Security Holes Found in some DLP Products

Security Holes Found in some DLP Products

Security Holes Found in some DLP ProductsTwo researchers have discovered multiple flaws in commercial and open-source data loss prevention (DLP) products, according to a report.

Zach Lanier, senior security researcher at Duo Security, and Kelly Lum, security engineer with Tumblr, claim to have discovered vulnerabilities in cross-site scripting (XSS) and cross-site request forgery (CSRF) in four commercial DLP products and one open-source tool. In order to draw attention to the matter, they have opted not to name names until their keynote at the Black Hat USA conference this week. Their speech is titled “Stay Out of the Kitchen: A DLP Security Bake-Off,” and will provide proof-of-concept attack examples.

The duo says they weren’t surprised to find flaws in these systems. “It was not a huge shock,” said Lum. “But I was a little surprised that some of the vulnerabilities were very simple, which means they should be easily fixed. It’s curious that they could have been easily avoided in the first place.”

The majority of the flaws were found in the web-based interfaces of the products, such as the administrative panels. “Some were endpoint and some were network-based,” said Lanier. “We also evaluated document parsing pieces that classify and protect the data.

These flaws wouldn’t allow for bypassing abilities, but the researchers do say they found flows that would allow an attacker to reconfigure or change the behavior of the DLP system so that it no longer monitors data leaks.

About the Author

Matt Holden is an Associate Content Editor for 1105 Media, Inc. He received his MFA and BA in journalism from Ball State University in Muncie, Indiana. He currently writes and edits for Occupational Health & Safety magazine, and Security Today.

  • Fresh Security Perspective from AMAG’s New Sales Director A Fresh Perspective on Security

    Fred Nelson may be new to the security industry but his sales and leadership methods are time tested, and true. Fred joined AMAG only a few months ago, but brings with him a wealth of experience in sales and life balance solutions. This year is off to a good start for AMAG with new solutions on the horizon.

Digital Edition

  • Security Today Magazine - April 2022

    April 2022

    Featuring:

    • Similarities at Data Centers and Airports
    • Transitioning to the Cloud
    • Going High Tech
    • The Benefits of On-site Security
    • Optimizing Store Layouts

    View This Issue

  • Environmental Protection
  • Occupational Health & Safety
  • Infrastructure Solutions Group
  • Spaces4Learning
  • Campus Security & Life Safety