Latest / Privacy Please / S6, E245 - Hard-coded Secrets and Unencrypted Data: A Digital Security Nightmare

Transcript

S6, E245 - Hard-coded Secrets and Unencrypted Data: A Digital Security Nightmare · Privacy Please

• 0:00
  Speaker 1: All righty then.
• 0:00
  Speaker 1: Ladies and gentlemen, welcome back to another episode of Privacy, please.
• 0:03
  Speaker 1: Cameron Ivey, here with Gabe Gumbs, we're just hanging out, we're chatting, we're chatting, we've been chatting, catching up a bit.
• 0:09
  Speaker 1: How are you doing?
• 0:10
  Speaker 1: I'm good man, always good, always good to connect, love, chatting with you, and there's a lot going on, but we pinpointed a specific story that seemed pretty interesting kind of take us back to our beginning days.
• 0:27
  Speaker 2: Um, yeah, we talk a lot offline about a ton of security and a ton of privacy, and you know that intersection of security and privacy is what privacy, please, is all about always has been since day one, and, and we came across, uh, we came across an article about, uh, you know, some chrome extensions leaking information because it was using HTTP over HTTPS, and we're having an interesting conversation that we figured was worthy of having online as well too.
• 0:52
  Speaker 2: Refresh me in the details, sure.
• 0:56
  Speaker 1: Yeah, yeah, so just for just to kind of high level.
• 1:00
  Speaker 1: So several popular Chrome extensions, including some marketed as privacy and security tools stuff like DualSafe, password Manager and Avast Online Security and Privacy found to be leaking sensitive data.
• 1:13
  Speaker 1: So the vulnerabilities came from two main issues transmitting sensitive data, browser domains, machine IDs, os details, etc.
• 1:22
  Speaker 2: It was unencrypted http and using hard-coded credentials, api keys, secrets, tokens so many things in that sentence yeah, so break that down there's a lot of naughty things in that sentence a lot yeah, that's a lot um hard-coded keys bad sending data over the internet not encrypted bad embedded in the extension of job javascripts, which is pretty common yeah, bad, and you know the internet well.
• 1:57
  Speaker 2: Why do we need security and privacy?
• 1:58
  Speaker 2: Well, we need them fundamentally, as humans, to feel safe, to fulfill one of those, those basic needs of ours.
• 2:04
  Speaker 2: Right, security is a very basic human need and that doesn't change in our digital world.
• 2:09
  Speaker 2: Yeah, but the internet wasn't designed with security in mind initially not for the most part, right, the?
• 2:16
  Speaker 2: What we know is the commercial internet grew out of something that wasn't intended to be accessed by everyone all the time in any open manner, and the world also has changed now that it's all interconnected.
• 2:28
  Speaker 2: And so, you know, http as a protocol is not encrypted by default.
• 2:32
  Speaker 2: Https is the S and HTTP is for security.
• 2:36
  Speaker 2: We're probably telling things to much of our audience that that knows, but you know if you don't.
• 2:40
  Speaker 2: You now know the distinction between those two things.
• 2:45
  Speaker 2: And all the way back to our very first episode, we were talking about another extension.
• 2:50
  Speaker 2: So over five years ago, we were talking about another extension that we were advising our listeners to use, and it enforces HTTPS.
• 2:58
  Speaker 2: It's called HTTPS Only.
• 3:00
  Speaker 2: It's developed by Freedom Foundation I think it's EFFFF, if I'm not mistaken.
• 3:06
  Speaker 2: I think they're the ones that published the HTTPS only plugin.
• 3:09
  Speaker 2: If it's not somebody you're allowed to at me on this one For this you can at me, go ahead and at me and correct me, but what it does is if you try to visit, say, www, transcend that.
• 3:26
  Speaker 2: Let me stop, sorry.
• 3:27
  Speaker 2: Http colon slash, slash, transcendio.
• 3:30
  Speaker 2: It will automatically send you over to HTTPS, right, and it won't let you go to HTTP.
• 3:36
  Speaker 2: Even if Transcend for some reason had an HTTP endpoint, it will not let you go there.
• 3:40
  Speaker 2: It will force you over to the other one, because we shouldn't be transmitting anything over the internet in clear text any longer with HTTP.
• 3:48
  Speaker 2: We should stop doing that.
• 3:49
  Speaker 2: Period.
• 3:52
  Speaker 2: The protocol still exists and arguably it exists for some good reasons.
• 3:55
  Speaker 2: But it exists because it has and it is out there and it is widely embedded into many things.
