Attunity Data Leak Exposes Sensitive Files at Ford, TD Bank

Three unsecured Amazon S3 storage buckets compromised more than 1TB of data belonging to Attunity and its high-profile clients.

Data management firm Attunity exposed more than 1TB of sensitive data via three misconfigured Amazon S3 buckets, security firm UpGuard disclosed late last week. The mistake compromised Attunitys internal corporate information as well as data of high-profile businesses, including Ford, TD Bank, and Netflix.
UpGuard researcher Chris Vickery found publicly accessible S3 storage buckets attunity-it, attunity-patch, and attunity-support on May 13, 2019. While the total amount of compromised data has not been confirmed, Vickery downloaded a sample of about 1TB, which included 750GB of compressed email backups, UpGuard reports.
Attunity-it held the bulk of sensitive data as well as the oldest files, which were uploaded in September 2014, though this doesnt mean they have been publicly accessible since then. The newest files were uploaded days before the discovery. Attunity was notified of the exposure on May 16. Following complications related to time zone disparities and Attunitys recent
acquisition
by business intelligence company Qlik, public access to the buckets was removed on May 17, 2019.
Attunity was notified in mid May of an issue related to internal company data stored in AWS S3 buckets, writes Qlik spokesperson Derek Lyons in a statement. Attunity personnel responded quickly to ensure that the data was secured. Attunity customers deploy and operate the software directly in their own environments, and therefore Attunity doesnt store or host sensitive data.
While AWS S3 bucket leaks are fairly common, Attunitys stands out for a few reasons. For starters, Vickery says, it wasnt difficult to discover three of its publicly accessible repositories. He usually finds one, maybe two or three, for a single company with one search. These businesses likely have more exposed, but the buckets names may have terms he doesnt explicitly search. When Vickery used Attunity as a term, the search yielded these results.
Finding three so quickly for Attunity was a little out of the ordinary, he says. This was surprising for a cloud migration and data integration business that counts 2,000 enterprises and half of the Fortune 100 among its clients. A file exposed among the buckets contained a client list with a number of organizations containing that description,
he reports
.
What Went Exposed?
Attunitys S3 buckets included details of internal projects at Ford, software upgrade invoices for TD Bank, and information on technology it was configuring for TD Bank. Vickery found backups of Attunity employee OneDrive accounts, which spanned a range of data that people need to do their jobs: emails, system passwords, sales and marketing contact info, project specifications.
What made it even more surprising was the amount of employee email content, Vickery continues, adding that you never know whats going to be in an email archive. Some of the exposed emails contained company account passwords written in plaintext, he points out.
Exposed files included documentation of Attunitys internal systems, documents describing how they will process customer data, and spreadsheets of employee information displaying full names, department, location, job title, date of hire, annual salary, and a range of other details. Adding to the risk, Vickery found employee ID numbers that are linked to Attunitys US employees use the same numbering scheme as Social Security numbers, leading to the idea the two may be the same. Researchers were able to confirm the Attunity employee IDs were valid SSNs; however, they were not able to verify the employee ID number for a person was also their SSN.
The amount of data that was present was pretty extensive, says Vickery. Whenever you have over a terabyte, that catches your attention. UpGuard notified Attunity of its findings, as well as its own clients that were affected by the exposure.
Cutting Third-Party Risk
The exposure of login credentials, particularly administrative credentials, increases the potential reach of someone who accessed these buckets. UpGuard researchers dont attempt to use credentials and cannot confirm the level of access provided by those exposed in the Attunity leak. Vickery says the question is what level of access Attunity has to client networks.
Clients could be giving Attunity access that at some point is privileged, to a degree, he explains. If this is the case, its hard to imagine a scenario in which the client wouldnt be at risk.
System credentials could be found in several places across the Attunity data set, serving as a reminder of how that data should be stored within an organization. Credentials such as private keys were stored and exposed in directors for configuring their respective systems. If exposed credentials and data pose a risk to Attunity, they pose a risk to the data that Attunity processes.
Vickery advises companies with major enterprise clients to never upload anything to a third-party cloud thats not already encrypted. Encrypted data stored in a misconfigured bucket isnt as big a deal; even if a researcher or attacker finds it, they wont be able to read it. The publicly accessible buckets Vickery found belonging to Attunity had information stored in plaintext.
When establishing contracts with third parties, he also suggests including very clearly defined areas where the data will be stored and managed, as well as URLs to the buckets where data will be backed up. One of the two parties owns or controls this neutral storage zone, he explains, but both will be able to verify whether the data is publicly accessible.
As per Lyons statement, Qlik is still in the process of investigating this issue and has consulted outside security firms to conduct independent evaluations. At this point, findings indicate UpGuard, the security firm that alerted Qlik, is the only one to externally access the data.
Related Content:
The Truth About Your Software Supply Chain
7 Ways to Mitigate Supply Chain Attacks
How Hackers Infiltrate Open Source Projects
Office 365 Multifactor Authentication Done Right

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the
conference
and
to register.

Last News
▸ Some DLP Products Vulnerable to Security Holes ◂ Discovered: 23/12/2024 Category: security	▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security	▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Attunity Data Leak Exposes Sensitive Files at Ford, TD Bank