One stolen login and a pile of OAuth grants
Free weekly email
Published October 13. Get the next one.
One email every Tuesday: what changed in security and compliance that week, and what it means if you sell to enterprise buyers.
Free. Unsubscribe in one click, and replies reach Jacob directly. Read the latest issue or browse the archive.
Four of the five stories this week come down to the same thing: access you granted to something else, and then stopped looking at. The ASOS breach, the Danish CPR register, forgotten OAuth tokens and a patched AWS agent flaw are all variations on that. If you are filling out vendor questionnaires for US buyers right now, this is the part of the form that is about to get longer.
ASOS breach started with a connected marketing platform
Source: Dark Reading
ASOS confirmed a breach after attackers sent rogue push notifications to customers through its mobile app. Reporting ties the compromise to a third-party communication platform and stolen employee credentials. Dark Reading's read is that one compromised identity opened the way to deeper access inside the corporate environment.
The tool that did the damage was not built by ASOS, and that distinction will not help them with customers or regulators. When we run SOC 2 or ISO readiness, the subprocessor inventory is almost always the weakest document in the folder, usually assembled from memory the week before fieldwork. If a marketing or support platform can reach your customers in your name, it belongs on that list with an owner, a review date and a scoped set of permissions.
Nobody can tell you how many OAuth grants they have
Source: BleepingComputer
This piece looks at how OAuth grants accumulate between SaaS apps, AI tools and other services faster than security teams can review them. It cites the recent Klue breach as a case where attackers used a forgotten grant to reach corporate data. The core problem it describes is that each grant creates a standing data path that nobody revisits.
I ask for this list on most engagements and I get a shrug. Pulling third-party app grants out of Google Workspace or Microsoft 365, assigning each one an owner and revoking the dead ones is maybe an afternoon of work, and it produces exactly the kind of artifact an auditor or a buyer's security team will accept without argument. The grant a departed employee approved two years ago for a trial tool is still live until someone kills it.
The Danish national register breach involved the password 123456
Source: DataBreaches.net
Danish reporting says at least three accounts at the company connected to the CPR register breach used the password "123456", including an administrator account. The breach exposed names, addresses and CPR numbers for roughly 8.8 million people, living and deceased, after attackers used a legitimate company account to get in.
No clever technique, no zero day, no framework gap. Someone had the control written down and did not enforce it on the accounts that mattered most. This is the argument for asking your own vendors a narrow question instead of sending a 200 line questionnaire: show me that administrative access to our data requires phishing-resistant MFA, and show me who holds it.
A single prompt could have taken over an AWS agent fleet
Source: Dark Reading
Researchers disclosed a now-patched flaw in AWS Bedrock AgentCore, dubbed AgentCorruption. According to the report, an attacker could use one AI chatbot to compromise an organization's entire fleet of agents. AWS has fixed the issue.
The patch matters less than the shape of the problem. If you shipped an AI feature this year, the question your fintech buyers will start asking is not whether you filter prompts, it is what the agent's credentials can reach when the filtering fails. Scope the agent's IAM role to the narrowest thing that still makes the feature work, and write down that scoping decision, because you will be asked to defend it in a security review before you are asked about it by an attacker.
CISA advisory on China-linked scanning and hands-on intrusion
Source: CISA
CISA and partner agencies published a joint advisory on October 8 covering Chinese government-linked actors enabled by the Integrity Technology Group. The advisory describes a mix of automated scanning tools, large-scale botnets and hands-on exploitation used to steal data from organizations worldwide, including US critical infrastructure. Listed techniques include vulnerability scanning, cross-site scripting and attacks on passwords.
Most of my readers are not the intended target of a state programme, and I am not going to pretend otherwise. What this changes for you is downstream: when your US customers in energy, health or financial services absorb an advisory like this, parts of it land in the vendor questionnaire you get next quarter. The practical response is unglamorous, which is knowing your internet-facing surface, patching the edge within a stated window and being able to prove both with a log rather than a sentence.
Short version of the week: the access paths you cannot enumerate are the ones that hurt you. If you only do one thing, pull your OAuth grant list and see how much of it you recognise.
Jacob
Free weekly email
Get the next issue on Tuesday
One email a week from Jacob Masse: the security and compliance stories that changed something that week, and what each one means if you sell software to enterprise buyers. Five stories, a take on each, five minutes to read.
Free. Unsubscribe in one click, and replies reach Jacob directly.