Security Market Segment LS
Tuesday, 08 August 2017 08:39

Texas engineering firm leaks Oracle, Dell data on Web Featured

By

Texas electrical engineering operator Power Quality Engineering has exposed electrical infrastructure data compiled by its engineers on such companies as Dell, the City of Austin, SBC, Freescale, Oracle and Texas Instruments to public view on the Internet.

The exposed data was found by UpGuard's security lead Chris Vickery on 6 July when he found an open port configured to accept packets at an IP address. Vickery heads the company's Cyber Risk Team.

When this was entered into a command-line interface, a fully downloadable data repository from PQE came down the pipe.

"Among the data that was exposed was the contents of one folder, Dell folder 6807, with a document labelled 'Director of Central Intelligence Directive No. 6/9' serving as a startling indicator of how sensitive the data entrusted to third-party vendors can be," UpGuard said in a blog post

"Emanating from the director of Central Intelligence — which, until 2005, referred to the director of the Central Intelligence Agency — the 'Physical Security Standards for Sensitive Compartmented Information Facilities' are detailed at length, for the purposes of installation and configuration in the many far-flung locations in which such rooms are found."

rsync

Such facilities are secure rooms used by security-cleared individuals to receive sensitive information. "Constructed with the specific goal of making external surveillance, eavesdropping, or interception of any information in the room as difficult as possible, SCIFs are common to intelligence community facilities and military installations," UpGuard said, adding that the location of such a secure room at a Dell facility in central Texas was clearly delineated.

The size of the repository is unknown but Vickery had downloaded about 205GB by the time PQE secured its systems on 8 July after being notified of the exposure by UpGuard.

The security firm pointed out that PQE had a poor CSTAR external cyber risk score of 181 out of a possible 950 at the time the data exposure was found.

"Beyond this highlighting of potential weak points and trouble spots in customer electrical systems, publicly downloadable schematics reveal the specific locations and configurations of government-operated top secret intelligence transmission zones within at least one Dell facility," UpGuard said in a statement. 

"In addition to this exposed customer data, a plain text file of internal PQE passwords was also stored in the repository, potentially enabling further access to more company systems."

images

Image of the main 'Clients' folder in the repository. Images: courtesy UpGuard.

The port that was exposed, 873, is used by the tool rsync, developed by Australian developer Andrew Tridgell, that is used for easy and rapid copying of data to another machine.

UpGuard said the configuration of PQE’s rsync process to allow public access through an open port was very common in IT environments. "While IT personnel can restrict port access to only authorised PQE employees, such measures can easily be forgotten without processes in place to ensure security gaps are identified and closed immediately," the company said.

"While the IP addresses able to access these systems via this port can be easily restricted by IT administrators using rsync’s 'hosts allow/deny' functions, this requires an extra step once the rsync utility is configured. This default accessibility, while simple to restrict, can be missed."

The repository included folders labelled Clients, User, and Intuit. Within the Clients folder, there were sub-folders with the names of many well-known companies.

"This data consists of reports and infrared imagery of weaknesses in clients’ power infrastructures as discovered and evaluated by PQE inspectors," UpGuard said. "Such infrared studies and their associated reporting reveal, with high levels of specificity, energy infrastructure inspection results of clients like HealthSouth Rehabilitation Hospital of Austin."

CHIEF DATA & ANALYTICS OFFICER BRISBANE 2020

26-27 February 2020 | Hilton Brisbane

Connecting the region’s leading data analytics professionals to drive and inspire your future strategy

Leading the data analytics division has never been easy, but now the challenge is on to remain ahead of the competition and reap the massive rewards as a strategic executive.

Do you want to leverage data governance as an enabler?Are you working at driving AI/ML implementation?

Want to stay abreast of data privacy and AI ethics requirements? Are you working hard to push predictive analytics to the limits?

With so much to keep on top of in such a rapidly changing technology space, collaboration is key to success. You don't need to struggle alone, network and share your struggles as well as your tips for success at CDAO Brisbane.

Discover how your peers have tackled the very same issues you face daily. Network with over 140 of your peers and hear from the leading professionals in your industry. Leverage this community of data and analytics enthusiasts to advance your strategy to the next level.

Download the Agenda to find out more

DOWNLOAD NOW!

Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.

VENDOR NEWS & EVENTS

REVIEWS

Recent Comments