Inactive, unmaintained Salesforce sites vulnerable to threat actors

Improperly deactivated and unmaintained Salesforce sites are vulnerable to threat actors who can gain access to sensitive business data and personally identifiable information (PII) by simply changing the host header. That’s according to new research from Varonis Threat Labs, which explores the threats posed by Salesforce “ghost sites” that are no longer needed, set aside, but not deactivated. These sites are typically not maintained or tested against vulnerabilities, while admins fail to update security measures according to newer guidelines. However, they can still pull fresh data and are easily exploitable by malicious actors, the researchers said.

The research follows a recent report from Okta, which warned that inactive and non-maintained accounts pose significant account takeover security risks with cybercriminals adept at using information stolen from forgotten or otherwise non-upheld accounts to exploit active accounts. Meanwhile, Google announced that it is updating its inactivity policy for Google Accounts to two years on security grounds, meaning that if a personal account has not been used or signed into for at least two years, it may delete the account and its contents. Google stated that abandoned accounts are at least ten-times less likely than active accounts to have multifactor authentication set up and typically rely on password reuse, making them particularly vulnerable to compromise.

Salesforce ghost sites are typically created when companies use custom domain names instead of unappealing internal URLs so partners can browse them, Varonis Threat Labs wrote. “This is accomplished by configuring the DNS record so that “partners.acme.org” [for example] points to the lovely, curated Salesforce Community Site at “partners.acme.org. 00d400.live.siteforce.com.” With the DNS record changed, partners visiting “partners.acme.org” will be able to browse Acme’s Salesforce site. The trouble begins when Acme decides to choose a new Community Site vendor, the researchers said.

Like any other technology, companies might replace a Salesforce Experience Site with an alternative. “Subsequently, Acme modifies the DNS record of “partners.acme.org” to point toward a new site that might run in their AWS environment,” Varonis Threat Labs added. From the users’ viewpoint, the Salesforce Site is gone, and a new Community page is available. The new page might be completely disconnected from Salesforce, not running in the environment, and no obvious integrations are detectable.

However, the researchers discovered that many companies stop at just modifying DNS records. “They do not remove the custom domain in Salesforce, nor do they deactivate the site. Instead, the site continues to exist, pulling data and becoming a ghost site.”

As a ghost site remains active in Salesforce, the siteforce domain still resolves, meaning it’s available under the right circumstances, the researchers said. “A straightforward GET request results in an error — but there is another way to gain access. Attackers can exploit these sites by simply changing the host header.” This tricks Salesforce into believing that the site was accessed correctly, and Salesforce would serve the site to the attacker, they added.

Although these sites are also accessible using the full internal URLs, these URLs are difficult for an external attacker to identify, the researchers pointed out. “However, using tools that index and archive DNS records — such as SecurityTrails and other similar tools — makes identifying ghost sites much easier.” Adding to the risk is the fact that old, obsolete sites are less maintained and therefore less secure, increasing the ease of an attack.

The Varonis researchers said they found many inactive sites with confidential data, including sensitive business data and PII, that was not otherwise accessible. “The exposed data is not restricted to only old data from when the site was in use; it also includes new records that were shared with the guest user, due to the sharing configuration in their Salesforce environment.”

Sites that are no longer in use should be deactivated, the researchers advised, along with highlighting the importance of tracking all Salesforce sites and their respective users’ permissions — including both community and guest users. Varonis Threat Labs has also created a guide for protecting active Salesforce Communities against recon and data theft.

Copyright © 2023 IDG Communications, Inc.

Discover SAASTEPS™, SAASPAY™, & SAASRAM™: Revolutionize Your Salesforce CRM Experience and Skyrocket Your Revenue at a Fraction of the Cost

SAASTEPS is proud to unveil its new website, SAASTEPS.com, offering a comprehensive suite of cutting-edge solutions designed to accelerate revenue, optimize processes, and significantly reduce costs for Salesforce CRM users. Experience unparalleled cost savings of up to 1/3 compared to purchasing similar services directly from Salesforce and transform your revenue operations with SAASTEPS.

BROOMFIELD, Colo., June 5, 2023 /PRNewswire-PRWeb/ -- SAASTEPS, a trailblazer in providing innovative solutions for businesses utilizing Salesforce CRM, is thrilled to announce the launch of its new website, SAASTEPS.com. The platform is set to become the ultimate hub for Salesforce CRM customers looking to optimize their workflow processes, boost revenue, and significantly reduce costs.

SAASTEPS offers a comprehensive suite of tailor-made solutions to cater to the diverse needs of Salesforce CRM users. The company's state-of-the-art products and services are designed to elevate the user experience, streamline operations, and propel business growth. By opting for SAASTEPS as their next solution evaluation, Salesforce CRM customers can anticipate accelerated revenue generation through a simplified, cost-effective approach that's a breeze to implement.

A major advantage of partnering with SAASTEPS is the impressive cost savings. Customers can expect to slash their expenses by 1/3 compared to purchasing similar services directly from Salesforce. This makes SAASTEPS a highly enticing option for businesses aiming to maximize their return on investment while still harnessing the power of Salesforce CRM.

The seasoned team at SAASTEPS is dedicated to helping businesses unlock their full potential using Salesforce CRM. They understand the unique challenges faced by companies in today's cutthroat landscape and have developed specialized solutions to tackle these issues head-on.

"Our mission at SAASTEPS is to equip Salesforce CRM customers with the most advanced tools and resources to help them flourish in today's ever-evolving business environment," said Tim Beck, Co-Founder and CEO of SAASTEPS. "We are confident that our new website will serve as an invaluable resource for businesses seeking to optimize their Salesforce CRM processes, accelerate revenue, and ultimately achieve greater success."

Salesforce CRM customers are encouraged to visit SAASTEPS.com to explore the extensive range of solutions available and discover how they can revolutionize their operations while reaping significant cost savings.

About SAASTEPS: SAASTEPS is the #1 Salesforce leading provider of trailblazing solutions designed to optimize Salesforce CRM processes, accelerate revenue generation, and reduce costs for businesses worldwide. With a comprehensive suite of products and services, SAASTEPS is committed to helping businesses maximize their ROI and achieve unparalleled success in today's competitive market. For more information, visit https://www.SAASTEPS.com/contact/.

Media Contact

Justin Ou, SAASTEPS, 650-759-0508, marketing@saasteps.com

Twitter, LinkedIn

SOURCE SAASTEPS

© 2023 Benzinga.com. Benzinga does not provide investment advice. All rights reserved.

Salesforce Surpasses Earnings Expectations, Raises Guidance