A researcher using Shodan — one of the basic search tools used by those hunting vulnerable systems and servers — found an ElasticSearch database holding more than 134 million rows that had no authentication requirement. The interaction between the researcher, xxdesmus, and the database's owner, Honda Motor Co., highlights the way responsible disclosure is supposed to work and the difficulties that can stand in the way of responsible behavior.

Justin Paine, director of trust and safety at Cloudflare, tweets and blogs under the name "xxdesmus." In his personal blog post on the incident, he writes of finding the open database through a Shodan search on July 4. The database, which appeared to be a catalog of all Honda internal computers, including the laptop computers used by the CEO and other executives, contained information such as machine hostname, MAC address, internal IP, operating system version, which patches had been applied, and the status of Honda's endpoint security software. While the database didn't contain personally identifiable information (PII), Paine says the information could have formed a very complete "road map" for an attacker planning an assault on Honda — an assault that might target PII. 

Paine wanted to alert Honda to the vulnerable database, but it took him two days and a request made through Twitter to finally find someone at Honda who could take action.

Once contact was made, Paine reports the database was secured within about 10 hours. 

Read more here. 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.