I didn’t see much visibility on this DocuSign hack. This is a situation where the product features were not vetted to understand if they could be misused by malicious fraudsters. There is not a technical vulnerability, it comes down to a design weakness in the product.
The entire process can be automated and sent out on a massive scale, spraying large numbers of unsuspecting victims.
It is the old story of well-intentioned developers asking if they “can” develop something without questioning if they “should” develop something.
It often takes security-minded experts, savvy in the ways of how attackers think, to evaluate such situations. These are often missed by even experienced developers because there is no technical vulnerability per se. But that does not mean a creative adversary can’t use it in destructive ways. Often, additional controls, oversight, or accountability must be included to dissuade, prevent, or quickly alert of misuse.
The sustainable solution for all software and service vendors is to have cybersecurity experts, not just security-minded developers, as part of the initial feature design teams, keep them in the loop during development, and make sure they vet the final capabilities before going live.
First seen on securityboulevard.com
Jump to article: https://securityboulevard.com/2024/11/fraudsters-abuse-docusign-api-for-legit-looking-invoices/
