Today, researchers have responsibly disclosed a security vulnerability by exploiting which they could access over 100,000 private employee records of United Nations Environmental Programme (UNEP).
The data breach stemmed from exposed Git directories and credentials, which allowed the researchers to clone Git repositories and gather a large amount of personally identifiable information (PII) associated with UNEP employees.
Ethical hacking and security research group Sakura Samurai have now disclosed their findings on a vulnerability that let them access over 100,000 private records of United Nations Environment Programme (UNEP) employees.
The documents and screenshots shared with BleepingComputer provide extensive details on the nature of this security flaw and all that it exposed.
Having come across the United Nation's Vulnerability Disclosure Program and InfoSec Hall of Fame, researchers Jackson Henry, Nick Sahler, John Jackson, and Aubrey Cottle of Sakura Samurai set out to hunt for any security flaws impacting UN systems.
They then came across exposed Git directories (.git) and Git credential files (.git-credentials) on domains associated with the UNEP and United Nation's International Labour Organization (ILO).
The researchers were able to dump the contents of these Git files and clone entire repositories from the *.ilo.org and *.unep.org domains using git-dumper.
"At this point, our only concern is informing the affected users. Particularly, Aubrey Cottle A.K.A. Kirtaner had noted that if it was this easy to obtain the data, threat actors likely already have the data."
"The group was in agreement that the UNEP should analyze the trajectory of the exposed PII to determine how many threat actors, if any, have the data," Sakura Samurai founder John Jackson told BleepingComputer.
This is not the first time UN systems have suffered a data breach.
In 2019, the UN did not disclose a cyberattack that had severely compromised their networks and databases.
In 2020, a disclosure finally came out from the UN which pinned the blame for the hack on a SharePoint vulnerability.
BleepingComputer has reached out to UNEP for comment and we are awaiting their response.
Update 11-Jan-2020: Clarified 100,000 employee records were accessed as a part of the breach.
The data breach stemmed from exposed Git directories and credentials, which allowed the researchers to clone Git repositories and gather a large amount of personally identifiable information (PII) associated with UNEP employees.
Ethical hacking and security research group Sakura Samurai have now disclosed their findings on a vulnerability that let them access over 100,000 private records of United Nations Environment Programme (UNEP) employees.
The documents and screenshots shared with BleepingComputer provide extensive details on the nature of this security flaw and all that it exposed.
Having come across the United Nation's Vulnerability Disclosure Program and InfoSec Hall of Fame, researchers Jackson Henry, Nick Sahler, John Jackson, and Aubrey Cottle of Sakura Samurai set out to hunt for any security flaws impacting UN systems.
They then came across exposed Git directories (.git) and Git credential files (.git-credentials) on domains associated with the UNEP and United Nation's International Labour Organization (ILO).
The researchers were able to dump the contents of these Git files and clone entire repositories from the *.ilo.org and *.unep.org domains using git-dumper.
"At this point, our only concern is informing the affected users. Particularly, Aubrey Cottle A.K.A. Kirtaner had noted that if it was this easy to obtain the data, threat actors likely already have the data."
"The group was in agreement that the UNEP should analyze the trajectory of the exposed PII to determine how many threat actors, if any, have the data," Sakura Samurai founder John Jackson told BleepingComputer.
This is not the first time UN systems have suffered a data breach.
In 2019, the UN did not disclose a cyberattack that had severely compromised their networks and databases.
In 2020, a disclosure finally came out from the UN which pinned the blame for the hack on a SharePoint vulnerability.
BleepingComputer has reached out to UNEP for comment and we are awaiting their response.
Update 11-Jan-2020: Clarified 100,000 employee records were accessed as a part of the breach.