Security Concerns: You can break Credentials used to start RDM easily!
Security Concerns: You can break Credentials used to start RDM easily!
Situation:
I work on a VM in our local domain.
I use RDM at different machines.
I save the Datasource in your cloud.
I use a Yubi-key to protect my datasource.
Problem:
Because of problems, I removed RDM to reinstall it.. It didn't delete the *.cfg so I deleted it by hand.
The cfg file includes the use of the Yubi-key.
When I restartet RDM without the cfg file, it just connected to my online datasource WITHOUT asking for ANY credentials.
I didn't even need to give the location to my datasource!
So EVERYONE in my domain who knows this bug can use all my credentials!
Why isn't the datasource better protected? I was flabbergasted when seeing how friggn easily you can break security while using this product!
So how can I make sure, that my datasource is protected? The way it works now, I can't use RDM anymore!
All Comments (7)
Hello,
Thank you for bringing this issue to our attention. We understand your concern regarding the security of your data source and the ease with which someone could potentially access your credentials. We apologize for any inconvenience or worry this may have caused you.
To address your concern, we would like to clarify the security measures in place for our online data source. We utilize standard OAuth authentication to protect the login process. This means that authentication tokens are handled by the browser and not stored in the .cfg file. Therefore, deleting the .cfg will not help to protect your online data source.
You could clear your logged session from here if you are on another machine:
https://portal.devolutions.com/security/sessions
Additionally, you can use the "Log Off" button within your virtual machine to ensure a complete logout from your Devolutions Account.
Regarding your Yubikey, please ensure that it is configured to protect your Devolutions Account rather than the local data source. By doing so, you can add an extra layer of security to your account and ensure that unauthorized access is prevented.
Regards
David Hervieux
It's not that deleting the config file doesn't protect my data. It's that deleting the config makes it, that any protection I configured is worthless..
The credentials do not encrypt ANYTHING, they are just a little: "if password is good then let user in." Also: "if I dont know about a password I let any user in!" That's not acceptable at all.
My colleagues just tested a few things with a local database: They don't get encrypted at all! You delete the config.. you get access.
Even when you protect your SQLite database with 2 factors: After deleting the config you just ignore the dialog asking for a new data source and voila... you have access to the database which was used before.
We were not able to secure the local data source at all. We used credentals both for A: starting RDM and B: securing the SQLite DB.
Deleting the config file gives you full access to anything!
We lost trust in this software completely.. it's not that hard to encrypt a database or credentials.
I liked your software and tested it some time for our company, but I am sorry to say.. RDM is banned for now.