“The United Nations accidentally published passwords, internal documents, and technical details about websites when it misconfigured popular project management service Trello, issue tracking app Jira, and office suite Google Docs.
The
mistakes made sensitive material available online to anyone with the
proper link, rather than only to specific users who should have access.
Affected data included credentials for a U.N. file server, the video
conferencing system at the U.N.’s language school, and a web development environment for the U.N.’s Office for the Coordination of Humanitarian Affairs.
Security researcher Kushagra Pathak discovered the accidental leak and notified the U.N. about what he found a little over a month ago. [He reported his findings to the UN on August 20]. As of today [9/24], much of the material appears to have been taken down.
In an online chat, Pathak said he found the sensitive information by running searches on Google. The searches, in turn, produced public Trello pages, some of which contained links to the public Google Docs and Jira pages.
Trello projects are organized into “boards” that contain lists of tasks called “cards.” Boards can be public or private. After finding one public Trello board run by the U.N., Pathak found additional public U.N. boards by using “tricks like by checking if the users of one Trello board are also active on some other boards and so on.” One U.N. Trello board contained links to an issue tracker hosted on Jira, which itself contained even more sensitive information. Pathak also discovered links to documents hosted on Google Docs and Google Drive that were configured to be accessible to anyone who knew their web addresses. Some of these documents contained passwords.
Pathak has become something of a specialist in finding private information on public Trello boards. Earlier this year, he discovered a range of private data, including passwords and security plans, belonging to the governments of the United Kingdom and Canada on 50 unprotected boards. Before that, he uncovered a large swath of sensitive data on Trello belonging to dozens of other organizations, including a “well-known ride-sharing company.” Some of the companies used publicly visible Trello boards as a way to internally share passwords for logging into their websites and contact databases, as well as accounts for email, social media, and credit card processing.
Pathak’s research has served to highlight just how often organizations completely fail when trying to handle the passwords and myriad other secrets needed to work and publish online. Here is just some of the sensitive information that the U.N. accidentally made accessible to anyone who Googled for it:
During this period, Pathak continued to report more sensitive information to the U.N. In all, he reported 60 Trello boards, several Google Drive and Google Docs links that contained sensitive information, and sensitive information from a public U.N. account on Jira.
The U.N. began taking down the exposed information on September 13, after The Intercept contacted the organization for comment. “Trello is one of various tools that U.N. staff use to share materials both internally and externally with partners,” U.N. spokesperson Florencia Soto Nino-Martinez said in an email.
“Some of the boards listed have communications materials which are not sensitive, while some have outdated information. However, we are reviewing all boards on the list to ensure that no passwords or credentials are shared through this medium.”
“We take security very seriously and have reached out to all staff reminding them of the risks of using a third-party platform to share content and to take the necessary precautions to ensure no sensitive content is public,” she added.
Trello boards, as well as documents hosted on Google Drive and Google Docs, are private by default. The user must manually change settings to make this information public for anyone on the internet to view. Pathak previously suggested that Trello add new safeguards to discourage the exposure of sensitive data. At the time, Trello’s CEO stated that “we strive to make sure public boards are being created intentionally and have built in safeguards to confirm the intention of a user before they make a board publicly visible. Additionally, visibility settings are displayed persistently on the top of every board.”
Security researcher Kushagra Pathak discovered the accidental leak and notified the U.N. about what he found a little over a month ago. [He reported his findings to the UN on August 20]. As of today [9/24], much of the material appears to have been taken down.
In an online chat, Pathak said he found the sensitive information by running searches on Google. The searches, in turn, produced public Trello pages, some of which contained links to the public Google Docs and Jira pages.
