Researcher found unsecured repository of 60,000 documents of sensitive US data on a publicly exposed Amazon Web Services "S3" bucket used by government contractor Booz Allen Hamilton.
Security credentials and password information that could potentially yield access to sensitive Department of Defense military documents were among the 60,000 files found on an unsecured Amazon cloud server used by government contractor Booz Allen Hamilton, according to a Gizmodo report.
UpGuard cyber risk analyst Chris Vickery made the discovery of the unsecured documents, which contained a number of references to the DoD's combat support and intelligence agency US National Geospatial-Intelligence Agency (NGA). No passwords were needed to access the publicly exposed information, according to the report.
Although the NGA stressed that no classified information had been disclosed in the incident, the information could have provided a potential path for attackers to obtain highly sensitive data. An attacker could have found not only passwords to US government systems that store sensitive information, but unencrypted passwords for at least six government contractors who had a high-level of security clearance.
The documents also contained security credentials for a Booz Allen lead senior engineer, which would have provided his private SSH keys, according to the report.
Read more about the NGA incident here.
About the Author(s)
You May Also Like
Securing Code in the Age of AI
April 24, 2024Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024