Deloitte's 'Test your Hacker IQ' site forced offline after hack

guest · Nov 5, 2020

Deloitte's 'Test your Hacker IQ' site fails itself after exposing database user name, password in config file
Security quiz site created by advisors includes inadvertent bonus round
November 5, 2020
https://www.theregister.com/2020/11/05/deloitte_hacker_test/

A website created for global consultancy Deloitte to quiz people on knowledge of hacking tactics has proven itself vulnerable to hacking.

The site, found at the insecure non-HTTPS URL http://deloittehackeriq.com/
, makes its YAML configuration file publicly accessible. And within the file, in cleartext, is the username and password for the site's mySQL database.
The site invites visitors to "Test Your Hacker IQ" by entering a username. It then poses a series of multiple choice questions about techniques employed by hackers to obtain corporate information.
Click to expand...

The blunder was spotted on Wednesday by Tillie Kottmann, a Switzerland-based IT consultant and developer who uses the handle "deletescape." The website was taken down in Wednesday.

Kottmann told The Register that the last commit to its .git repo was in 2017 and said it's not clear how actively the site is being used. The site was first captured by the Internet Archive's Wayback Machine in 2018.
Further compounding the vulnerability of the site, the quiz is hosted on Ubuntu Linux 14.04, which stopped receiving security patches in April last year [...]
Click to expand...

Updated to add
In a statement sent to The Register after this story was published, a spokesperson for Deloitte distanced the firm from the now-removed hacking contest site.

“We are aware of an incident that involved unauthorized access to an interactive game/website which was developed for a cybersecurity event in 2015,” the company spokesperson said.
“The platform is hosted by a third-party and is distinct from any other Deloitte system; there is no impact to any other Deloitte system. The site has not been actively used since 2015 and has now been taken down. [...]”
Click to expand...

Log in or Sign up

Deloitte's 'Test your Hacker IQ' site forced offline after hack

guest Guest

Log in or Sign up

Deloitte's 'Test your Hacker IQ' site forced offline after hack

guest Guest

Useful Searches