Home Security Texas engineering firm leaks Oracle, Dell data on Web
Texas engineering firm leaks Oracle, Dell data on Web Featured

Texas electrical engineering operator Power Quality Engineering has exposed electrical infrastructure data compiled by its engineers on such companies as Dell, the City of Austin, SBC, Freescale, Oracle and Texas Instruments to public view on the Internet.

The exposed data was found by UpGuard's security lead Chris Vickery on 6 July when he found an open port configured to accept packets at an IP address. Vickery heads the company's Cyber Risk Team.

When this was entered into a command-line interface, a fully downloadable data repository from PQE came down the pipe.

"Among the data that was exposed was the contents of one folder, Dell folder 6807, with a document labelled 'Director of Central Intelligence Directive No. 6/9' serving as a startling indicator of how sensitive the data entrusted to third-party vendors can be," UpGuard said in a blog post

"Emanating from the director of Central Intelligence — which, until 2005, referred to the director of the Central Intelligence Agency — the 'Physical Security Standards for Sensitive Compartmented Information Facilities' are detailed at length, for the purposes of installation and configuration in the many far-flung locations in which such rooms are found."

rsync

Such facilities are secure rooms used by security-cleared individuals to receive sensitive information. "Constructed with the specific goal of making external surveillance, eavesdropping, or interception of any information in the room as difficult as possible, SCIFs are common to intelligence community facilities and military installations," UpGuard said, adding that the location of such a secure room at a Dell facility in central Texas was clearly delineated.

The size of the repository is unknown but Vickery had downloaded about 205GB by the time PQE secured its systems on 8 July after being notified of the exposure by UpGuard.

The security firm pointed out that PQE had a poor CSTAR external cyber risk score of 181 out of a possible 950 at the time the data exposure was found.

"Beyond this highlighting of potential weak points and trouble spots in customer electrical systems, publicly downloadable schematics reveal the specific locations and configurations of government-operated top secret intelligence transmission zones within at least one Dell facility," UpGuard said in a statement. 

"In addition to this exposed customer data, a plain text file of internal PQE passwords was also stored in the repository, potentially enabling further access to more company systems."

images

Image of the main 'Clients' folder in the repository. Images: courtesy UpGuard.

The port that was exposed, 873, is used by the tool rsync, developed by Australian developer Andrew Tridgell, that is used for easy and rapid copying of data to another machine.

UpGuard said the configuration of PQE’s rsync process to allow public access through an open port was very common in IT environments. "While IT personnel can restrict port access to only authorised PQE employees, such measures can easily be forgotten without processes in place to ensure security gaps are identified and closed immediately," the company said.

"While the IP addresses able to access these systems via this port can be easily restricted by IT administrators using rsync’s 'hosts allow/deny' functions, this requires an extra step once the rsync utility is configured. This default accessibility, while simple to restrict, can be missed."

The repository included folders labelled Clients, User, and Intuit. Within the Clients folder, there were sub-folders with the names of many well-known companies.

"This data consists of reports and infrared imagery of weaknesses in clients’ power infrastructures as discovered and evaluated by PQE inspectors," UpGuard said. "Such infrared studies and their associated reporting reveal, with high levels of specificity, energy infrastructure inspection results of clients like HealthSouth Rehabilitation Hospital of Austin."

47 REASONS TO ATTEND YOW! 2018

With 4 keynotes + 33 talks + 10 in-depth workshops from world-class speakers, YOW! is your chance to learn more about the latest software trends, practices and technologies and interact with many of the people who created them.

Speakers this year include Anita Sengupta (Rocket Scientist and Sr. VP Engineering at Hyperloop One), Brendan Gregg (Sr. Performance Architect Netflix), Jessica Kerr (Developer, Speaker, Writer and Lead Engineer at Atomist) and Kent Beck (Author Extreme Programming, Test Driven Development).

YOW! 2018 is a great place to network with the best and brightest software developers in Australia. You’ll be amazed by the great ideas (and perhaps great talent) you’ll take back to the office!

Register now for YOW! Conference

· Sydney 29-30 November
· Brisbane 3-4 December
· Melbourne 6-7 December

Register now for YOW! Workshops

· Sydney 27-28 November
· Melbourne 4-5 December

REGISTER NOW!

LEARN HOW TO REDUCE YOUR RISK OF A CYBER ATTACK

Australia is a cyber espionage hot spot.

As we automate, script and move to the cloud, more and more businesses are reliant on infrastructure that has the high potential to be exposed to risk.

It only takes one awry email to expose an accounts’ payable process, and for cyber attackers to cost a business thousands of dollars.

In the free white paper ‘6 Steps to Improve your Business Cyber Security’ you’ll learn some simple steps you should be taking to prevent devastating and malicious cyber attacks from destroying your business.

Cyber security can no longer be ignored, in this white paper you’ll learn:

· How does business security get breached?
· What can it cost to get it wrong?
· 6 actionable tips

DOWNLOAD NOW!

Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the sitecame into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.

 

Popular News

 

Telecommunications

 

Sponsored News

 

 

 

 

Connect