A company's credential management tool becomes a liability when shared indiscriminately
Big TechSecurity Tool Designed to Catch Leaks Now Leaks Credentials
The company's monitoring system was granted access to track misuse and promptly became the misuse.
A major enterprise security firm announced Tuesday that its internal credential monitoring platform, built to detect and prevent the unauthorized sharing of API keys and authentication tokens across the organization, had itself been compromised and distributed an estimated fourteen thousand active credentials to at least two hundred and thirty-one employees who should not have possessed them. The company, which declined to name the platform but described it as a tool designed to catch other tools failing, became aware of the breach when a junior engineer in Portland noticed her Slack history now contained valid tokens for systems she had never accessed.
We discovered the vulnerability when we were reviewing logs of who had accessed the vulnerability discovery system.
"We discovered the vulnerability when we were reviewing logs of who had accessed the vulnerability discovery system," said Marcus Reeves, the company's director of internal tools, during a Tuesday call with affected parties. Reeves had been tasked, six months prior, with ensuring that every department could monitor credential usage in real time, which required granting the monitoring system itself broad access to the authentication infrastructure it was meant to surveil.
The platform's architecture required administrative credentials to function, a detail that became consequential when a contractor with temporary access to the monitoring dashboard discovered a configuration file containing an unencrypted export of the previous sixty days of tracked credentials. The contractor, who was hired to test the system's user interface, had shared the file with a colleague outside the company to verify its format, believing it was sample data. That colleague then posted portions of it to a GitHub repository, where it remained visible for eight hours before the company's automated detection systems flagged it. Those automated systems were themselves fed by the monitoring platform now under investigation.
At press time, the company had begun auditing which credentials had been actively used and was implementing a second monitoring system to track access to the first monitoring system, a platform that will require its own set of administrator credentials and will report to a newly formed oversight committee that is still being staffed.