Post by @masek@infosec.exchange

2025-06-21 13:37 UTC

Analysis This is not a complete failure analysis. This are only my observations. A full detailed analysis is most likely to be even more shocking. Failures: The PC with that kind information should never have been "internet facing" (architecture mistake)The informations do not belong on any file share (organisational mistake)Shares should never allow unauthenticated access (configuration mistake)The information should never have been stored unencrypted (lack of data security)Incoming SMB traffic should never be allowed to such a network (firewall policy mistake).Any such network should include a monitoring of the external attack surface that could easily identify such a leak (lack of posture management, lack of attack surface management).It was out of scope for our involvement, but is very likely that the systems could have been used to compromise any attached networkSUMMARY: A complete and utter failure of IT-Security on the technical and organisational level for that labImpact It can be safely assumed (due to duration and easiness to discover) that all data on those shares is now in the hands of inttelligence services with non-friendly attitude towards the United States of America (e.g. Russia, China) 3/4

Replies (2)

@masek@infosec.exchange 2025-06-21 13:39

Acknowledgments The greatest thanks belong to @JayeLTee@infosec.exchange , who discovered the leak, clearly recognised the severity and started the chain of events that led to the closure of the leak. Special thanks to "Dissent Doe" of DataBreaches.net for reaching out to the Bozeman Police Department, who responded promptly by calling her to get IP addresses and details so they could investigate and follow up. They made contact with the state lab, who notified the police that they had just heard from the vendor and had unplugged everything while they investigated. Thanks to the FBI and Bozeman PD for the prompt and professional contact. Beside them, no official that was contacted reached out. I also wish to thank (in alphabetical order) Abraham, Andy, Ben, Cody, Dhruv, Emma, Frank, Harlo, Jeff, Jerry, JollyOrc, Judie, Royce, Russ and Rysiek for providing assistance. If I omitted someone, I apologise for the oversight. The communication turned into a frenzy on June 17th and some may have escaped the analysis for my PostMortem. Closing Remarks It is clearly necessary that we have at least one public contact in each country that investigates and closes data leaks reported to them. The effort to close even the worst leaks is unbearable and currently rests on the shoulders of security researchers and their supporting environment. Time spent on this leak from my side (without the time for this report) is 12+ hours. My best estimate on the effort of all people involved closing this leak would be in the multiple hundreds of hours. The amount of time spent by the person responsible for the leaking system on security issues: None. I assume the the leak is somehow tied to the DOJ Montana. This is not 100% sure, but i received multiple indicators that they are closely connected the leak. There were more attempts to reach official contacts than documented here in the PostMortem. The list only includes those I could pinpoint with a reasonable degree of certainty. I will not answer questions on how the forensics software works. This is out of scope for me. If you want to keep your phone safe: make it stay in the BFU state most of the time, choose a long and complex PIN, avoid cloud backups and do not install tracking apps. I do not know if the share was writeable for everyone. This is also out of scope. Therefore I cannot say how difficult it would have been to manipulate an investigation. But my guess would be, that at least for a skilled atacker this would seem quite possible. Purpose of the PostMortem is to provide an opportunity to learn for the affected party and those in danger of making similar mistakes. Futhermore I feel responsible to give all the people involved some closure.

Open ##2426780
@babble_endanger@freeradical.zone 2025-06-21 14:41

@masek@infosec.exchange > inttelligence services with non-friendly attitude towards the United States of America (e.g. Russia, China) Russia China and USA

Open ##2426784