• 4:01
  Speaker 2: But anyone developing any security or privacy plugin it belies logic that anything at all could even communicate on a standard port 80 HTTP port.
• 4:16
  Speaker 2: It just shouldn't.
• 4:16
  Speaker 2: Https by default communicates over port 443, ssl, and so it's an interesting article, largely because it's a firm reminder that security is both hard and easy in some ways right.
• 4:32
  Speaker 2: It's hard to get right because there are all of these existing things like unencrypted protocols that are still out in the wild and the trust we put into developers and random plugins.
• 4:45
  Speaker 2: But it's easy also because it's like really dude, like HTTP.
• 4:48
  Speaker 2: Really we're hard coding secrets.
• 4:52
  Speaker 2: It's 2025, gee, what's that Can we not do that?
• 4:56
  Speaker 1: Let me paint a scenario, gabe.
• 4:58
  Speaker 1: So when they're mentioning, even trusted extensions can become attack vectors.
• 5:04
  Speaker 1: So what does it mean by that?
• 5:06
  Speaker 1: What are some of the common mistakes that you see, or you've seen or you know about where developers can neglect proper security practices?
• 5:16
  Speaker 1: I mean, that's the human Humans.
• 5:19
  Speaker 2: Humans are humans.
• 5:19
  Speaker 2: But before I pick on the devs too much, because I spent a lot of years in application security and building application security products and being an application security pen tester, so I spent a lot of years beating up developers in security, so I feel I owe it to them at this point to be very, very nice to them.
• 5:36
  Speaker 2: There are a few places where these things get slippery, though.
• 5:39
  Speaker 2: Right Like I can publish my own Chrome plugin and I can make it look very similar and close to yours so that I trick people in a downloading mind.
• 5:50
  Speaker 2: That's a huge problem.
• 5:51
  Speaker 2: That's a significant problem, and so that's problem number one I think a lot of people should be on the lookout for is are you getting that plugin, even from the official source?
• 5:59
  Speaker 2: Is that the official place?
• 6:01
  Speaker 2: Is that the right one?
• 6:02
  Speaker 2: Humans being humans, things like hard-coded keys probably a byproduct of development testing In order to make that process quicker use temporary, unsafe keys that you reuse in development because it shortens the workflow that you need to do.
• 6:20
  Speaker 2: But then a lot of times that kind of thing gets committed further upstream or downstream is the case, maybe in your product pipeline and find its way into production, and that's not good.
• 6:32
  Speaker 2: And so you know communities like OWASP, the Open Web Application Security shit.
• 6:39
  Speaker 2: What does the P stand for?
• 6:40
  Speaker 2: I don't remember Open Web Application Security something, but it's a nonprofit group that promotes web application securities, right?
• 6:49
  Speaker 2: So like they publish a top 10 of things that you should be mindful of, and so my short answer to you is don't listen to what I have to say about that.
• 6:55
  Speaker 2: I turn to the OWASP community for web application developers.
• 6:58
  Speaker 2: Like they have a ton of resources on what they should do, how they should do it.
• 7:05
  Speaker 2: There are no shortage of resources.
• 7:07
  Speaker 2: There's also a lot of resources already built into programming frameworks that will automatically implement different security protocols, so you know.
• 7:15
  Speaker 2: So as a developer, you don't have to remember doing those things.
• 7:17
  Speaker 2: So hopefully that's advice to young, burgeoning developers that are not intimately familiar.
• 7:23
  Speaker 2: If you're not familiar with OWASP, go check them out.
• 7:26
  Speaker 2: There's also a new OWASP Nomad chapter, so most OWASP chapters are kind of in person.
• 7:31
  Speaker 2: There's a new global one, or Restud.
• 7:34
  Speaker 2: We rebooted we I didn't reboot it.
• 7:35
  Speaker 2: Jerry Hoff has been a longstanding member of the OWASP community Great dude, One of the most amazing AppSec folks I know.
• 7:45
  Speaker 2: He restarted the Nomad chapter.
• 7:48
  Speaker 2: So if you want to join a virtual chapter of the open web app Clay's Security, because there's one near you, go check out Jerry Hoff.
• 7:56
  Speaker 2: You can find him probably on LinkedIn, some of the socials.
• 7:59
  Speaker 2: Go check out OWASP.
• 8:00
  Speaker 2: Go check out the OWASP Nomad group and there's a ton of resources there for you developers.
• 8:06
  Speaker 2: We love you, Love you.
