Finance company stores DB credentials in helpfully labeled spreadsheet

PWNED Welcome, once again, to PWNED, the weekly column where we recount the adventures of IT explorers who found their own pile of quicksand and then jumped right into it. This week's story involves keeping sensitive information in a very vulnerable place and then not protecting it adequately. The tale comes to us courtesy of …

[Dan 55]

That's amazing, I've got the same combination on my luggage

[bemusedHorseman]

Spaceballs: The Follow-Up Comment!

"I knew it, I'm surrounded by Assholes!"

[Pascal Monett]

Not a gaping hole in the network, but . . .

Once upon a time I was called in to take over security for a new customer.

My company was selected and I was the frontend to replace a very well-known company in Luxembourg which I will not name for obvious reasons.

The time for handover came and the previous responsible gave me a USB key with an Excel file that had the passwords that I needed.

Sorted in a table by the company name.

With all the other companies' data just a click away.

What kind of fuckwit doesn't realize that you don't just give away confidential data like that ?

It's beyond me.

[An_Old_Dog]

Re: Not a gaping hole in the network, but . . .

Q. What kind of fuckwit doesn't realize that you don't just give away confidential data like that?

A. All too often, the sort of fuckwit which is promoted into upper management.

[Strahd Ivarius]

Re: Not a gaping hole in the network, but . . .

The same that store passwords in OneNote, on only one page, for all the clients he is working with?

Then on a Teams meeting need to open said page to connect to a system for performing a demo while sharing his screen?

(I won't give the name of the company, because they have a strong accent and like adventure; but I still have the screenshot...)

[Anonymous Coward]

Re: Not a gaping hole in the network, but .

We had an old, long since discontinued, piece of network kit die on us some years back. Specifically it was a load balancer, and as such it wasn’t as easy as ”just getting another model and dropping it in”. Add to that that we were in the long process of sunsetting the platform it was serving - an older TV platform still serving a few tens of thousands customers - and so the willingness to invest in it wasn’t very high from our management.

Eventually, the integrator we had once bought the one that had died from found an identical model in their warehouse. It was a customer trade-in that they were - I kid you not - using as a door stop. They were willing to part with it (as long as we promised them something equally heavy in return) and it ended up on my desk to reconfigure.

…at which point I found the configuration for the country’s biggest marketplace site (Craigslist style) still on the device. Including private keys, web and database server login credentials, and keys to the RADIUS servers used for authenticating network admins.

This story is bad for so many reasons. First of all, the vendor shouldn’t have stored all this in plain text in the visible device config. Secondly, the old customer should have wiped the config before returning it. Thirdly, the integrator should have wiped it again on receiving it and then checked it once more before sending it to us. And fourthly, we shouldn’t have accepted network equipment used as a freaking DOOR STOP for a production plattform. (When it too died on us a few months later, the product owner said ”Fsck it, let’s contact the remaining customers and tell them we’ll be migrating them starting Monday. Let’s hope the other one in the cluster doesn’t die before then.”)

[Anonymous Coward]

Re: Not a gaping hole in the network, but .

We purchased a second hand and supposedly refurbished colour network scanner/printer/photocopier. It was the sort of machine that had a hard drive in it to store scans on.

After installation I decided to have a play with the scan and store function although it wasn't something we were likely to use. I found a folder full of saved scans on the hard drive. Full colour scans of both sides of driving licences, birth certificates and in some cases passports for about 40 different people presumably from the company the copier was previously installed at. No password protection or anything, fully accessible to anyone who had access to the machine.

We informed the company we had purchased the device from, who we were also paying to support it for us and they sent out an engineer to perform a system level format of the hard drive to make sure the files were properly eradicated.

[Anonymous Coward]

Re: Not a gaping hole in the network, but .

Stories like this are why my employer has a strict "shred it all" policy for hard drives leaving the datacenter floor. Including the ones in load-balancers. And when it was first put into enforcement, it caused a rather big stink with vendors when doing RMAs. Some of them didn't like us digging around the inside of their kit, some of them didn't want to deal with replacing them on their end, and so on.

Was interesting to see the adoption of easily removable drives after a decade or so. Made me wonder if a lot of companies adopting similar policies might have been driving it.

[timmy 2]

Re: Not a gaping hole in the network, but .

25+ yrs ago I was working for a state agency and we really needed some backup server hardware but no budget. "No problem" (says I) because I have access to the state surplus IT equipment list. Found 2 servers being surplused from another agency that were WAAAAAAY overkill for our needs, Dell 4300 with full complement of SCSI hard drives and DLT tape backup (all I really needed was the DLT drives for backing up the data on our in-house server).

Imagine my surprise when I booted them up and they had a full operating system! Further investigation found they had been running Exchange server and still had everything stored. Looked up the previous administrator and found out "Hey, that's my old buddy <redacted>!" So I called up "John" and started feeding him some rope. He got embarrassed since it was his job to ensure they had been wiped. He ended up sending a subordinate over to low-level wipe the drives which took him about just over an hour per drive. That individual sat there all day just reading the newspaper, moving only to start the wipe on the next drive.

I still yank my buddy's chain to this day even though he retired 10 yrs ago. Call him up randomly for a chat and tell him "Found another one!"

[CrazyOldCatMan]

Re: Not a gaping hole in the network, but . . .

The same that store passwords in OneNote, on only one page, for all the clients he is working with?

