Blessed Ticket Trick, Who Entered Through the Helpdesk

Patron of support systems, ticket email addresses, and companies that trust their own domain.

Life

On 10 September 2017 Inti De Ceukelaire described Ticket Trick: many helpdesk systems assign every request an email address in the company's domain. Using that address, an attacker could sign up to internal tools that required a company email to join, such as chat and repositories, reading the confirmation messages straight out of the tickets. In this way he got, as a test, into the platforms of hundreds of companies.

Prayer

O Blessed Ticket Trick, who reads confirmation emails inside tickets, let our tools never mistake a domain for an identity. Amen.

How to celebrate

Celebrated by separating helpdesk addresses from employee ones and not trusting the domain alone for access.

Open a ticket and sometimes you open a door.