@GossiTheDog the sheer fact that #MSPs & #CSPs can access clients' setups without proper #authorization [including #KYC / #KYB, #AuthCode|s and proper authorization via contract] is already sickening.

This literally begs to be abused via #SocialEngineering / #SocialHacking of #Microsoft personnel or just blatant "#PrivilegueEscalation" through falsefully claiming to be a #MSP / #CSP contracted by the targeted company.

Such fundamental #ITsec fuckups are reasons alone not to use #Azure or any #Microsoft products & services at all...

I mean, it doesn't require #Mitnick-level skills to pull this off, since it doesn't necessitate #Lapsus-Style #SIMswap or other means to gain access...

CyberplaceKevin Beaumont (@GossiTheDog@cyberplace.social)Attached: 3 images This is the partner.microsoft.com portal, it allows CSPs - Cloud Solution Providers - to gain access to their customer's environments. CVE-2024-49035 was around improper privilege management, i.e. being able to access things you shouldn't. It being in CISA KEV says it was being exploited in the wild. That portal allows a huge footprint of access by design.

#mitnick #lapsus #simswap

**Bèr Kessels** @berkes@mastodon.nl · Jan 23

Jan 23

Bèr Kessels @berkes@mastodon.nl

A big source of confusion & security issues & tech debt, comes from devs not understanding the difference between #Authorization and #Authentication.

Amplified by libraries bodging them together. Or naming it "auth".

But worse is when official protocols start mixing them up:

> Authorization Server – the place where, in a pure OAuth 2.0 authorization flow, end-users authorize third-party applications to act on their behalf; or, in an OpenID Connect flow, where end-users authenticate.

**Bill** @Sempf@infosec.exchange · Jan 20

Jan 20

Bill @Sempf@infosec.exchange

Wow, dumpster fire much, WordPress? They can't BUY some good news. In case we forgot with all of the other drama, the plugin ecosystem is a trash heap too.

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/w3-total-cache/w3-total-cache-281-authenticated-subscriber-missing-authorization-to-server-side-request-forgery

www.wordfence.comW3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery — Wordfence Intelligence

#wordpress #authorization

**Art Smart** @ArtSmart@mas.to · Dec 15, 2023 *

Dec 15, 2023 *

Art Smart @ArtSmart@mas.to

Remember when #RonaldReagan famously stood up to the #SovietUnion? "Mr. Gorbachev, tear down this #wall."

It's amazing how far the #GOP has devolved since then. Instead of tearing down walls, it demands they be built. Instead of admonishing #authorization #dictators, it admires them. #Trump repeatedly promises to be one himself (but just for one day, as only the most gullible could ever foolishly believe).

That's not an earthquake. It's #Reagan spinning in his grave.

https://www.newyorker.com/news/letter-from-bidens-washington/a-congressional-christmas-gift-to-putin

The New Yorker · Dec 14, 2023A Congressional Christmas Gift to PutinBy Susan B. Glasser