Security Holes Found in some DLP Products

Security Holes Found in some DLP Products

Security Holes Found in some DLP ProductsTwo researchers have discovered multiple flaws in commercial and open-source data loss prevention (DLP) products, according to a report.

Zach Lanier, senior security researcher at Duo Security, and Kelly Lum, security engineer with Tumblr, claim to have discovered vulnerabilities in cross-site scripting (XSS) and cross-site request forgery (CSRF) in four commercial DLP products and one open-source tool. In order to draw attention to the matter, they have opted not to name names until their keynote at the Black Hat USA conference this week. Their speech is titled “Stay Out of the Kitchen: A DLP Security Bake-Off,” and will provide proof-of-concept attack examples.

The duo says they weren’t surprised to find flaws in these systems. “It was not a huge shock,” said Lum. “But I was a little surprised that some of the vulnerabilities were very simple, which means they should be easily fixed. It’s curious that they could have been easily avoided in the first place.”

The majority of the flaws were found in the web-based interfaces of the products, such as the administrative panels. “Some were endpoint and some were network-based,” said Lanier. “We also evaluated document parsing pieces that classify and protect the data.

These flaws wouldn’t allow for bypassing abilities, but the researchers do say they found flows that would allow an attacker to reconfigure or change the behavior of the DLP system so that it no longer monitors data leaks.

About the Author

Matt Holden is an Associate Content Editor for 1105 Media, Inc. He received his MFA and BA in journalism from Ball State University in Muncie, Indiana. He currently writes and edits for Occupational Health & Safety magazine, and Security Today.

  • How COVID-19 Has Revolutionized Aviation Security Let's Talk Sports Security

    In this episode of SecurPod, Ralph C. Jensen and Fred Burton discuss security tactics at sporting events, from dealing with unruly fans to coordination between the home and visitors' teams to identifying potential stalkers. We also talk about the logistics of re-opening mass-attendance venues in the wake of the COVID-19 pandemic.

Digital Edition

  • Security Today Magazine - May June 2021

    May June 2021

    Featuring:

    • Tapping into Touch-free Digital
    • Deep Learning
    • Working from Home
    • Body-worn Technology
    • A Tragic Turn of Events

    View This Issue

  • Environmental Protection
  • Occupational Health & Safety
  • Infrastructure Solutions Group
  • Spaces4Learning
  • Campus Security & Life Safety