I have to admit, I did keep a spreadsheet of all the usernames and passwords of the email addresses I was looking after (OK - I was migrating everyone over to a new email system OK? And they were all family and friends!).

But at least I kept it on an encrypted, password-protected Apple Disk Image, with the password known only to me. I'm sure it wasn't necessarily uncrackable but, to do so, the attacker would have to get into my network, get into my Mac (encrypted disk image *not* stored in iCloud) past FileVault, then try to guess the (quite long and complex and not stored in any password manager) password for the disk image.

Then guess the (different) password that I locked the spreasheet with.

Yes, yes, I am paranoid. I'm in IT. If you have done IT as long as me and are *not* paranoid, you've not been doing it properly.

[Anonymous Coward]

Re: Not a gaping hole in the network, but . . .

What kind? Someone who is losing his job because another company takes over the contract and ceased to care?

[Sproggit]

I'm likely to get flamed for this... but based on personal experience, this is a common problem caused by poor management and more specifically by giving people conflicting objectives.

If you run a "DevOps" shop, you are asking some of your technology people to both support production environments and have developer-level access to the code they have in production. Everywhere I've seen this done, I have seen higher levels of unauthorised changes, higher levels of post-change incidents, higher levels of downtime. In fairness, that would be less than 5 organizations, so I acknowledge my experience is limited.

But in shops where developers have no access to UAT or Production and where robust controls were in place to safeguard those environments, stability and reliability were much higher. And yes, we're talking big financial institutions, where the stability and integrity of production code wasn't just important, it carried legal implications for executives [think Sarbanes-Oxley Act, False Claims Act, etc.]. I recall watching one DevOps Analyst-Programmer in particular - a pretty smart guy - get a clean compile out of some code he'd just written, give it a *single test run* on the *production* data, sample the output and then move the code to Production libraries... All because our manager had set up an incentive structure that drove that behavior. Or as we would say, "Work faster, not smarter". Doing that in a shop where roles and responsibilities are amorphous is just asking for trouble.

If you want people to behave in a particular way [sensibly] then you have to incentivize them to do so. Setting year-end goals to "Get X in Production" or "Implement Feature Y" is not an incentive for your developers, it's handing them a loaded gun and asking them to aim at *your* foot, close their eyes and pull the trigger.

DevOps is like giving them a gun with a full clip and asking them to keep shooting at both your feet until the clip is empty.

And DevSecOps is like dropping a tactical nuke in your boxer shorts and hoping it won't go off...

[Anonymous Coward]

You see, that's why I don't wear boxer shorts..

[Anonymous Coward]

If that is your only reason then how did you come to that?

I don’t wear boxer shorts but that is a preference because I don’t like the feel of them…

[Anonymous Coward]

It's indeed not the only reason, grin. There's also the Heisenberg principle of uncertainty for the bit in the middle.

Other configurations offer less of a dangling participle, so to speak.

[Anonymous Coward]

There are some advantages to being a Scotsman.

[Korev]

> There are some advantages to being a Scotsman.

Is that a Kilt switch?

[herman]

A tragedy: kilt -9 scot*

[TimMaher]

Re:- “dangling participle”

I’d recommend budgie smugglers.

[Albert Coates]

Re: “dangling participle”

Commando, the only way, unless you are a dedcated sagger.

[Throg]

Doing It Wrong

If you run a "DevOps" shop, you are asking some of your technology people to both support production environments and have developer-level access to the code they have in production.

I realise that this is a cliche answer, but if that’s what “DevOps” means to your organisation, you’re doing it wrong.

Everywhere I've seen this done, I have seen higher levels of unauthorised changes, higher levels of post-change incidents, higher levels of downtime.

This is nothing to do with DevOps per se. I’ve encountered it in organisations with no automated build pipelines etc.

It’s a people problem. Overzealous managers who don’t have the experience to understand why it’s a bad idea, coupled with over enthusiastic dev teams who don’t… yeah you can see where this is going.

My rule as a team lead, regardless of DevOps - no developers in prod or staging, ever. It’s a hill I’m willing to stand or die on in the face of upper management pressure.

[ecofeco]

Crap like that is why I've learned to CMA before I do anything else, while on the job.

Cover My Ass.

Because YOU will be the scapegoat when SHTF.

[segfault188]

Multi-layered security

Multi-layered security is essential, although once someone has physical access all bets are off.

I dug up a tree the other day and all I needed was a spade to get root access.

[Anonymous Coward]

Re: Multi-layered security

That's actually one of the few systems where the more legacy there is, the harder it is to get to root.

Also, from an IT perspective it's actually upside down :).

[Mast1]

Re: Multi-layered security

For legacy trees, you need axes to get access to the root(s).

[Strahd Ivarius]

Re: Multi-layered security

I am working at a beverage company, and IT is running on root beer...

[bemusedHorseman]

The only filename that would be even more obvious, would be to give remote access to "Bob from Microsoft", and to have a file on your desktop named BIG_LIST_OF_SECRETS_SAAR.txt...

[cd]

Hi, I'm the principal here, call me Peter.

[Anonymous Coward]

So they were also using shared accounts for a lots of things?

While some things needs to be shared, like some keys, most accounts should never be shared (unless you can't have more than one on some devices), and recovery ones should be stored separately.

But here the problem was in the first three letters "fin" - Excel is the only database they understand.