The session that never expired

An identity verification vendor holds the highest-value dataset in any onboarding pipeline. Government ID images. Passport MRZ strings. Facial biometrics. Liveness capture. Date of birth, residential address, document number. One vendor sits behind dozens of consumer platforms - dating apps, crypto exchanges, gig marketplaces, social networks. Breach the vendor once and every downstream customer’s verification stream is readable at source. The scenario here is not renderer RCE or a kernel primitive. It is standing access. Attackers held a live position inside an ID verification provider for more than a year and read documents as they were scanned.

There is no CVE for this. No patch diff. No affected version range that closes the hole. The failure class is credential exposure and access persistence, mapped to CWE-522 (insufficiently protected credentials), CWE-798 (use of hard-coded credentials), and CWE-284 (improper access control). The primitive is not memory corruption. It is a valid session that never expired and a credential that was never rotated. Nothing in the intrusion looks like an intrusion. That is the entire point of the technique.

The precedent is documented. In 2024, researchers reported that administrative credentials for AU10TIX - an identity verification provider used by TikTok, Uber and X - sat exposed for over a year. The credential set reportedly reached a logging platform linked to processed identity documents. AU10TIX stated the affected system was decommissioned. The exposure window is the finding. A credential left live for twelve-plus months is not an incident that happened at a moment. It is a condition that persisted across every scan in that window.

Identity verification runs as a pipeline. A client SDK captures the document and the selfie. Data moves to the vendor backend over TLS. The backend runs OCR, MRZ parsing, face match, liveness scoring, and sanctions screening. Results and source artifacts land in object storage, logging systems, and an operator console. Every stage is a place where a credential grants read access to raw PII. The operator console and the logging platform are the richest. They exist to let humans adjudicate borderline cases, which means they render the actual document and the actual face by design. A read credential to that tier returns the same view a fraud reviewer sees. Full document. Full biometric.

Three access vectors compound into a year of dwell. Stolen or exposed credentials - T1078, valid accounts - give the initial foothold with no exploit required. When the credential is a cloud identity, T1078.004 applies and the blast radius becomes the vendor’s cloud tenant. Secrets left in a repository, a misconfigured bucket, or a public log map to T1552.001, unsecured credentials in files. External remote services - T1133 - describe the entry when the console or API is internet-facing with no network restriction on the management plane. None of these require malware. None trip an endpoint sensor. The foothold is a login that the system was built to accept.

The trust concentration is the structural failure. A platform that outsources identity verification does not just outsource a workflow. It transfers custody of its users’ government documents and biometrics to a third party and then trusts a boolean back - verified, or not. The platform sees the attestation. It does not see the vendor’s credential hygiene, its session policy, its logging retention, or which contractor holds console access this quarter. The trust boundary sits inside a system the customer cannot audit. When that vendor serves TikTok, Uber and X at once, a single exposed credential is not a vendor incident. It is a shared incident across every customer, discovered by all of them at the same time.

Persistence is where the mechanism separates from a normal login. An attacker who only holds a password loses access the moment that password rotates. An attacker who holds post-authentication material does not. Application access tokens - T1550.001 - replay a session without re-authenticating. Account manipulation - T1098 - adds a new API key or a service principal that survives a password reset and a forced logout. This is the mechanism behind twelve months of access. The defender rotates the password. The attacker still holds a token or a key the rotation never touched. Credential lifecycle and session lifecycle are separate systems in most identity stacks, and only one of them gets attention during cleanup.

The Okta case from 2023 shows the same physics. Session material lifted from HAR files in a support system let attackers act as valid users without triggering credential alarms. Session token replay defeats MFA because MFA already fired. The token is post-authentication state. This is why single-factor advice does not close the scenario. The attacker is not logging in. The attacker is resuming a session the platform already trusts.

Insider threat is the third leg, and it is the hardest to separate from normal work. An insider with legitimate console access produces no anomaly on any access-control check. The account is authorized. The query is in scope. The bulk read looks like a busy shift. Distinguishing a reviewer working cases from a reviewer harvesting cases requires behavioral baselining on the reviewers themselves. Most verification vendors instrument their perimeter and their customers. Few instrument their own operators as potential adversaries.

The objective is the data, and identity data has properties that make it worse than credential theft. A leaked password is rotated in an hour. A leaked passport image is valid until the document expires, often a decade out. A facial biometric template does not rotate at all. Exfiltration maps to T1530, data from cloud storage, and T1213, data from information repositories, moved out over T1567.002 or blended into normal API egress under T1071. The output feeds synthetic identity fraud, account takeover at every platform that trusted the vendor’s attestation, and document forgery keyed to real biometric templates and real MRZ data. The verification vendor becomes a single point of failure for the identity assurance of every platform downstream of it. Compromise one KYC provider and the fraud propagates through every customer that outsourced trust to it.

Telemetry is where the year comes from. Valid-account activity generates authentication success events, not failures. No brute-force signature. No impossible-travel alert when the attacker proxies through the expected region on a residential range. No binary on disk, so no Sysmon Event ID 1 process create, no EDR detonation, no LSASS access pattern to correlate - the access is API and console, not endpoint. The evidence lives in cloud audit logs. CloudTrail, Entra ID sign-in logs, GCP admin activity. That evidence exists only if data-plane logging was enabled and retained past the dwell window. Most retention is ninety days. A twelve-month intrusion is invisible to a ninety-day log by definition. The read operations that matter most - S3 GetObject on a document bucket, console renders of individual identity records - are data-plane events. Data-plane logging is off by default and costly at volume, so it is frequently never collected. The gap is not attacker sophistication. It is that the one telemetry source that would show bulk document reads was never turned on.

What does fire, when anything fires, is volume and shape. A single operator account reading records at machine speed. API keys created outside a change window. Access from a new ASN or a residential proxy range that does not match the operator’s history. Token use after the associated interactive session should have ended. Review queues or sanctions-screening results pulled in full rather than case by case. These are correlation-rule detections, not signature detections. They demand that the vendor model its own operators and service accounts as adversaries, baseline normal read volume per identity, and alert on deviation. That is detection engineering work, not a product toggle.

Australian regulatory exposure follows the dwell time directly. Under the Privacy Act and the Notifiable Data Breaches scheme, a verification provider holds sensitive information and biometric identifiers, and a twelve-month access window drives both the assessment obligation and the scope of individuals notified. Where the vendor supports a regulated critical infrastructure customer, SOCI obligations extend the reporting chain. A breach discovered a year after it began is not one notification. It is every subject processed across that window. Active or suspected access of this kind escalates to the vendor’s incident response and the relevant national security team, not to a self-managed cleanup.

There is no patch boundary here because there is no vulnerable version. The residual exposure is the data model. A verification vendor centralizes the most sensitive identity artifacts a person owns, holds them in systems designed for human review, and issues standing credentials to reach them. Rotate every password today and any unrevoked token, any orphaned API key, any authorized insider persists past the rotation. The fix is credential and session lifecycle enforced together, session and token invalidation on any privilege or password change, data-plane audit logging retained past a plausible dwell window, and behavioral detection aimed at the operators and service accounts inside the trust boundary. Everything downstream inherits the vendor’s weakest credential. The breach was not a door forced open. The door was left open, logged nowhere, for a year.

See also: NordVPN for tunneled traffic when operating outside controlled networks.

---

#ad Contains an affiliate link.