30/10/2020

shermancountycd

Saved By Business

Attacker Cites Exposed Akamai Server and “intel123” Password

LoadingIncorporate to favorites

Intel: “We feel an particular person with entry downloaded and shared this data”

A misconfigured Akamai CDN (written content shipping community) server and information with the password “intel123” have been pinpointed as the apparent lead to of a major leak from Intel which has viewed 20GB of source code, schematics and other delicate info printed on the net.

The leak, posted last evening by Tillie Kottman, an IT guide primarily based in Switzerland, has information delivered to companions and shoppers by chip maker Intel underneath non-disclosure agreement (NDA), and involves source code, enhancement and debugging instruments and schematics, instruments and firmware for the company’s unreleased Tiger Lake system.

Read through much more: Intel’s 7nm ‘Defect’ Leaves Investors Fretting

In a now-deleted post, the alleged source of the leak explained: “They have a services hosted on the net by Akami CDN that wasn’t correctly protected. Immediately after an online-huge nmap scan I found my goal port open and went by a listing of 370 possible servers primarily based on details that nmap delivered with an NSE script.

“The folders were being just lying open and I could just guess the identify of one. Then you were being in the folder you could go back again to the root and just simply click into the other folders that you don’t know the identify of.

The Intel leak stated in a (now deleted) post by the meant perpetrator

“Best of all, due to a different misconfiguration, I could masquerade as any of their staff or make my possess user.”

The source extra that however several of the zip information on the folder were being password-guarded, “most of them [have] the password Intel123 or a lowercase intel123.”

Kottman expects the info dump will be the first in a series of leaks from Intel.

“Unless I am misunderstanding my source, I can presently inform you that the foreseeable future parts of this leak will have even juicier and much more categorized stuff,” he explained on Twitter.

A spokesman for Intel explained the chipmaker is investigating the leak, but declined to remark on the statements about the misconfigured server and weak passwords.

She explained:“The information appears to come from the Intel Resource and Design and style Center, which hosts information for use by our shoppers, companions and other exterior get-togethers who have registered for entry.

“We feel an particular person with entry downloaded and shared this info.”

The incident is a stark reminder — if any were being needed — that proactively mimicking these types of techniques by hackers is very important to company stability, no matter whether that is via regular Crimson Teaming, or other techniques.

The latest stability steerage from the NSA (focussed on OT environments, but applicable throughout several IT environments as well), observed that ideal tactics contain:

  • Entirely patching all World wide web-obtainable devices.
  • Segmenting networks to defend workstations from immediate exposure to the online. Implement protected community architectures using demilitarized zones (DMZs), firewalls, bounce servers, and/or one-way interaction diodes.
  • Be certain all communications to remote devices use a digital non-public community (VPN) with robust encryption further secured with multifactor authentication.
  • Verify and validate the legit business need for this kind of entry.
  • Filter community traffic to only allow IP addresses that are known to need entry, and use geo-blocking in which appropriate.
  • Join workstations to community intrusion detection devices in which possible.
  • Seize and evaluate entry logs from these devices.
  • Encrypt community traffic to avert sniffing and guy-in-the-center techniques.

See also: National Security Agency: Assume Your OT Regulate Program Will Get Turned In opposition to You