Many people enjoyed this previous post, so I brought you another similar story. The main character of this story is surprisingly Mercedes-Benz. Mercedes-Benz has shown some actions through their official GitHub, such as participating in some open source projects or opening up some level of access.
However, recently, a Mercedes employee’s authentication token was found in a public GitHub repository. This token granted full access to Mercedes’ GitHub Enterprise Server, allowing them to download the company’s source code repository (the entire code source that manages Mercedes-Benz’s entire fleet).
According to Shubham Mittal, who first discovered and reported the breach, the token granted “unrestricted” access to the full source code hosted on Mercedes’ internal GitHub Enterprise Server, which contained sensitive internal information such as intellectual property, connection strings, cloud access keys, schematics, design documents, single sign-on passwords, and API keys.
What’s a bit funny is that Mittal didn’t report this to Mercedes-Benz, but to the press. After finding out about this through a press report, Mercedes-Benz officially announced that they “revoked the API token and immediately removed the public repository,” and admitted that “internal source code was accidentally published to a public GitHub repository.” They also stated that they would be more careful about security in the future.
In fact, in some ways, the only victim seems to be Mercedes-Benz... It's an amazing true story, both from the person who uploaded the main token to Github to the person who discovered it and reported it to the media. Personally, if I were Mittal, I think reporting it to Mercedes-Benz and providing them with security solutions would have been worth more than one Benz. The reason I think this way is because Mittal is the CTO of RedHunt Lab, an IT security solution company. 😂
Subscribe to 'haebom'
📚 Welcome to Haebom's archives. --- I post articles related to IT 💻, economy 💰, and humanities 🎭. If you are curious about my thoughts, perspectives or interests, please subscribe. Would you like to be notified when new articles are posted? 🔔 Yes, that means subscribe. haebom@kakao.com
