Teleport's company blog covers infrastructure access, SSH certificates, access control, eBPF, and cloud security.
HN mostly links it through Teleport's YC hiring posts, and commenters discuss its open-source licensing and commercial-use restrictions.
>Also CORS and SOP can be bypassed: https://dev.to/pssingh21/websockets-bypassing-sop-cors-5ajm
Like I said, you can reimplement SOP by checking that the Origin header equals the Host header. Or alternatively check them against an allowlist. It's just a couple lines of code, and then it's as secure as normal HTTP.
https://dev.to/pssingh21/websockets-bypassing-sop-cors-5ajm
That article contains a confusing quote:
>The initial handshake occurs via HTTP Upgrade request, the response body is disregarded and the HTTP/HTTPS protocol is upgraded to WS/WSS protocol.
But the response body isn't disregarded. What could best be described as the response body is the server->client websocket messages. Those aren't disregarded.
>Even very experienced teams make mistake with this kind of things. See for instance, this Kubernetes vulnerability: https://goteleport.com/blog/kubernetes-websocket-upgrade-sec...
Thanks, that's an interesting vulnerability. I'm not so sure it's websocket-specific though. It looks like the attack could be done without websockets at all. The end request that does the malicious action is plain HTTP. The initial request that triggers the desync uses a Connection: Upgrade header, which is used in websockets, but isn't actually websocket-specific. Connection: Upgrade was created in RFC 2616 from 1999, which was before the websocket RFC 6455 in 2011.
The vulnerability was there was a proxy, and the proxy didn't properly handle the Connection header as specified…
Thanks Matthew, great write up. I have a couple of questions/comments
1) Have you guys considered changing the licensing to require larger organizations to contribute financially to the protocol? Permissive open source licensing is great for allowing small upstarts (i.e. individuals like me) to build off of and contribute to development without institutional scale funding. However the virtues of the system become hazy when organizations with gigantic budgets come into the fold and begin essentially parasitizing off your work, despite clearly having the resources to contribute. I'd like to live in a culture where sound moral and economic judgement ruled the day, however based on my experience with the current open source company that I work for (https://goteleport.com) and the similar experience detailed in your funding post, it seems that we simply don't live in such a world. IMO the Open Source world should be considering moving to a Source Available model which looks to maintain the innovation/security benefits of Open Source, while experimenting with a greater variety of license enforced models such that larger players are required to contribute financially. Juce is one example of a project that works something like what I'm imagining (https://juce.com/get-juce), Unreal is another model (https://www.unrealengine.com/en-US/faq).
2) As Matrix grows, it seems inevitable that it will fall victim to the spam problems well known with email. My current understanding is that…
Teleport (YC S15) | Backend and Fullstack Engineers | US, Toronto, London, Remote OK | https://goteleport.com
Do you enjoy building security and deployment tools for other engineers? Join us to hack on https://github.com/gravitational/teleport. Most of our code is Go, we have very little technical debt, our codebase is clean and small.
If you are a backend or fullstack engineer, we expect you to be comfortable with the following:
* Go for backend and Go+TypeScript for fullstack engineers. * Linux, networking, and security. * Scalability and/or security experience for systems software is welcome. We're looking for senior engineers to join the Teleport team. Teleport is a company started by engineers to build products for engineers. We are a stable and growing company.
We offer:
* Competitive salary and equity. * 401k with company match. * Excellent health insurance. Apply: https://jobs.lever.co/teleport
What to expect once you apply:
* You will join a 30 minute intro call and we will walk you through compensation, the interview process, and requirements. * You join a private Slack channel and submit a coding challenge in Go (backend) or Go+TypeScript (fullstack) depending on the position using Github.
> Did you also consider some form of out-of-band approval mechanism for production environment access?
No, not before your comment at least. Vendor CI tools (be it GitLab, Drone, etc) often make it difficult to use this workflow. Their typical model is long lived static creds, and gating authn/authz around job kick off. I'm not aware of any that would work with delegated/approved credentials, at least without writing a custom secrets plugin. If anyone knows of such capabilities, give a me a holler.
Furthermore, there is still the risk of any service available to external contributors being compromised (as we saw in the this vulnerability). I'd just as soon have "no prod secrets touch a system that does external CI" as a security invariant -- no matter how trustworthy that external CI system is.
In a bittersweet irony, out-of-band approvals are in our product:
https://goteleport.com/blog/workflow-api/
but we're not there with CI yet. :/ It would be fantastic if we could have short lived credentials issued only for the duration of the job, after approval (or better: after delegation) from a trusted party. Something like AWS's `CalledVia`.
Teleport (YC S15) | Senior Technical Support Engineer | US, Europe, Canada, Remote OK | https://goteleport.com
We are looking for Senior Tech Support Engineers who can script, love systems troubleshooting and helping customers.
Join Us:
https://jobs.lever.co/teleport/7c7f25dd-21c7-45c9-a107-98d8a78995e5
Most of our code is Go, we have very little technical debt, our codebase is clean and small.
We expect you to be comfortable with the following:
* Scripting in Python, Go or Bash
* Deep understanding of Linux and networking administration
* Understanding of modern infra stacks - Kubernetes, Terraform, Ansible
* Scalability or security experience for systems software is welcome.
What to expect once you apply:
* We will send you a 30-50 minute SRE hacking/troubleshooting quiz
* You will join 30 minute intro call and we will walk you through the compensation, interview process and requirements.
* You will join a live troubleshooting session simulation and try to find all issues we planted in a cloud infrastructure.
https://jobs.lever.co/teleport/7c7f25dd-21c7-45c9-a107-98d8a78995e5
Teleport (YC S15) | Backend Engineer | US, Europe, Canada | https://goteleport.com
Do you enjoy building security and deployment tools for other engineers?
Join us to hack on https://github.com/gravitational/teleport anywhere in the U.S, Canada, UK, Ireland, Portugal, Australia, and Poland.
Most of our code is Go, we have very little technical debt, our codebase is clean and small.
We expect you to be comfortable with the following:
* Go or Rust
* Linux, networking.
* Scalability or security experience for systems software is welcome.
We’re looking for senior engineers to join the Teleport team.
Teleport is a company started by engineers to build products for engineers.
We are a stable and growing company.
We offer:
* Competitive salary and equity.
* Work anywhere in the U.S, Canada or Europe
Apply: https://jobs.lever.co/teleport
We are Backend, Security, Full-stack Engineers and SREs.
What to expect once you apply:
* We will send you a 20-30 minute programming quiz
* You will join 30 minute intro call and we will walk you through the compensation, interview process and requirements.