argue the challenge goes even deeper than just
14:41
auditing the integrations that your IT department.
14:43
actually officially sanctions. Oh, how so? Well,
14:47
think about it. The Canva and Cani connection
14:50
was an approved documented integration. It was
14:53
mapped out and known to their architecture team.
14:56
Which brings us to the unknown ones. Exactly.
15:00
The shadow integrations. Every organization right
15:04
now is grappling with shadow IT. It's just the
15:07
proliferation of tools that employees adopt completely
15:10
outside the purview of the security department.
15:13
Just consider your own workflow or anyone listening.
15:17
How frequently do you or your coworkers authorize
15:20
a third -party plug -in to, I don't know, synthesize
15:24
meeting notes or convert file formats? Oh, man,
15:27
all the time. You just click Allow Access to
15:29
Google Workspace or Connect to Microsoft 365
15:31
because you just need the stupid thing to work
15:33
for a 2 p .m. deadline, right? You completely
15:36
bypass the procurement review. We all do it.
15:40
But... Every single time that authorization is
15:43
granted, a new API token is generated, usually
15:46
with really broad read and write scopes, just
15:49
connecting this totally unvetted external server
15:52
directly into your core identity fabric. Wow.
15:55
So the next major supply chain breach that dominates
15:58
the news cycle, it might not originate from an
16:01
enterprise -grade vendor like Canny. Right. It
16:04
is highly probable it's going to stem from a
16:06
free unpatched browser extension or a productivity
16:09
widget that... Some employee just plugged into
16:12
their corporate environment yesterday afternoon,
16:14
bypassing every security control you thought
16:17
you had. That is, wow. That's a really sobering
16:20
reminder that in this hyper -connected ecosystem,
16:23
convenience is really just vulnerability by another
16:26
name. It truly is. Well, thank you for joining
16:29
us for this deep dive into the complexities of
16:31
the digital supply chain. It's been eye -opening.
16:33
Yeah, thanks for having the discussion. For everyone
16:36
listening, take a moment today to actually review
16:38
the third -party apps authorized on your own
16:41
accounts. Audit those permission scopes and really
16:43
question whether that random PDF converter actually
16:47
needs unrestricted access to your entire email
16:50
history. Stay curious, stay vigilant, and we
16:53
will catch you next time.