Leaving environment files open to the public is one of the simplest mistakes that web admins can make, but it can have disastrous consequences. Despite leaving some of its sensitive credentials exposed, New England Biolabs seems to have dodged a bullet.
On September 18th, the Cybernews research team discovered two publicly hosted environment files (.env) attributed to New England Biolabs (NEB). They included a lot of sensitive information, such as database credentials, login information for the SMTP server, enterprise payment processing information, and others.
Both files were designated for the production environment, meaning they were likely used in real-time scenarios to handle operations in the company’s Canada branch.
If cybercriminals had found those files first, they’d be able to send emails on behalf of the organization, access and exploit sensitive data, and even try to authorize payments.
NEB is a known producer and supplier of recombinant and native enzyme reage nts for life science research. The company, founded in 1974, also provides products and services supporting genome editing, synthetic biology, and next-generation sequencing.
“This leak is very significant. Environment files typically contain sensitive configuration information and credentials. Their exposure is a significant threat to organizations. If cybercriminals discover the environment file first, it puts the organization at risk of unauthorized access to critical data, potential data breaches, data tampering, financial losses, reputational damage, and legal and compliance issues,” Cybernews researchers write.
Keeping crucial .env files secure is essential, as they could be used to compromise services and applications. In 2018, Uber had to pay a high price of $148 million for exposing the personal information of 57 million people worldwide – including driver’s license information – after trying to pay the ransom and keep things quiet. A lesson not worth repeating.
“It is easy to mess up server configuration files, such as .htaccess, and overlook important restrictions. However, administrators should place the .env files in inaccessible directories, typically, the root directory. By default, the file is inaccessible, but after manual setups, updates, configurations, always do check if it stays that way,” researchers advise.
As of October 5th, upon communication with the NEB, the environment files have been secured and are no longer accessible. Cybernews reached out to the NEB but received no comments before publishing this article.ne
Take a look at the original post for CyberNews’s recommendations:
About the author: Ernestas Naprys, Senior Journalist at Cybernews
(SecurityAffairs – hacking, New England Biolabs)