NASA employee data exposed for at least three weeks due to misconfigured web app

Names and email addresses accidentally made public in the second major security scare in as many months

Space walk

A misconfigured app exposed NASA employees' personal details including their names and email address, as well as details about ongoing projects within the space agency.

Incorrectly-set permissions within Jira, a piece of web-based software used by organisations to monitor workflow and internal issues, exposed a bulk of internal data for at least three weeks last year, according to security researcher Avinash Jain.

Advertisement - Article continues below

These details could have been accessed by anybody over the internet with just the right URL over at-least a three week period and could have aided an attacker in gaining access to the wider application.

Jain claimed a system administrator may have misunderstood the definition of "all users" and "everyone" when assigning permissions to newly-created dashboards within the app, interpreting these terms to mean everyone within the organisation.

Due to these misconfigured global permissions scheme, the data exposed extended to all NASA employees' names and email addresses, their roles as assigned to projects listed on Jira, as well as current NASA projects and upcoming milestones.

Alongside an issue that allowed members of the public to browse a full list of employees, a separate filter misconfiguration exposed how projects and tasks are categorised within NASA, and who oversees them.

Advertisement
Advertisement - Article continues below

"This will likely not be a complete list of users like the browse users function, but can glean useful information about how usernames are formatted," Jain wrote in his report.

Advertisement - Article continues below

"Additionally, it can give an attacker an idea of what kind of information may be housed within the application and what projects team is working upon along with showing features of different projects."

Jain reported the bug to the NASA Security Operations Centre (SOC) and the US-Computer Emergency Readiness Team (US-CERT) on 3 September 2018 and received word the issue had been resolved three weeks later on 25 September.

He then informed both agencies of his intention to disclose the incident publicly a few weeks later on 9 November.

This is the second major security scare NASA has sustained in recent months after malicious actors breached a server in October last year and stole highly sensitive employee information. There are no suggestions these two incidents are connected.

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now
Advertisement

Recommended

Visit/security/ransomware/356292/university-of-california-gets-fleeced-by-hackers-for-114-million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
Visit/security/cyber-security/356289/australia-announces-135b-investment-in-cybersecurity
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
Visit/cloud/cloud-security/356288/csa-and-issa-form-cybersecurity-partnership
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020
Visit/business/policy-legislation/356215/senators-propose-a-bill-aimed-at-ending-warrant-proof-encryption
Policy & legislation

Senators propose a bill aimed at ending warrant-proof encryption

24 Jun 2020

Most Popular

Visit/mobile/google-android/356373/over-2-dozen-additional-android-apps-found-stealing-user-data
Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020
Visit/laptops/29190/how-to-find-ram-speed-size-and-type
Laptops

How to find RAM speed, size and type

24 Jun 2020
Visit/cloud/356260/the-road-to-recovery
Sponsored

The road to recovery

30 Jun 2020