The Mistakes Behind Most Breaches
Your Server Can Reach Things Nobody Outside Can
Last timeRunning What You Were Given
Accept an address and fetch it, and you have offered a stranger the use of your server's network position. That position reaches administrative ports, neighbours, and credential services.
The position is the prize
The feature is ordinary and useful. Give us the address of your profile
picture and we will fetch it. Give us a link and we will show a preview.
Tell us where your webhook receiver lives. Import from this address. Here
is a document to convert, at this location.
In each case your server takes an address from a stranger and connects
to it. The thing to notice is that the stranger did not gain a file. They
gained the use of your server's position on the network, and that position
is worth far more than any single file, because a great deal of
infrastructure is protected by nothing except being hard to reach.
What is actually reachable
Being concrete matters here, because the abstract version of this flaw
sounds minor and the concrete version does not.
| reachable from outside, | reachable from your serv | typically requires no au | the destination the feat | |
|---|---|---|---|---|
| your own server, bound l | 0 | 1 | 1 | 0 |
| a neighbour on a private | 0 | 1 | 1 | 0 |
| a link-local credential | 0 | 1 | 1 | 0 |
| an ordinary address on t | 1 | 1 | 0 | 1 |
The first class is the one teams overlook because it feels absurd: your
own server, addressed as itself. Administrative interfaces, debugging
endpoints, metrics, a database bound locally, a message broker. All of
them configured over the years on the assumption that a local caller is a
trusted caller.
The second class is the neighbours, and the shape there is a flat
internal network where services authenticate callers weakly or not at
all, because the boundary was the control.
The third class is the one that turns this from a disclosure into a
takeover: a service that exists to hand machine credentials to whatever
process asks from the right position. One fetch, and the supplied address
returns a credential for your infrastructure.
The lesson stops here
3 more paragraphs to go
You have read the opening. The rest of the argument, the problems that check whether it landed, and the lines worth keeping at the end all come with a plan.
The first lesson of every course in the library reads the whole way through, free, so you can see exactly what the rest of them are.
See the planThe contentsThis is the reading half
Starting the course gives you your own copy of it. Every idea on every page has problems standing under it, marked with a reason rather than a tick, and any sentence you do not believe can be opened and argued with. None of that can happen on a page nobody owns.
The contents