1

I'm working in a new clients system, and they automatically assign permissions based on the domain name for the email address the account was created under (they do require validation via an email).

They check that the email ends with @somedomain.tld. For large banking corporations. If you have the appropriate domain name you will have full access to employment histories, address histories, SSNs....etc for a cuople million people. These are 3rd party domains (that are used for the email addresses), are under no control of the aforementioned client operating this system. And are the company email addresses of whomever owns those domains. There are ~500 domains whose email addresses have access in this manner.

Are there security pitfalls with this? Are there exploits that have been used to work around such systems?

My goal is to do some due diligence since at first glance this seems like a fragile way of authorizing access to such information. But I do not have the knowledge to say if it is or is not. I would also like to know, outside of the scope of the above scenario, if there are pitfalls and issues with this sort of setup, regardless of the type of role or risk.

Improve this question
5
  • 2
    I think this is too broad. It is unknown what kind of permissions you talk about (i.e. risks involved), how the mail is exactly associated with the user, what protections are in place to make sure that nobody can steal the email (i.e. it is some public mail provider, are these company specific addresses) ... Please don't add these information as comment but edit your question instead to provide these information in a consistent way.
    – Steffen Ullrich
    Nov 2, 2018 at 20:30
  • Hi Think your question is not defined properly, but I will try to give you a hint that may help you, I suggest that you should start think on implement DMARC on your company.
    – camp0
    Nov 2, 2018 at 21:42
  • 1
    @camp0 DMARC will be useless in this scenario
    – schroeder ♦
    Nov 2, 2018 at 21:44
  • I assume that the ability to send messages from arbitrary domains would violate these protections.
    – multithr3at3d
    Nov 2, 2018 at 21:46
  • @SteffenUllrich I have added additional information. the gist is that it provides access to a large number of people personal info and the domains are company emails.I'm just trying to do some due diligence since it seems fragile at first glance.
    – Douglas Gaskell
    Nov 3, 2018 at 0:44

2 Answers 2

Reset to default
2

My understanding of your question is that you want to use the domain part of the users email to identify the company of the user and then setup access permissions based on this detected company. But you don't just use a single email for this - instead you associate the email with a user account (i.e. additional protection with password or similar) and the user has to prove that he has access to the claimed mail account when setting up the user account by sending some kind of confirmation link to the given mail address.

In order to have this kind of association between a user/company and an mail address you have to guarantee that nobody outside the company can send and receive mails using a company specific email address. Given that company specific mails can often be accessed from outside the companies network (mobile workers) and that phishing for credentials including mail credentials is heavily done today, it must be assumed that somebody outside the company might get access to a companies mail account.

Moreover the initial verification of the mail when setting up the user account does not help if the user leaves the company since there is no procedure to automatically disable the user account. While one can check from time to time if the user still has access to the mail account the process of disabling access for ex-employees is often broken, i.e. the user might still have access to his old companies mail even he does not work longer for the company.

Improve this answer
4
  • Hi Steffen, one correction. It's not that I want to do this, it's that this is whats in place right now and it makes me feel uneasy. There is no validation done past checking the domain of the email and sending a verification email to verify the account before letting them login. But I cannot say why it is good or bad, since I don't know of effective attack vectors that might put my client at risk.
    – Douglas Gaskell
    Nov 4, 2018 at 3:22
  • 1) The helpdesk exploit below, 2) Many companies bring in contractors or temporary workers who are assigned a corporate email address but shouldn't be given the same access or permissions, 3) Companies often rebrand, merge or takeover, resulting in new domains being issued. In many cases the old domains are forgotten, left unsecured or later deregistered, allowing malicious users to pick them up
    – Dave Satch
    Nov 5, 2018 at 7:04
  • An alternative long term solution is to use OAuth or some form of single sign on to have the partner company validate their employees directly. i.e. single sign on request is forwarded to the partner company, who checks if the user password is correct AND they are in the group of employees who should have access to this data
    – Dave Satch
    Nov 5, 2018 at 7:08
  • Also #4 - companies often have catch all emails such as helpdesk@yyy and sales@yyy that can accessed by multiple users - if someone registered using this account and then accessed the system to steal data, it would be difficult to track who exactly had caused the breach. Also consider legal liability implications depending on where the data is located.
    – Dave Satch
    Nov 5, 2018 at 7:13
1

There was an incident a while ago on Slack where teams that accepted domain-based account validation to join the team were breached via an exploit of their help desk ticket systems, issue trackers, etc.

https://medium.com/intigriti/how-i-hacked-hundreds-of-companies-through-their-helpdesk-b7680ddc2d4c

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .