Sunday , June 16 2024
owasp

OWASP discloses data breach caused by wiki misconfiguration

The nonprofit OWASP warned its members about a possible data breach that could have affected anyone who was a member of the organization from 2006 to 2014.

The foundation released a statement on Friday, saying they found old resumes on an old Wiki server in late February.

ASUS warn serious security vulnerability on 7 routers

ASUS released a new firmware update to fix a vulnerability affecting seven router models, which could be exploited by remote...
Read More
ASUS warn serious security vulnerability on 7 routers

AWS Announced New Malware Detection Tool For S3 Buckets

AWS announced new security features at its re:Inforce conference, such as identity and malware protection services. The cloud giant added...
Read More
AWS Announced New Malware Detection Tool For S3 Buckets

150,000 phones registered under one IMEI number in Bangladesh

A smartphone's IMEI (which stands for International Mobile Equipment Identity) is a unique identifier for each device, similar to a...
Read More
150,000 phones registered under one IMEI number in Bangladesh

CISA Releases Twenty Industrial Control Systems Advisories

CISA released 20 advisories about Industrial Control Systems (ICS) on June 13, 2024. These advisories give important information about security...
Read More
CISA Releases Twenty Industrial Control Systems Advisories

Current web vulnerabilities in Bangladesh across vendor product line

On a report titled "Surge on Web defacement and web application related vulnerabilities targeting Bangladesh" BGD e-GOV CIRT said, web...
Read More
Current web vulnerabilities in Bangladesh across vendor product line

Criminals impersonating CISA’s employees in phone calls

CISA warned that criminals are pretending to be its employees in phone calls in order to trick people into sending...
Read More
Criminals impersonating CISA’s employees in phone calls

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added 2 new vulnerabilities to its catalog of known exploited vulnerabilities, because they have proof that these vulnerabilities are...
Read More
CISA Adds Two Known Exploited Vulnerabilities to Catalog

Microsoft Tuesday fixes 51 flaws, 18 RCEs June 2024 Patch

Microsoft has released updates for 49 security vulnerabilities in its Patch Tuesday update for June. One of the fixes addresses...
Read More
Microsoft Tuesday fixes 51 flaws, 18 RCEs June 2024 Patch

Hackers breached 20,000 FortiGate systems worldwide: MIVD

The Dutch military security service MIVD recently revealed that a cyber espionage campaign, which was initially mentioned in February, managed...
Read More
Hackers breached 20,000 FortiGate systems worldwide: MIVD

Riskiest Connected Devices in 2024: Forescout Report

By 2028, there will be over 25 billion Internet of Things (IoT) devices. Attackers are increasingly targeting various devices, operating systems,...
Read More
Riskiest Connected Devices in 2024: Forescout Report

The organization calls itself the “world’s largest non-profit organization concerned with software security” and has more than 250 chapters around the world with tens of thousands of members.

The OWASP Foundation’s Executive Director, Andrew van der Stock, said around 1,000 resumes were on the server, but he wasn’t sure if there were any duplicates.

Van der Stock believes that only OWASP staff have accessed the server, and it was archived by the Wayback Machine in 2023 but not re-indexed.

“Unfortunately, the log retention policy on the small VPS [Virtual Private Server] it was hosted upon only means we have limited logs, so we don’t think it was widely accessed, but as the misconfiguration dates back to at least 2019 when the VPS was first stood up, we simply don’t know, and as the file system is small, any old data would have been long overwritten even if forensics was possible,” he said.

Van der Stock explained that it was difficult to find the directory with the resumes because it was not indexed separately from the organization’s Wiki installation.

“So in all likelihood, considering that we only just got our first support tickets about it means that it wasn’t widely accessed prior to February 2024,” he said.

OWASP has advised that anyone who was a member between 2006 and 2014 and had submitted a resume should assume their information was compromised.
The organization collected the data during a membership process where applicants had to show connections to the OWASP community. They no longer ask for resumes and use cloud-based security practices to protect member information.

OWASP has addressed the issue by disabling directory browsing, reviewing the web server and MediaWiki configuration for other security problems, completely removing the resumes from the wiki site, and clearing the CloudFlare cache to prevent further access.

“Lastly, we have requested that the information be removed from the Web Archive,” the organization said.

OWASP had to make this issue public because many people who could be affected are no longer members and it’s hard to contact them.

According to OWASP, affected individuals don’t need to do anything because the information has been removed from the internet. However, they should be cautious of possible scam attempts if any of the resume information is still valid.

“We recognize the significance of this breach, especially considering the OWASP Foundation’s emphasis on cybersecurity. We apologize to those affected by the breach and are committed to ensuring that this does not happen again,” the notice said.

“We are reviewing our data retention policies and will be implementing additional security measures to prevent future breaches.”

 

Check Also

Singapore-Based Absolute Telecom Allegedly Hit by Cyberattack

GhostR hacker claimed to hack Absolute Telecom PTE Ltd, a Singapore-based telecom company and stole …

Leave a Reply

Your email address will not be published. Required fields are marked *