- Aug 17, 2014
Today, researchers have responsibly disclosed a security vulnerability by exploiting which they could access over 100,000 private employee records of United Nations Environmental Programme (UNEP).
The data breach stemmed from exposed Git directories and credentials, which allowed the researchers to clone Git repositories and gather a large amount of personally identifiable information (PII) associated with over 100k employees.
Ethical hacking and security research group Sakura Samurai have now disclosed their findings on a vulnerability that let them access the private data of over 100,000 United Nations Environment Programme (UNEP) employees.
The documents and screenshots shared with BleepingComputer provide extensive details on the nature of this security flaw and all that it exposed.
Having come across the United Nation's Vulnerability Disclosure Program and InfoSec Hall of Fame, researchers Jackson Henry, Nick Sahler, John Jackson, and Aubrey Cottle of Sakura Samurai set out to hunt for any security flaws impacting UN systems. [...]
In an email interview with BleepingComputer, the group said:
"When we started researching the UN, we didn't think it would escalate so quickly. Within hours, we already had sensitive data and had identified vulnerabilities. Overall, in less than 24 full hours we obtained all of this data," Sakura Samurai told BleepingComputer.
"In total, we found 7 additional credential-pairs which could have resulted in unauthorized access of multiple databases. We decided to stop and report this vulnerability once we were able to access PII that was exposed via Database backups that were in the private projects," state the researchers in their blog post.
This week, researchers have responsibly disclosed a vulnerability by exploiting which they could access over 100K private records of United Nations Environmental Programme (UNEP). The data breach stemmed from exposed Git directories which let researchers clone Git repositories and gather PII of...