Source code from dozens of companies leaked online

guest · Jul 27, 2020

Source code from dozens of companies leaked online
July 27, 2020
https://www.bleepingcomputer.com/news/security/source-code-from-dozens-of-companies-leaked-online/

Source code from exposed repositories of dozens of companies across various fields of activity (tech, finance, retail, food, eCommerce, manufacturing) is publicly available as a result of misconfigurations in their infrastructure.

A public repository of leaked code includes big names like Microsoft, Adobe, Lenovo, AMD, Qualcomm, Motorola, Hisilicon (owned by Huawei), Mediatek, GE Appliances, Nintendo, Roblox, Disney, Johnson Controls; and the list keeps growing.
Operation 'Confidential & Proprietary'
The leaks have been collected by Tillie Kottmann, a developer and reverse engineer, from various sources and from their own hunting for misconfigured devops tools that offer access to source code.

A large number of these leaks, which go by the name “exconfidential” or the more tongue-in-cheek label “Confidential & Proprietary,” are available in a public repository on GitLab
Click to expand...

Kottmann told BleepingComputer that they find hardcoded credentials in the easily-accessible code repositories, which they try to remove as best as they can, to prevent direct harm and avoid contributing in any way to a larger breach.

“I try to do my best to prevent any major things resulting directly from my releases,” Kottmann told BleepingComputer
The developer admitted that they don’t always contact the affected companies before releasing the code, yet they make an effort to minimize the negative impact resulting from publishing.
Click to expand...

guest · Aug 6, 2020

Maker of SonarQube defends DevOps product's security after source code leaks blamed on bad configurations
August 4, 2020
https://www.theregister.com/2020/08/04/sonarsource_defends_sonarqube_after_leaks/

SonarQube, an open-source product by SonarSource that claims to be "your teammate for Code Quality and Security", was the focus of adverse publicity recently when a computer consultant chose to publish proprietary source code from well-known companies on the internet – alleging it was largely obtained via badly configured SonarQube installations.

The code was leaked by Swiss computer consultant Tillie Kottmann, who boasts "probably leaking your code right now" on their Twitter profile, which also features a pinned tweet inviting anyone with "access to any confidential info, documents, binaries or source code, which you think should be made available to the public" to contact Kottmann "so we can discuss safely releasing it".
Click to expand...

Why the leaks? Was it to encourage companies not to be sloppy about securing their code? "That's definitely part of it," Kottmann told us, [...] Kottmann claimed that much of the code was found in poorly secured repositories, many of which were leaked via SonarQube.

SonarSource CEO Olivier Gaudin has posted about the leaks, emphasising that access was because of "the way these specific SonarQube instances were configured, not because of a vulnerability in the SonarQube product itself".
Click to expand...

guest · Oct 27, 2020

FBI: Hackers stole government source code via SonarQube instances
October 27, 2020
https://www.bleepingcomputer.com/ne...vernment-source-code-via-sonarqube-instances/

The Federal Bureau of Investigation (FBI) issued a flash alert warning of hackers stealing data from U.S. government agencies and enterprise organizations via internet-exposed and insecure SonarQube instances.

SonarQube is an open-source platform for automated code quality auditing and static analysis to discover bugs and security vulnerabilities in projects using 27 programming languages.
Vulnerable SonarQube servers have been actively exploited by attackers since April 2020 to gain access to data source code repositories owned by both government and corporate entities, later exfiltrating it and leaking it publicly.
Dozens of companies already had their source code leaked

"Beginning in April 2020, the FBI observed source code leaks associated with insecure SonarQube instances from US government agencies and private US companies in the technology, finance, retail, food, eCommerce, and manufacturing sectors," the FBI says in the TLP:WHITE flash alert.
Kottmann also leaked roughly 20 GB of Intel confidential documents during August, after receiving them from an anonymous source who allegedly breached the company's servers earlier.
Click to expand...

While not naming any names, the FBI highlights two such events in the flash alert, one conducted by an identified actor and one where the attackers are still unknown:
Previous attacks and mitigation measures
The threat actors start their attacks by first scanning for Internet-exposed SonarQube instances using the default port number (i.e., 9000) the FBI explains.

• In July 2020, an identified cyber actor exfiltrated proprietary source code from enterprises through poorly secured SonarQube instances and published the exfiltrated source code on a self-hosted public repository.
• In August 2020, unknown threat actors leaked internal data from two organizations through a public lifecycle repository tool. The stolen data was sourced from SonarQube instances that used default port settings and admin credentials running on the affected organizations’ networks.
Click to expand...

guest · Dec 2, 2020

Source code used by Central Banks and Stock Exchanges leaked online
December 1, 2020
https://securityreport.com/source-code-used-by-central-banks-and-stock-exchanges-leaked-online/

This week, the source code of CMA, a software provider relied on by leading central banks across nations and stock exchanges has been exposed online.

The National Central Banks related software has been published on a public repo.
The code has been developed by https://t.co/UTGS2deUeP, that creates software primarily for Central Banks and Stock Exchanges.
Allegedly over $100bn/day in transactions happen via their software. pic.twitter.com/KcvxiwVMbt
— Bank Security (@Bank_Security) November 30, 2020
On taking a closer look, Security Report can confirm the source code for what appear to be CMA’s applications, has indeed been leaked online.
Click to expand...

CMA’s clients include prominent central banks in Morocco, Mauritius, Oman, Serbia, Libya, Cambodia, etc.
The company also serves names like Oracle, Symantec, Citibank, and others.

The actor behind this leak is the same one who had previously exposed source code from dozens of companies online, which included names like Microsoft, Adobe, Lenovo, AMD, Qualcomm, Motorola, Mediatek, GE Appliances, Nintendo, Roblox, Disney, and so on.
Click to expand...

Log in or Sign up

Source code from dozens of companies leaked online

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Source code from dozens of companies leaked online

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches