FBI: Hackers stole Source Code of US Agencies due to SonarQube misconfiguration [pdf]

#1

Post by aschatten » Sat, Nov 07, 2020, 10:03 PM UTC

FBI: Hackers stole Source Code of US Agencies due to SonarQube misconfiguration [pdf]
ic3.gov

Re: FBI: Hackers stole Source Code of US Agencies due to SonarQube misconfiguration [pdf]

#2

Post by aschatten » Sat, Nov 07, 2020, 10:03 PM UTC

During the initial attack phase, cyber actors scan the internet for SonarQube instances exposed to the open Internet using the default port (9000) and a publicly accessible IP address. Cyber actors then use default administrator credentials (username: admin, password: admin) to attempt to access SonarQube instances.

Given how often this happens, not having a default password and forcing users to set it should be a standard practice these days. Relying on administrators of the instance doing the right thing obviously keeps failing, thus an option to do the wrong thing should be removed completely.

Re: FBI: Hackers stole Source Code of US Agencies due to SonarQube misconfiguration [pdf]

#3

Post by ExcavateGrandMa » Sat, Nov 07, 2020, 10:38 PM UTC

Epic nabz... do you realize in which insecurity we are... :Ð

Re: FBI: Hackers stole Source Code of US Agencies due to SonarQube misconfiguration [pdf]

#4

Post by txutxu » Sat, Nov 07, 2020, 10:49 PM UTC

I did discover a SonarQube instance at $work open to the internet, default credentials too...

Developers are good at copy/pasting commands.

    docker

We're not an US Agency, but it seems those things happen eventually.

Re: FBI: Hackers stole Source Code of US Agencies due to SonarQube misconfiguration [pdf]

#5

Post by throwaway383737 » Sun, Nov 08, 2020, 4:19 AM UTC

txutxu wrote: post #4

I did discover a SonarQube instance at $work open to the internet, default credentials too... Developers are good at copy/pasting commands. docker We're not an US Agency, but it seems those things happen eventually.

How does this happen? Who writes the firewall rules to map these ports?