Preventing Authentication Bypass: A Tale of Two Researchers

Importance of security in cloud services and incident response plan

• Enforcing policies at runtime is important and having a common team to manage it helps reduce complications
• Incident response plan is critical for cloud service providers to have
• Periodic scenario audits and learning from past reports and bugs can improve security flow
• Partnering with the security community can help find flaws and have a plan in place to manage and roll out fixes
• Tips for bug hunters include using the application like a normal user and monitoring updates of the target
• Improving tool box and documenting findings are important for future use

One researcher got lucky with a bug and suggests improving tool box and documenting findings for future use

“I discovered a critical security issue that lets an attacker compromise any other user’s account without any user interaction."Join Terry Zhang, Ron Chen, and a Microsoft Engineer for the coordinated public disclosure of a critical elevation of privilege vulnerability. This is the story of a research collision by two security researchers and the emergency response investigation that was launched as a result of their vulnerability reports. Attendees will learn the techniques used by researchers to identify the vulnerability, how companies can effectively partner with researchers throughout the disclosure process to protect customers, and what application developers can do to more securely code web applications to avoid similar flaws.