Trello projects are organized into “boards” that contain lists of tasks called “cards.” Boards can be public or private. After finding one public Trello board run by the U.N., Pathak found additional public U.N. boards by using “tricks like by checking if the users of one Trello board are also active on some other boards and so on.” One U.N. Trello board contained links to an issue tracker hosted on Jira, which itself contained even more sensitive information. Pathak also discovered links to documents hosted on Google Docs and Google Drive that were configured to be accessible to anyone who knew their web addresses. Some of these documents contained passwords.
Pathak has become something of a specialist in finding private information on public Trello boards. Earlier this year, he discovered a range of private data, including passwords and security plans, belonging to the governments of the United Kingdom and Canada on 50 unprotected boards. Before that, he uncovered a large swath of sensitive data on Trello belonging to dozens of other organizations, including a “well-known ride-sharing company.” Some of the companies used publicly visible Trello boards as a way to internally share passwords for logging into their websites and contact databases, as well as accounts for email, social media, and credit card processing.
Pathak’s research has served to highlight just how often organizations completely fail when trying to handle the passwords and myriad other secrets needed to work and publish online. Here is just some of the sensitive information that the U.N. accidentally made accessible to anyone who Googled for it:
- A social media team promoting the U.N.’s “peace and security” efforts published credentials to access a U.N. remote file access, or FTP, server in a Trello card coordinating promotion of the International Day of United Nations Peacekeepers. It is not clear what information was on the server; Pathak said he did not connect to it.
- The U.N.’s Language and Communication Programme, which offers language courses at U.N. Headquarters in New York City, published credentials for a Google account and a Vimeo account. The program also exposed, on a publicly visible Trello board, credentials for a test environment for a human resources web app. It also made public a Google Docs spreadsheet, linked from a public Trello board, that included a detailed meeting schedule for 2018, along with passwords to remotely access the program’s video conference system to join these meetings.
- One public Trello board used by the developers of Humanitarian Response and ReliefWeb, both websites run by the U.N.’s Office for the Coordination of Humanitarian Affairs, included sensitive information like internal task lists and meeting notes. One public card from the board had a PDF, marked “for internal use only,” that contained a map of all U.N. buildings in New York City. Another card had an attached PDF that included a phone tree with names and phones numbers of people working for a division of U.N.’s human resources department. Some cards contained links to internal documents hosted on Google Docs that, in turn, contained sensitive information about web development projects, including a web address and password to access a staging environment to test early features of the website.
- The U.N. website developers also used a public Jira bug tracker that contained detailed technical information about how the sites were developed and what issues they were having.
During this period, Pathak continued to report more sensitive information to the U.N. In all, he reported 60 Trello boards, several Google Drive and Google Docs links that contained sensitive information, and sensitive information from a public U.N. account on Jira.
The U.N. began taking down the exposed information on September 13, after The Intercept contacted the organization for comment. “Trello is one of various tools that U.N. staff use to share materials both internally and externally with partners,” U.N. spokesperson Florencia Soto Nino-Martinez said in an email.
“Some of the boards listed have communications materials which are not sensitive, while some have outdated information. However, we are reviewing all boards on the list to ensure that no passwords or credentials are shared through this medium.”
“We take security very seriously and have reached out to all staff reminding them of the risks of using a third-party platform to share content and to take the necessary precautions to ensure no sensitive content is public,” she added.
Trello boards, as well as documents hosted on Google Drive and Google Docs, are private by default. The user must manually change settings to make this information public for anyone on the internet to view. Pathak previously suggested that Trello add new safeguards to discourage the exposure of sensitive data. At the time, Trello’s CEO stated that “we strive to make sure public boards are being created intentionally and have built in safeguards to confirm the intention of a user before they make a board publicly visible. Additionally, visibility settings are displayed persistently on the top of every board.”
Pathak believes that people often make their organizations’ sensitive data public simply because it’s more convenient. This way they can “share the details present on the board with their team members just by sharing the URL of the board with them without adding them to the board,” Pathak said.
“Adding people to the board seems to be huge task for these people, but in fact it is really easy,” he added.”
..................
No comments:
Post a Comment