Mozilla Exposes Email Addresses of 76,000 Developers and 4,000 Password Hashes

 Mozilla, the foundation behind the popular Firefox Web Browser, warned on Friday that it had mistakenly exposed information on almost 80,000 members of its Mozilla Developer Network (MDN) as a result of a botched data sanitization process.

The discovery was made around June 22 by one of Mozilla’s Web developers, Stormy Peter, Director of Developer Relations at Mozilla, said in a security advisory posted to the Mozilla Security Blog on Friday.

“Starting on about June 23, for a period of 30 days, a data sanitization process of the Mozilla Developer Network (MDN) site database had been failing, resulting in the accidental disclosure of MDN email addresses of about 76,000 users and encrypted passwords of about 4,000 users on a publicly accessible server,” Peter wrote.

While the data was exposed to the public, it doesn’t necessarily mean that anyone with malicious intentions had discovered it before being cleaned up, and according to Peter, Mozilla hasn’t seen any malicious activity the server, but noted they can’t rule it out.

According to Peter, the encrypted passwords were salted hashes and they by themselves cannot currently be used to authenticate with the MDN. However, Peter warned that MDN users may be at risk if they reused their original MDN passwords on other non-Mozilla websites or authentication systems. Peter further clarified in comments on the blog that the exposed passwords included salts that were unique to each user record.

Mozilla sent notices to those affected, and suggested that for those that had both email and password information exposed, change any similar passwords they may be using.

In typical breach disclosure fashion, Peter explained that Mozilla was examining how the “processes and principles that are in place” could be made better to reduce the likelihood that a similar incident could happen again.

Tags:

• NEWS & INDUSTRY
• Incident Management
• Data Protection

Researchers at Rapid7 have uncovered information disclosure issues in SNMP [Simple Network Management Protocol] on embedded devices that could cause them to leak authentication data.

The issues were reported last week as part of a talk at CarolinaCon. According to Rapid7‘s Deral Heiland, the problems were discovered in consumer-grade modems and a load balancer. The situation allows authentication data to be swiped by attackers via the read-only public SNMP community string. The problem was uncovered in the following devices: the Brocade ServerIron ADX 1016-2 PREM TrafficWork Version 12.500T40203 application load balancer; the Ambit U10C019 and Ubee DDW3611 series of cable modems; and the Netopia 3347 series of DSL modems.

“While it can certainly be argued that information disclosure vulnerabilities are simple to resolve and largely the result of poor system configuration and deployment practices, the fact remains that these issues can be exploited to gain access to sensitive information,” blogged Heiland, senior security consultant at Rapid7. “In practice, the low-hanging fruit are often picked first. And with that, we have three new disclosures to discuss.”

“The first involves a Brocade load balancer (you might have one of these in your rack),” he noted. “The second and third involve some consumer-grade modems from Ambit (now Ubee) and Netopia (now Motorola). For the modem/routers, you might have one of these at a remote office, warehouse, guest wi-fi network, water treatment plant, etc. They are quite common in office and industrial environments where IT doesn’t have a strong presence. Shodan identifies 229,409 Ambit devices exposed to the internet, and 224,544 of the Netopia devices.”

Heiland uncovered the vulnerabilities with independent security researcher Matthew Kienow.

According to Heiland, the Brocade device stores username and passwords hashes within the SNMP MIB [Management Information Base] tables at the following OID Indexes:

• Username:            1.3.6.1.4.1.1991.1.1.2.9.2.1.1         
• Password hash:    1.3.6.1.4.1.1991.1.1.2.9.2.1.2

“The Brocade ServerIron load balancer has SNMP enabled by default,” he explained. “The community string “public” is configured by default. Unless SNMP is disabled, or the public community string is changed, an attacker can easily extract the passwords hashes for an offline brute force attack.”

The Ambit U10C019 and Ubee DDW3611 series of cable modems store the following information within the SNMP MIB tables at these OID [Object Identifier] Indexes:

 U10c019

• Username:             1.3.6.1.4.1.4684.2.17.1.2.1.1.97.100.109.105.110
• Password:              1.3.6.1.4.1.4684.2.17.1.1.1.2.97.100.109.105.110
• WEP Keys Index:   1.3.6.1.4.1.4684.2.14.2.5.1.2
• WPA PSK:             1.3.6.1.4.1.4491.2.4.1.1.6.2.2.1.5.6
• SSID:                     1.3.6.1.4.1.4684.2.14.1.2.0

DDW3611

• Username:            1.3.6.1.4.1.4491.2.4.1.1.6.1.1.0
• Password:            1.3.6.1.4.1.4491.2.4.1.1.6.1.2.0
• WEP Key Index:   1.3.6.1.4.1.4684.38.2.2.2.1.5.4.2.3.1.2.12
• WPA PSK:           1.3.6.1.4.1.4491.2.4.1.1.6.2.2.1.5.12
• SSID:                  1.3.6.1.4.1.4684.38.2.2.2.1.5.4.1.14.1.3.12

SNMP is not enabled by default on these devices, blogged Heiland. However, a number of cable providers that utilize Ubee devices enable SNMP with the community string of “public” on the uplink side of the cable modem for remote management purposes, which makes it possible in those cases to enumerate this data over the Internet, he explained. 

In the case of the Netopia 3347 series of DSL modems, SNMP is enabled by default with the community string of ‘public’ on the internal interface. These devices store the following information with the SNMP MIB tables at the following OID indexes:

• WEP Keys Index:  1.3.6.1.4.1.304.1.3.1.26.1.15.1.3
• WPA PSK:             1.3.6.1.4.1.304.1.3.1.26.1.9.1.5.1
• SSID:                     1.3.6.1.4.1.304.1.3.1.26.1.9.1.2.1

“The DSL side is not enabled by default, but currently a number of DSL providers that still utilize the Netopia 3347 series devices enable SNMP with community string of public on the uplink side of the DSL for remote management purposes,” he blogged. 

This makes it possible to enumerate this data over the Internet, he explained. The modems that were tested are end-of-life, so it is unlikely that firmware updates will be released to address the defaults, he added.

“Of course, just because something is end-of-life doesn’t mean it disappears from the Internet — causal Shodan browsing attests to that,” he blogged. “Further, we cannot know if these configurations persist in current, supported offerings from the vendors, but you might want to check yours when you get a chance to download Metasploit.”

Tags:

• NEWS & INDUSTRY
• Vulnerabilities