"A 2FA bypass is not a bug because you'd need to know the username and password to use it"
uhhhhh folks what do you think 2FA is for?
Riot Games 2FA implementation is inherently broken: The same code can be used multiple times.
The code is also emailed to you, and email is known to be an insecure channel. You do not have the option to use your own TOTP application to generate login codes.
Riot Games responded to a report saying that the system is "working as intended"
Lesson? Phish Riot accounts. They will do nothing to stop you.
Also, HackerOne is an absolute fucking joke.
Today I learned that unprivileged users can run "systemctl show servicename" to see all the environment variables set in the .service file.
This means if someone sets their AWS_SECRET_ACCESS_KEY in there (or any other secret), it can be read by an attacker even if they don't have read privileges to read the .service file.
For defenders, use EnvironmentFile= instead of Environment= and as long as your environment file has the correct privileges, you will be fine on this front.
Now, they did exactly one thing right:
They don't ask permission to send the code when you log in. They just send it.
Asking things like "Where would you like us to send the code?" or "Is it alright if we send you the code?" gives an attacker a chance to back out before the notification alerts the account owner to the potential breach.
Your auth systems should make attackers noisy. We like noisy attackers.
Riot Games deployed multifactor auth in basically the worst way they could:
1) *only* email 2FA is supported, no TOTP
2) The code is shown in the subject line, making it trivial to steal from streamers, or participants in a video call, or anybody who can wake up a target's phone (no unlock needed)
3) Enrolling your account forwards you through an absolute fuckton of redirects to unrelated domains, including sites for Riot's other games, and their eSpOrTs site.
Patch now. Like right now. This one looks pretty easy to exploit, and it's present on default Debian, Ubuntu, and CentOS/RHEL installs.
Help me prove a point to a colleague:
If your corporate computer (or school computer, or pretend you work for a place that issues computers) normally asks you to press ctrl+alt+del before logging on:
1) Would you ever notice if you *weren't* asked to do that, just once?
2) If you did notice, what would you do?