An internal code repo used by New York States IT office was exposed online
Zack Whittaker@zackwhittaker / 1:00 promethium CDT"June 24, 2021
Governor Cuomo Under fire as he Faces Multiple Sexual Harassment Accusations
Image Credits: Matthew Cavanaugh (opens in a new window)/ Getty Images
A cypher repository used by the New York state governments IT department was left exposed on the internet, allowing anyone to access the projects inside, some of which contained secret keys and passwords associated with state authorities systems.
The exposed GitLab server was discovered on saturday by Dubai-based SpiderSilk, a cybersecurity companion credited with discovering data spills at Samsung, Clearview AI and MoviePass.
Organizations usage GitLab to collaboratively develop and stock their seed code as well as the secret keys, tokens and passwords needed for the projects to act on servers that they control. But the exposed server was accessible from the internet and configured so that anyone from outside the organization could create a user account and log in unimpeded, SpiderSilks head surety officer Mossab husayn told TechCrunch.
When TechCrunch visited the GitLab server, the login varlet showed it was accepting new user accounts. Its not known exactly how long the GitLab server was accessible in this way, but historic records from Shodan, a search engine for exposed devices and databases, shows the GitLab was first detected on the internet on mar 18.
SpiderSilk shared several screenshots display that the GitLab server contained secret keys and passwords associated with servers and databases belonging to New York States office of Information Technology Services. Fearing the exposed server could be maliciously accessed or tampered with, the startup asked for help in disclosing the security lapse to the state.
TechCrunch alerted the New York governors office to the exposure a short time after the server was found. Several emails to the governors office with details of the exposed GitLab server were opened but were not responded to. The server went offline on Monday afternoon.
Scot Reif, a spokesperson for New York States office of info technology Services, said the server was a test box lot up by a vendor, there is no data whatsoever, and it has already been decommissioned by ITS. (Reif declared his response on background and attributable to a nation official, which would command both parties agree to the terms in advance, but we are printing the reply as we were not presumption the opportunity to scorn the terms.)
When asked, Reif would not say who the vendor was or if the passwords on the server were changed. Several projects on the server were marked prod, or common shorthand for production, a condition for servers that are actively used. Reif also would not say if the incident was reported to the states Attorney Generals office. When reached, a spokesperson for the attorney General did not comment by press time.
TechCrunch understands the vendor is Indotronix-Avani, a New York-based company with offices in India, and owned by venture capital firm Nigama Ventures. Several screenshots present some of the GitLab projects were modified by a project manager at Indotronix-Avani. The vendors website touts New York say on its website, along with other governance customers, including the U.S. state Department and the U.S. department of Defense.
Indotronix-Avani spokesperson stain Edmonds did not respond to requests for comment.