• 8:08
  Speaker 2: We wouldn't have a lot of this without you, Both the good and the bad.
• 8:14
  Speaker 1: What do you think about like?
• 8:15
  Speaker 1: Do you think that there should be a deeper discussion around like regulatory pressure, around increased for extension marketplaces to enforce, like more development?
• 8:27
  Speaker 2: standards.
• 8:28
  Speaker 2: I don't know if more regulation is gonna gonna help like.
• 8:30
  Speaker 2: This is just.
• 8:31
  Speaker 2: We've got so much regulation our heads already dizzy.
• 8:33
  Speaker 2: Right, like you're already not supposed to transmit.
• 8:35
  Speaker 2: You know, like medical records and clear text, right?
• 8:38
  Speaker 2: A lot of that the problem, I think, with that type of regulation that we're now discussing is it's very consumer-oriented.
• 8:47
  Speaker 2: Those that have listened to the show in the past know that I weirdly do like regulation in a lot of ways, like very it's.
• 8:55
  Speaker 2: It's very antithetical to my personality to actually like regulation, but but I but I do enjoy the guardrails that that at least helps define, like, hey, everyone, here's what you should do, right, like.
• 9:07
  Speaker 2: The problem is when they're just guidelines.
• 9:08
  Speaker 2: People don't just follow the guidelines.
• 9:10
  Speaker 2: Problem is when they're regulation.
• 9:11
  Speaker 2: People just check the box sometimes, right, but I don't think regulation helps there.
• 9:15
  Speaker 2: I don't think it would.
• 9:18
  Speaker 2: It certainly could be done.
• 9:20
  Speaker 2: We have consumer protections, we have multiple consumer protection agencies, in fact, in the US, but I don't see how you solve that problem with that.
• 9:30
  Speaker 1: Well, like you just said, though, it's funny because you think of http and some people are like whatever yeah but maybe that's part of the reason, because it's being overlooked, because people are just not really thinking that it's the more abstracted people get from technology too, right, like, think of the generations below us at this point.
• 9:50
  Speaker 2: Right, I am not certain how many of them can tell you the difference between http and hp.
• 9:54
  Speaker 2: Like I don't actually know the answer, but I know that technology is so abstracted away that most of them have never, like, had to sign their own cert or work with a cert authority.
• 10:05
  Speaker 2: Right, like, because they probably didn't intimately interact with technology as a youngster.
• 10:09
  Speaker 2: Like not in that meaningful way.
• 10:10
  Speaker 2: They don't have to think about am I going to a secure site or not, because most sites on the internet default to actps.
• 10:16
  Speaker 2: Now that most people don't even think about it, right, like, they may have learned that.
• 10:21
  Speaker 2: Oh, I should look to see if the little lock is there.
• 10:22
  Speaker 2: Maybe they've learned that, but maybe they haven't.
• 10:24
  Speaker 2: Yeah, you know, maybe they've learned that when it says, oh, this certificate is entrusted, continue anyway.
• 10:29
  Speaker 2: No, maybe you don't continue like, maybe they have.
• 10:31
  Speaker 2: Maybe, like, whatever internet era, keep going.
• 10:34
  Speaker 2: Yeah, yeah, abstraction of technology from humans in general definitely creates more space for this kind of thing.
• 10:43
  Speaker 1: Do you think that privacy tools could actually be a helpful thing for the security teams?
• 10:50
  Speaker 1: When it comes to something like this, yeah, what's the first thing that kind of sticks out to you that could benefit?
• 10:59
  Speaker 2: I think it has to start with some education, right, like it has to start with some understanding of what we've spent a lot of time, just like I talked about OWASP.
• 11:07
  Speaker 2: Owasp is all about security and so as a by-product, there's a lot of privacy built into the practices that are preached there.
• 11:15
  Speaker 2: But I know of no just privacy-focused efforts around application security development.
• 11:23
  Speaker 2: We published some resources around this.
• 11:26
  Speaker 2: We've got a little GitHub with all those privacy resources.
• 11:32
  Speaker 2: We can drop the link again here With.
• 11:34
  Speaker 2: You know, with all those privacy resources, we can drop the link again here.
• 11:36
  Speaker 2: It's awesome, awesome privacy guy Privacy.
• 11:39
  Speaker 2: Awesome privacy engineering tools.
• 11:40
  Speaker 2: Awesome privacy engineering tools.
• 11:41
  Speaker 2: That's the name of it.
• 11:43
  Speaker 2: Yeah, it's on GitHub.
