New Verizon data leak, the second one in a few months

Experts at Kromtech Security Research Center discovered a new Verizon leak exposed confidential and sensitive data on internal systems.

It has happened again, security researchers with Kromtech Security Research Center discovered a new Verizon leak exposed confidential and sensitive data on internal systems.

Leaked data includes server logs and credentials for internal systems, the huge trove of documents was found on an unprotected Amazon S3 bucket.

The archive seems to refer to internal Verizon Wireless systems, known as Distributed Vision Services (DVS), that is a middleware system used by the company to deliver data from the back-end systems to the front-end applications used by employees and staff in stores and at call centers.

“On September 20th, Kromtech Security researchers discovered publicly accessible Amazon AWS S3 bucket containing around 100MB of data attributing to internal Verizon Wireless system called DVS (Distributed Vision Services).” states a blog post published by Kromtech.

“DVS is the middleware and centralized environment for all of Verizon Wireless (the cellular arm of VZ) front-end applications, used to retrieve and update the billing data.”

The Amazon cloud storage contained several files, mostly scripts and server logs that included some login credentials to internal systems, some folders contained internal Verizon confidential documents, another folder contained 129 Outlook messages with internal communications within Verizon Wireless domain.

The repository contained:

• Admin user info that could potentially allow access to other parts of the network
• Command notes, logs including
• B2B payment server names and info
• Internal PowerPoints showing VZ infrastructure, with server IPs, marked as “Verizon Wireless Confidential and Proprietary information”
• Global router hosts
• 129 saved Outlook messages with access info and internal communications

Although no customers data are involved in this data leak, some scripts could be used by an attacker to elevate privileges within the internal systems and access them.

Some documents, marked as “confidential and proprietary materials,” include detailed information on the internal infrastructure, including server IP addresses and global router hosts.

It’s not clear why the confidential documents were exposed on a public server.

According to ZDNet, the unprotected Amazon S3 storage server was controlled by an employee that told ZDNet on the phone Thursday that the files were “not confidential,” he also added that Verizon was fully aware of the server’s existence.

After the data leak was publicly disclosed, the server was shut down.

This is the third incident suffered by Verizon in the last two years, in March 2016, hackers reportedly stole the records of 1.5 million customers in July 2017 which were offered for sale in the criminal underground, in July 2017 data belonging to 14 million U.S.-based Verizon customers have been exposed on an unprotected AWS Server by a partner of the telecommunications company.

A Verizon spokesperson confirmed that the company is “aware” of the incident.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Verizon, data leak)

[adrotate banner=”13″]