OCR Labs exposes its systems, jeopardizing major banking clients

A digital identification tool used by major banks and government agencies leaked sensitive credentials, putting clients at severe risk.

• London-based OCR Labs is a major provider of digital ID verification tools. Its services are used by companies and financial institutions including BMW, Vodafone, the Australian government, Westpac, ANZ, HSBC, and Virgin Money.
• A misconfiguration of the company’s systems exposed sensitive credentials to the public.
• Data leak affected QBANK, Defence Bank, Bloom Money, Admiral Money, MA Money, and Reed.
• Using leaked data, threat actors could potentially breach banks’ backend infrastructure and consequently the infrastructure of their clients.
• Financial services are the main target for cybercriminals, so the threat for the organizations and their customers is severe.
• Cybernews contacted OCR Labs, and the company fixed the issue.

The Cybernews research team discovered a misconfiguration in the OCR Labs system that exposed sensitive data.

The company is a leading provider of digital ID verification tools, with its IDkit tool being used by major banks, telecoms companies, and governmental agencies. IDKit verifies users by linking their faces to their identity documents.

The discovered data leak impacted financial institutions in Australia – QBANK, mainly used by government agency workers, Defence Bank, catering to the Australian armed forces, and MA Money, a company that focuses on residential mortgages.

The leak also affected Bloom Money and Admiral Money – two financial companies based in the UK, and Reed, which is the UK's top recruitment agency.

Using leaked data, threat actors could potentially breach companies’ backend infrastructure and consequently the infrastructure of their clients. While financial services are the main target for cybercriminals, the threat to the organizations and their customers is severe.

Cybernews reached out to the company, and it fixed the issue.

A treasure trove of credentials

On March 8, 2023, the Cybernews research team discovered a publicly accessible environment file (.env) belonging to idkit.com, owned by OCR Labs.

The file contained database credentials, including host, port, and username, Amazon Web Services (AWS) with Simple Queue Service (SQS) access credentials, application tokens, and various application programming interface (API) keys.

Among the leaked data, researchers found Google and Liveness API keys. Liveness is used in the digital identification process, determining whether the sample belongs to a live person or a fake, thereby preventing spoofing or account-holder impersonation.

The exposure of these keys is particularly dangerous because it potentially allows an attacker to see all the API's data and modify and update related files, pipelines, and workflows.

Researchers also stumbled upon Engine v4 credentials: while they cannot determine the exact impact of this discovery, it is related to the Know Your Customer (KYC) service, which entails verifying a client's identity when opening an account and periodically over time to guard against money laundering. The exposure of its ID and secret can potentially compromise KYC processes.

Financial data at risk

Another piece of sensitive information observed was the API key from Experian, a well-known multinational data analytics and consumer credit reporting company.

Experian collects financial data on individuals to help rate their creditworthiness. Having access to the API might enable the threat actor to access private user data such as credit score, and edit all data associated with the API.

Leaked app URLs, IDs, and tokens could have been used by threat actors to hijack OCR Labs client applications.

The exposure of AWS and SQS access credentials has put OCR Labs clients in danger. Leaking this kind of data opens up the possibility of disrupting the company’s systems operations, hampers its ability to view internal server communication, and potentially enables malicious actors to gain further access to cause harm to customers.

The discovered OAuth endpoint URL and token for business metrics could help malicious actors access private commercial information.

Wide range of attacks

This leak could have caused significant damage if malicious actors used it to take over the application instance, enabling lateral movement with a targeted system.

The environment file could potentially provide threat actors with various attack options. Ransomware deployment, and access to sensitive customer data such as personally identifiable information (PII), deposits, withdrawals, and transfers, are just a few examples of what could be done with the leaked data.

Leaked data could be highly beneficial for phishers and fraudsters who may exploit the opportunity to impersonate brokers or banks and deceive unsuspecting individuals and businesses into transferring money to scammers.

Moreover, the risk of identity theft and establishing fraudulent bank accounts, also known as bank drops, using stolen customer credentials, cannot be overlooked.

OCR Labs’ response

Immediately after Cybernews informed the company about the misconfiguration, it took all the necessary actions to remedy the situation. OCR Labs says it adheres to a vulnerability disclosure program (VDP) framework “to securely accept, triage, and rapidly remediate vulnerabilities.”

Following the framework, the company claims to have notified all impacted clients as part of their response. After an internal investigation, it stated that there was “no risk to the security of our client’s data or any of our other clients.”

“After more than 40 hours of investigation, we discovered that these reports pertained to unused demo and non-production environments and the keys which were discovered by the bots were of offline systems,” said Paul Warren-Tape of OCR Labs.

Cybernews reached out to the affected clients, but at the time of writing has not received their comment yet.

Staying safe

To ensure the security of stored data, Cybernews researchers advise companies to be cautious and avoid storing sensitive information such as login URLs, connection strings, access tokens, and credentials in environment files.

Due to the nature of the data contained in these files, researchers recommend that they be stored in secure and safeguarded folders at all times.

OCR Labs should take necessary precautions, including resetting credentials, passwords, tokens, and API keys. Additionally, the company should create strong, unique passwords that are randomly generated while also restricting database access to ensure that only their owners can read access tokens.

Organizations are encouraged to implement reliable verification procedures to protect clients, for example multi-factor authentication.