• 11:45
  Speaker 2: You'll find it under that name or under my name on Cape Gums, you'll see it there, and so we've published some things around those.
• 12:02
  Speaker 2: But it starts with definitely some education.
• 12:03
  Speaker 2: I think those developers need to before we blame them for leaking things like did they really understand that they shouldn't have been doing?
• 12:07
  Speaker 2: that I would hope so and I would have expected, like I absolutely would have expected that.
• 12:09
  Speaker 2: But do we know that?
• 12:09
  Speaker 2: Has someone told them that?
• 12:11
  Speaker 2: Has that communication occurred?
• 12:12
  Speaker 2: I don't know.
• 12:15
  Speaker 1: You know, this makes me think too, and I don't know if I'm too far out in left field, but I think there's the term like lack of visibility.
• 12:23
  Speaker 1: I think that's why it's so important to have a good privacy tool in place that also integrates well with your security tools.
• 12:31
  Speaker 1: So, first of all, companies are still doing this.
• 12:33
  Speaker 1: They're collecting way too much data that they don't even need, so that hurts your lack of visibility, because you don't even know what you got, why you got it.
• 12:42
  Speaker 1: Exactly so.
• 12:43
  Speaker 1: If someone does get in, it'd be nice that.
• 12:45
  Speaker 1: That's why having a good privacy tool that integrates with-.
• 12:48
  Speaker 1: No, you're right.
• 12:49
  Speaker 2: These browser extensions are sending back a lot of sensitive data that you just right here.
• 12:53
  Speaker 2: I like OS is like all kinds of things, which I'm certain I know why the tools send those things back.
• 12:59
  Speaker 2: But now you're collecting information about the users of your products, like, did you need all of it, right?
• 13:07
  Speaker 2: I can tell you that, as a developer, sometimes there's uh, not myself, but you know developers will, sometimes they will they will sometimes capture more than needed because it's easier to throw things out than it is to go back and go get it right.
• 13:19
  Speaker 2: It's like ah, let me just grab all of the data and then I'll just sift out what I need.
• 13:26
  Speaker 1: Do you also do that as a developer?
• 13:27
  Speaker 1: Do you also do that as like for testing too?
• 13:30
  Speaker 2: Sometimes absolutely.
• 13:31
  Speaker 1: Yeah, yeah, absolutely.
• 13:34
  Speaker 2: Makes sense.
• 13:34
  Speaker 2: Telemetry, just general understanding of what's happening at the other end, yeah, but sometimes that's not really, it's not always needed.
• 13:42
  Speaker 2: Can you achieve the same goal right, Like can you whatever problem you were trying to solve for development?
• 13:49
  Speaker 2: Can you solve that problem without getting more data?
• 13:55
  Speaker 1: That requires a lot more work, Gabe.
• 13:58
  Speaker 2: And I'll tell you data being what it is, everyone is in, the more data is better than less game these days and AI is when they made that problem worse.
• 14:08
  Speaker 2: Right, like more data, because we have to train on that data.
• 14:11
  Speaker 2: We want more data, more, more data, more data we want more data, more more data, more data.
• 14:19
  Speaker 1: Yeah, I agree with you.
• 14:21
  Speaker 1: I think this topic is actually.
• 14:23
  Speaker 1: You can go pretty far with this.
• 14:24
  Speaker 1: Obviously, we could talk you guys into the ground, but We'll post some resources.
• 14:31
  Speaker 2: Let's post some OWASP resources.
• 14:32
  Speaker 2: We'll post the awesome privacy engineering resources.
• 14:36
  Speaker 2: Um, I know you guys over at transcend have some great resources on this stuff too.
• 14:40
  Speaker 2: Um, we've got a couple of things also because myota actually, you know, we we create a, an infrastructure product that application developers actually do use.
• 14:48
  Speaker 2: So, like some of our, some of our customers like, when their application takes data in it, it goes inside of a secure MyOta vault and that's where it operates out of.
• 14:57
  Speaker 2: It's actually it's part of their application infrastructure.
• 15:01
  Speaker 2: So we'll post some resources on this topic.
• 15:04
  Speaker 2: It's a lot of good reading on this.
• 15:05
  Speaker 2: Love it.
• 15:07
  Speaker 1: Yeah, all right.
• 15:08
  Speaker 1: Well, thank you guys.
• 15:09
  Speaker 1: Thanks, gabe.
• 15:10
  Speaker 1: All right, I'll see you guys in the next one.
• 15:13
  Speaker 1: Till next time.