For PCI audits, they move things around and turn off servers to avoid some issues. Username/Passwords are plaintext in API requests (query parameters). Login Password were hashed via SHA1. It's been migrated to argon this year. The company was hacked last month, although I'm positive it's happened multiple times in the past. Co-workers mentioned there was a hack a few years back that wasn't as bad as this. This most recent hack, they got everything. Codebase, databases, client credentials (we don't encrypt client secrets), and card numbers. They had root access to prod servers. Clients have done their own pentesting and found issues. Security wasn't a thing until this hack happened. Anyone with a brain would see the issues.
It took the company about 2 weeks or so to even discover the hack had happened. The only reason the hacker was caught was because they started using the deployment pipeline to modify code/servers. I think it was because they wanted to see just how stupid the company was. The hacker was able to gain all of this access because the code base is garbage. Tons of XSS, SSRF, SQL injections, and poor code in general. They were able to gain access to services because they used default passwords. Secrets were shared between environments (staging and production). AWS keys were not locked down (S3 read-only was setup to read/write to S3 and other services). Logs truncate at 30 days, so no one is sure how long they were in the system.
I have been trying to find another job, but the industry is trash right now. I can't stay here. I've looked into whistle blower laws and seems like none of this would really qualify for anything. I've thought about talking to a lawyer about all of this. I cannot afford to just quit. It took me awhile to get this job and I'm terrified that losing this job will leave me homeless.
One of the biggest issues was our all hands we had today. The CEO, CTO, and another high level person talked to everyone. It was very little truth with a lot of BS. This entire hack was preventable. Other jobs I've had, people would be getting fired and replaced over this.
The question I want to ask is what would you do in a situation like this?
2. Fix every problem that is part of your job description when you can, and document it. Document the ones you notice, but are unable to fix, or told not to.
3. If there is no process to resolve said documented problems, write an anonymous letter to the board of directors.
Don't hang people in the letter, just point out the necessity of a process to resolve problems.
The board knows who is responsible for what, and will do their own hanging.
4. If the dysfunctional CEO is on the board of directors, get a new job as fast as possible.
It's not the problems that get you in trouble, its the "talking about them" that does.
You will arouse all sorts of fear and paranoia when you do that. ( in a dysfunctional environment like you seem to be describing ) And when that happens, people lose their minds and "kill the messenger." https://en.wikipedia.org/wiki/Shooting_the_messenger
Problems are normal. Talking openly about how serious they are induces emotional responses in people who don't fully understand the technical details.
Talk openly about solutions. People love solutions.
Solve problems quietly.
The organization chooses to operate like this, if they wanted to fix the systematic issues, they would. It sounds, from your observations, they do not want nor intend to fix the systemic issues. You cannot solve problems the organization does not want to solve. You can provide recommendations and guidance, they choose whether to implement or fix.
Once you find your next job and you’ve safely moved on, drop a tip to Brian Krebs and let them know who it is while sticking to facts, if you’re so inclined, no obligation to do so.
https://krebsonsecurity.com/