URLscan.io's SOAR spot: Chatty security tools leaking private data!

LuisElolaPrev — Mon, 23 Jan 2023 21:33:08 GMT

Community, have you noticed that we may be accidentally exposing confidential information of the users we protect by submitting URLs for analysis to URLscan.io?

Credits to: FABIAN BRAUNLEIN

Sensitive URLs to shared documents, password reset pages, team invites, payment invoices and more are publicly listed and searchable on urlscan.io, a security tool used to analyze URLs
Part of the data has been leaked in an automated way by other security tools that accidentally made their scans public (as did GitHub earlier this year)
If we don't take the proper measures regarding the configuration of URL scanning through the XSOAR integration and URLscan.io we have a high risk of your accounts being hijacked through manually activated password resets.

I am attaching an image with a simple mitigation measure in the configuration (Instance Settings), in case you have not applied it yet.

Re: URLscan.io's SOAR spot: Chatty security tools leaking private data!

sramesh-7 — Wed, 25 Jan 2023 03:29:26 GMT

Good point, I was thinking the private option would work only with premium licenses of URL Scan , if thats the case and no premium licenses, best to watch what is the integration used for and reduce its usage.

Re: URLscan.io's SOAR spot: Chatty security tools leaking private data!

LuisElolaPrev — Wed, 25 Jan 2023 13:59:35 GMT

Exactly!

topic Re: URLscan.io's SOAR spot: Chatty security tools leaking private data! in Cortex XSOAR Discussions

URLscan.io's SOAR spot: Chatty security tools leaking private data!

Re: URLscan.io's SOAR spot: Chatty security tools leaking private data!

Re: URLscan.io's SOAR spot: Chatty security tools leaking private data!