New England Biolabs leak sensitive data

Leaving environment files open to the public is one of the simplest mistakes that web admins can make, but it can have disastrous consequences. Despite leaving some of its sensitive credentials exposed, New England Biolabs seems to have dodged a bullet.

On September 18th, the Cybernews research team discovered two publicly hosted environment files (.env) attributed to New England Biolabs (NEB). They included a lot of sensitive information, such as database credentials, login information for the SMTP server, enterprise payment processing information, and others.

Both files were designated for the production environment, meaning they were likely used in real-time scenarios to handle operations in the company’s Canada branch.

If cybercriminals had found those files first, they’d be able to send emails on behalf of the organization, access and exploit sensitive data, and even try to authorize payments.

NEB is a known producer and supplier of recombinant and native enzyme reagents for life science research. The company, founded in 1974, also provides products and services supporting genome editing, synthetic biology, and next-generation sequencing.

“This leak is very significant. Environment files typically contain sensitive configuration information and credentials. Their exposure is a significant threat to organizations. If cybercriminals discover the environment file first, it puts the organization at risk of unauthorized access to critical data, potential data breaches, data tampering, financial losses, reputational damage, and legal and compliance issues,” Cybernews researchers write.

Keeping crucial .env files secure is essential, as they could be used to compromise services and applications. In 2018, Uber had to pay a high price of $148 million for exposing the personal information of 57 million people worldwide – including driver’s license information – after trying to pay the ransom and keep things quiet. A lesson not worth repeating.

“It is easy to mess up server configuration files, such as .htaccess, and overlook important restrictions. However, administrators should place the .env files in inaccessible directories, typically, the root directory. By default, the file is inaccessible, but after manual setups, updates, configurations, always do check if it stays that way,” researchers advise.

As of October 5th, upon communication with the NEB, the environment files have been secured and are no longer accessible. Cybernews reached out to the NEB but received no comments before publishing this article.

What was in the New England Biolabs leak?

Database credentials: Cybercriminals, who managed to gain a foothold in the company’s network, could then read, change, and delete data stored within the database, resulting in data breaches, manipulation, or unauthorized access to sensitive data.
SMTP server and Mail credentials: Attackers can exploit this for sending emails disguised as legitimate company representatives.This could lead to social engineering attacks, malware distribution, or phishing.
Paymetric (enterprise payment processing company) credentials, Secret, and Endpoint: Unauthorized parties could obtain access to the company's payment system, execute unauthorized transactions, modify payment settings, or access sensitive payment data. Exposed endpoints could be leveraged to flood the system or application with traffic, disrupt or block the service for legitimate users, initiate DDoS attacks, disseminate spam, conduct phishing attacks, and other malicious actions.
Root path: Potential attackers could gain knowledge of the architecture, technologies, and directory hierarchy of the underlying system, facilitating the discovery of potential vulnerabilities. They could also try accessing sensitive files by using the exposed root path to launch directory traversal (file path manipulation) attacks.
QUOTE_CRYPT_KEY (likely a variable that holds the specific cryptographic key used by a program), and CIPHER (presumably, a method to perform encryption and decryption): Attackers could try with additional knowledge to exploit the key for decrypting information.

The Cybernews research team recommends that any company with leaked keys and credentials change or reset them immediately. In NEB’s case, that would include database passwords, mail credentials, and Paymetric credentials.

“Conduct regular security assessments and penetration testing to identify vulnerabilities and weaknesses. Put in place rigorous monitoring and logging procedures to identify any unauthorized activity or potential breaches caused by exposed data,” researchers write.

Continuously checking access restrictions, network traffic, and system logs could help reveal any signs of compromise.