Posted on
May 12, 2018 at
6:28 PM

According to one security researcher, there has been a massive overlook when it comes to the security of British mobile network company called EE. By failing to change the default username and password, the company their users’ and ’ data wide , and ready for taking.

EE fails to a code repository

One of the largest mobile networks in Britain, EE,  which is also owned by BT Group, was accused of risking the safety of a critical code repository due to bad security. Apparently, the company left the repository protected only by a default login info, according to one researcher.

This researcher, with a Twitter handle of “six”, posted a tweet in which he announced that he got access to two million lines of code. These contain a number of AWS secret keys and APIs belonging to developers and other company’s employees.

By getting to these keys, it is possible for hackers to get a detailed analysis of the company’s payment systems, as well as to discover additional vulnerabilities. By finding those, a number of frightening possibilities are opening up, including the potential theft of payment info.

According to the researcher, the code can be accessed on SonarSource’s platform called SonarQube, on the EE subdomain. This is where the company usually does code analysis and bug detection.

Reports of the flaw were not answered

The researcher also claimed that he reported the company of this multiple times during the span of several weeks. Surprisingly, the company did not respond on any of these occasions, which finally forced this Twitter user to go public with his findings.

In a tweet, he stated that he has waited for many weeks, yet the reply never came, which forced him to let the public know about the issue. He came out with all of the critical information in the post in which he states that two million lines were only protected by an admin:admin combination for username and password.

With these credentials left in their default form, there is practically nothing that would stop hackers to analyze the code and find additional vulnerabilities. In fact, he claims that there is no real need for any analysis since the hackers can just handpick the API and AWS keys from the data.

Finally, he warned the users of the company that their data is at risk since EE obviously does not that much about their users’ security. The company stated to ZDNet that these accusations are false and that the data of their customers are not at risk.

Additionally, they stated that the security of their users is of highest priority within the company. At least, the company acknowledged the mistake and decided to thank “six” for pointing the flaw out.

WinMagic’s VP EMEA, Luke Brown, stated that there were a lot of incidents regarding the data theft and bad security. However, the default login info on a repository that is used for finding bugs and improving security is quite ironic. According to Brown, this is further proof that the most of the responsibility shared between the cloud security and company security still falls on the organization itself. This is why there is the need for rules and policies regarding passwords, encryption, and similar aspects of security within companies.

Summary

British Cell Operator Left itself Open for a Hacking Attack  - wAAACwAAAAAAQABAEACAkQBADs  - British Cell Operator Left itself Open for a Hacking Attack

Article Name

British Cell Operator Left itself Open for a Hacking Attack

Description

According to one security researcher, there has been a massive overlook when it comes to the security of British mobile network company called EE. By failing to change the default username and password, the company left their users’ and employees’ data wide open, and ready for taking.

Author


Ali Raza

Publisher Name


Koddos

Publisher Logo





Source link

LEAVE A REPLY

Please enter your comment!
Please enter your name here