Services Provider to Government Left Database Exposed: Report

guest · Feb 13, 2020

Services Provider to Government Left Database Exposed: Report
Researcher Says Exposed Granicus Database Could Have Made Websites Vulnerable
February 13, 2020
https://www.databreachtoday.com/services-provider-to-government-left-database-exposed-report-a-13716

One of the largest IT services providers for U.S. federal and local government agencies left a massive production database exposed to the internet, potentially allowing attackers to rewrite content on websites or plant malware, according to a security researcher. The database was taken offline Wednesday.
The elasticsearch database belongs to Granicus [...]

The database was found by Dan Ehrlich, an Austin, Texas-based researcher who runs the consulting firm Twelve Security. Elasticsearch is an open-source platform for storing and querying data, but if it's misconfigured, the data may be accessible.
The researcher says the database includes the files for websites belonging to the Department of Health and Human Services and U.S. House of Representatives plus, those for hundreds of other local government units across the country.
Click to expand...

Granicus has been called out before for security issues.

Ehrlich says he also noticed Granicus' lack of use of HTTPS, which encrypts traffic between a user's computer and a server. The encryption means that if the traffic is collected by a third party on the same network, it cannot be read.

"Granicus does not use HTTPS for the vast majority of their entire IT infrastructure," Ehrlich says.
Click to expand...

Log in or Sign up

Services Provider to Government Left Database Exposed: Report

guest Guest

Log in or Sign up

Services Provider to Government Left Database Exposed: Report

guest Guest

Useful Searches