Mercedes-Benz onboard logic unit (OLU) source code leaks online

mood Updates Team

Joined:: Oct 27, 2012

Posts:: 45,459

Location:: Germany

Mercedes-Benz onboard logic unit (OLU) source code leaks online
Daimler allowed anyone to register on one of its on-premise GitLab servers
May 18, 2020
https://www.zdnet.com/article/mercedes-benz-onboard-logic-unit-olu-source-code-leaks-online/

The source code for "smart car" components installed in Mercedez-Benz vans has been leaked online over the weekend, ZDNet has learned.

The leak occurred after Till Kottmann, a Swiss-based software engineer, discovered a Git web portal belonging to Daimler AG, the German automotive company behind the Mercedes-Benz car brand.
Kottmann told ZDNet that he was able to register an account on Daimler's code-hosting portal, and then download more than 580 Git repositories containing the source code of onboard logic units (OLUs) installed in Mercedez vans.
WHAT'S AN OLU?
According to the Daimler website, the OLU is a component that sits between the car's hardware and software, and "connects vehicles to the cloud."
Click to expand...

UNSECURED GITLAB INSTALLATION LEAKS OLU CODE
Kottmann told ZDNet in an interview today that he found Daimler's GitLab server using something as simple as Google dorks (specialized Google search queries).

Kottmann says Daimler failed to implement an account confirmation process, which allowed him to register an account on the company's official GitLab server using a non-existent Daimler corporate email.
While the leak appeared to be harmless in the beginning, threat intelligence firm Under the Breach, which also reviewed the data, told ZDNet they discovered passwords and API tokens for Daimler's internal systems.
Click to expand...

After both ZDNet and Under the Breach reached out today to Daimler, the company took down the GitLab server from where Kottmann downloaded the data. A Daimler spokesperson did not return a formal request for comment.
Click to expand...

mood, May 18, 2020

#1

fblais Registered Member

Joined:: Jul 31, 2008

Posts:: 1,320

Location:: Québec, Canada

fblais, May 18, 2020

#2

Tarnak Registered Member

Joined:: Feb 5, 2007

Posts:: 5,103

A hacked Benz.... No, thanks!

Tarnak, May 19, 2020

#3

mood Updates Team

Joined:: Oct 27, 2012

Posts:: 45,459

Location:: Germany

Mercedes-Benz Data Leak: Embarrassing But Endurable
The Mistake Could Have Been Much Worse in an Era of Connected Vehicles
May 25, 2020
https://www.inforisktoday.com/blogs/mercedes-benz-data-leak-embarrassing-but-endurable-p-2903

Last week, a curious data breach occurred: Almost 9 GB of software development documentation from Daimler AG, the parent company of Mercedes-Benz.

He discovered Daimler's GitLab pages by using hyper-specific Google searches, sometimes referred to as Google dorking. He created an account and found that Daimler AG didn't verify that he had a control of an email account within domain that the company had sanctioned to join the GitLab pages.
Thus he had complete access. Kottmann then republished the data via Mega, the online storage platform, and on other outlets.
Credentials Leaked
The mistake by Daimler was a simple one: it should have made Kottmann verify he owned an authorized email address before granting access. This kind of inattentiveness to access controls or settings, whether it could be GitLab pages to Elasticsearch clusters, has led to big data breaches.
Click to expand...

As for why he didn't give Daimler a heads up, Kottmann tells ISMG: "I guess this just comes down to my personal beliefs, curiosity and not really caring too much about their corporate interests. I did not intend for there to be credentials and private keys, but apparently didn't check this leak thoroughly enough."
Daimler: Access Was 'Illicit'
Upon learning of the leak, "the affected platform was shut down at once; potentially affected credentials were immediately deactivated respectively deleted," Rosenthal says. "We will examine the incident carefully and initiate appropriate measurements."
Rosenthal characterized Kottmann's access to the GitLab pages as "illicit."
Click to expand...

mood, May 25, 2020

#4

Log in or Sign up

Mercedes-Benz onboard logic unit (OLU) source code leaks online

mood Updates Team

fblais Registered Member

Tarnak Registered Member

mood Updates Team

Useful Searches