Hack Notice

Hack Notice: NY Gov

NY Gov

Source
https://techcrunch.com/2021/06/24/an-internal-code-repo-used-by-new-york-states-it-office-was-exposed-online/
Description
An internal code repo used by New York States IT office was exposed online Zack Whittaker@zackwhittaker / 1:00 promethium CDT"June 24, 2021 Comment Governor Cuomo Under fire as he Faces Multiple Sexual Harassment Accusations Image Credits: Matthew Cavanaugh (opens in a new window)/ Getty Images A cypher repository used by the New York state governments IT department was left exposed on the internet, allowing anyone to access the projects inside, some of which contained secret keys and passwords associated with state authorities systems. The exposed GitLab server was discovered on saturday by Dubai-based SpiderSilk, a cybersecurity companion credited with discovering data spills at Samsung, Clearview AI and MoviePass. Organizations usage GitLab to collaboratively develop and stock their seed code  as well as the secret keys, tokens and passwords needed for the projects to act  on servers that they control. But the exposed server was accessible from the internet and configured so that anyone from outside the organization could create a user account and log in unimpeded, SpiderSilks head surety officer Mossab husayn told TechCrunch. When TechCrunch visited the GitLab server, the login varlet showed it was accepting new user accounts. Its not known exactly how long the GitLab server was accessible in this way, but historic records from Shodan, a search engine for exposed devices and databases, shows the GitLab was first detected on the internet on mar 18. SpiderSilk shared several screenshots display that the GitLab server contained secret keys and passwords associated with servers and databases belonging to New York States office of Information Technology Services. Fearing the exposed server could be maliciously accessed or tampered with, the startup asked for help in disclosing the security lapse to the state. TechCrunch alerted the New York governors office to the exposure a short time after the server was found. Several emails to the governors office with details of the exposed GitLab server were opened but were not responded to. The server went offline on Monday afternoon. Scot Reif, a spokesperson for New York States office of info technology Services, said the server was a test box lot up by a vendor, there is no data whatsoever, and it has already been decommissioned by ITS. (Reif declared his response on background and attributable to a nation official, which would command both parties agree to the terms in advance, but we are printing the reply as we were not presumption the opportunity to scorn the terms.) When asked, Reif would not say who the vendor was or if the passwords on the server were changed. Several projects on the server were marked prod, or common shorthand for production, a condition for servers that are actively used. Reif also would not say if the incident was reported to the states Attorney Generals office. When reached, a spokesperson for the attorney General did not comment by press time. TechCrunch understands the vendor is Indotronix-Avani, a New York-based company with offices in India, and owned by venture capital firm Nigama Ventures. Several screenshots present some of the GitLab projects were modified by a project manager at Indotronix-Avani. The vendors website touts New York say on its website, along with other governance customers, including the U.S. state Department and the U.S. department of Defense. Indotronix-Avani spokesperson stain Edmonds did not respond to requests for comment.

About HackNotice and NY Gov

HackNotice is a service that notices trends and patterns in publically available data so as to identify possible data breaches, leaks, hacks, and other data incidents on behalf of our clients. HackNotice monitors data streams related to breaches, leaks, and hacks and NY Gov was reported by one of those streams. HackNotice may also have the breach date, hack date, the hacker responsible, the hacked industry, the hacked location, and any other parts of the hack, breach, or leak that HackNotice can report on for the consumers of our product.

If you are a user of NY Gov their products, services, websites, or applications and you were a client of HackNotice, monitoring for NY Gov you may have been alerted to this report about NY Gov . HackNotice is a service that provides data, information, and monitoring that helps our clients recover from and remediate data breaches, hacks, and leaks of their personal information. HackNotice provides a service that helps our clients know what to do about a hack, breach, or leak of their information.

If NY Gov had a breach of consumer data or a data leak, then there may live additional actions that our clients should take to protect their digital identity. Data breaches, hacks, and leaks often direct to and reason identity theft, account read overs, ransomware, spyware, extortion, and malware. account takeovers are often caused by credential reuse, parole reuse, easily guessed passwords, and are facilitated by the sharing of billions of credentials and other customer information through data leaks, as the direct resultant of data breaches and hacks.

HackNotice monitors trends in publically available data that indicates tens of thousands of data breaches each year, along with billions of records from data leaks each year. On behalf of our clients, HackNotice works to monitor for hacks that leading to depress client surety and digital identities that experience been exposed and should be considered vulnerable to attack. HackNotice workings with clients to identify the extent that digital identities experience been exposed and provides remediation suggestions for how to handle each type of exposure.

HackNotice monitors the hacker community, which is a network of individuals that part data breaches, hacks, leaks, malware, spyware, ransomware, and many other tools that are often used for financial fraud, account make overs, and further breaches and hacks. HackNotice monitors the hacker community specifically for breaches, hacks, and data leaks that offend consumers. HackNotice applies industry specific knowledge and advanced security practices to monitor for trends that indicate breaches, hacks, and exposed digital identities.

HackNotice also enables clients to share hack notices with their friend, family, and collogues to help increment awareness around alleged hacks, breaches, or data leaks. HackNotice works to provide clients with sharable reports to help increment the security of our clients personal network. The security of the people that our clients interact with directly impacts the rase of certificate of our clients. Increased exposure to accounts that have been taken over by hackers leads to further account take overs through phishing, malware, and other attach techniques.

If you found this plug notice to be helpful, then you may be interested in reading some additional plug notices such as:

h an event may be more damaging than the red of the data itself. Those working inside ending of the trust relationship. In distributed systems, this can also occur with a breakdownkely encounter a way into any presumption network. There are two types of companies: those that experience been hacke

Defacement http://dfodang.gov.np

RotoMetrics  Roto-Die Company

Defacement http://msgg.gov.mr/0x48.htm