FBI: Poorly Secured Tool Allowed Hackers Steal Source Code From Government Agencies And Private Companies

Hackers are always on the move, lurking in the dark to find weak points and security holes inside systems.

It's through these that the malicious actors can infect systems, compromising them, hold them as hostages, or steal data.

And here, the FBI through its Internet Crime Complaint Center (IC3) website has sent out a security alert warning, saying that hackers are abusing misconfigured SonarQube applications to access and steal source code repositories from both U.S. government agencies and private businesses "in the technology, finance, retail, food, eCommerce, and manufacturing sectors."

According to the agency, the intrusions were recorded since at least April 2020.

The alert specifically warns owners of SonarQube, a web-based open-source automatic reviewing tool that detects bugs and security vulnerabilities in source code.

SonarQube apps are installed on web servers and connected to source code hosting systems like GitHub, BitBucket, GitLab accounts, or Azure DevOps systems.

SonarQube
"In August 2020, unknown threat actors leaked internal data from two organizations through a public lifecycle repository tool. The stolen data was sourced from SonarQube instances that used default port settings and admin credentials running on the affected organizations' networks."

"This activity is similar to a previous data leak in July 2020, in which an identified cyber actor exfiltrated proprietary source code from enterprises through poorly secured SonarQube instances and published the exfiltrated source code on a self-hosted public repository."

The reason for this security issue is that, some agencies and companies have left these systems unprotected, by keeping them using their default configuration (on port 9000) with default admin credentials (admin/admin).

It's through the above misconfigurations that the hackers managed to access SonarQube instances, to then connect to their targets' source code repositories, and then steal proprietary or private/sensitive applications from them.

[block:block=87]

For more than many times, cybersecurity researchers warn about the dangers of leaving MongoDB and Elasticsearch databases exposed online without passwords. And apparently, these SonarQube issues have somehow slipped unnoticed.

To mitigate these issues, the FBI suggests SonarQube users to:

  • Change the SonarQube default settings, including changing default administrator username, password, and port (9000).
  • Place SonarQube instances behind a login screen, and check if unauthorized users have accessed the instance.
  • Revoke access to any application programming interface keys or other credentials that were exposed in a SonarQube instance, if feasible.
  • Configure SonarQube instances to sit behind your organization’s firewall and other perimeter defenses to prevent unauthenticated access.