Internal database was accessible to the world without passwords, the portal Graham Cluley reports.
If you run a chain of superstores up and down the UK you have to recognise that from time-to-time ne’er-do-wells are likely to steal goods from your shelves.
And so it wouldn’t be a surprise if those stores maintain a database of the names of those people who they have caught stealing products, what was stolen, the value of the good stolen, and which stores they were stolen from.
After all, you might wish to ban people who have stolen from you in the past, or suspect might steal from you in the future, from your premises.
Oh, and one thing is for sure - you certainly would want to make sure that such a database wasn’t itself easy to steal…
Unfortunately, according to security specialists at Ctrlbox, well-known UK household goods and hardware store B&Q has been careless with its database for tracking offenders and thefts - leaving it wide open for anyone on the internet to access.
A database of 70,000 offender and incident logs was only supposed to be accessible internally within B&Q, but was instead exposed for anyone to access.
The offending (ho ho..) data was on an ElasticSearch server - a technology used for powering search functions - and was not protected by a password.
The nature of the data (alleging possible criminal activity and including in some cases people’s names and vehicle details) meant, of course, that it could be considered highly sensitive and could have serious repercussions if it fell into the wrong hands through such sloppiness.
That’s obviously bad. But what makes things worse is the hoops Ctrlbox had to jump through in order to get the data removed from the internet.
Having determined that the breach was related to B&Q by analysing GEOIP information, product codes, and types of goods listed in the exposed data, Ctrlbox’s Lee Johnstone sent a notification to the store’s support team. This was followed a day later by a message to B&Q over Twitter.
Four days after the first notification, Johnstone says that the data was still wide open:
“…clearly they had not got the message and it was becoming clear that B&Q was not going to act on this any time soon, so another message was sent to support who once again assured me that the message had been sent to the right people.”
Johnstone says that after a week he had communicated with three different support staff, but nothing had been done. He even tried messaging B&Q CEO Christian Mazauric on LinkedIn (according to Johnstone, Mazauric read the message, but never replied).
The offending ElasticSearch server only finally went offline two days ago - almost two weeks after B&Q was informed about the problem.
Companies need to act more quickly when informed of serious security breaches. And all staff, even if they don’t have the ability to assess the seriousness of a security issue themselves, need to understand the importance of escalating it to the right team in a prompt fashion.
