8 ms·
Nissan code leaked after bitbucket repo set-up with defaults admin/admin
- orev 6y agoIt’s absolutely inexcusable that in 2021 we still have apps that come with default credentials like admin/admin. You can yell at users all you want, but history has shown that is not good enough. The blame here at least partially falls on bitbucket for making it so easy to set things up in an insecure way. To all developers reading this: it is YOUR responsibility to do everything you can to prevent your users from shooting themselves in the foot like this.
- Mg6yDfjp5U 6y agoDo you know of any resources describing this as a developer responsibility/best practice? I agree with you, but I'm looking for some independent resource that I can show to Business to convey to them the importance of this. (Most resources I'm finding are only describing the importance of remembering to change the default password, rather than designing a system without a default password to begin with.)
- bob1029 6y agoLook at some practical implementations. E.g. Jenkins CI. When you first install it (the latest versions), it does not use default admin/admin credentials. What it does is produce a random password string that you have to go find on disk to perform the initial setup. At no point could someone without direct access to the machine get in before you are able to lock the door.
- isbvhodnvemrwvn 6y agoWhile this practice is OK, I am not sure if Jenkins with its billions of trivial vulnerabilities in every other plugin is a poster child for security. https://www.jenkins.io/security/advisories/ https://www.jenkins.io/security/advisories/
- JosephRedfern 6y agoWhich is totally irrelevant in the context of this discussion (which is on default passwords).
- tlarkworthy 6y agohttps://hdivsecurity.com/owasp-broken-authentication https://hdivsecurity.com/owasp-broken-authentication "Do not ship or deploy with any default credentials, particularly for admin users." Though I wish OWASP published this guideline too. (they do state this is a top 10 venerability, and the HDIV scanner looks for this to fix)
- ericcholis 6y agoEven routers these days have a random password assigned to them.
- bberenberg 6y agoThere are no default credentials in Bitbucket[0]. An admin manually set these at some point. [0] https://confluence.atlassian.com/bitbucketserver/install-a-bitbucket-server-trial-867192384.html#InstallaBitbucketServertrial-Createyouradministratoraccount https://confluence.atlassian.com/bitbucketserver/install-a-b...
- tiborsaas 6y agoYou can try as hard as you want, but users will always find a way to bypass your precautions and shoot themselves in the foot. There's also a danger that if you try to do this, then your product turns into a UX nightmare.
- orev 6y agoDefaults matter. There’s a huge difference between starting an account with a complex password and then the user intentionally weakens it, vs starting with a weak password with a note saying “pretty please change it”. It’s obvious that some set of users will not change it, so it’s better to start in a default secure state than an insecure one. And yes, sometimes security and UX conflict, and users just need to deal with it.
- gabereiser 6y agoYes but in this case there was no auth and the user setup admin/admin. This was a human.
- tracker1 6y agoI tend to make a default passphrase of "Please change me." and require a password change on first login.
- mattlondon 6y agoUnrelated meta-side-rant: this leak exhibits one of the two types of naming conventions for internal tools that I really dislike: - Unrelated historical/comic book/movie references, e.g. "Project Morpheus" or "X-37" or "Calligua", "Wolverine Project" etc etc. Meaningless. - Things like this Nissan leak where everything is an acronym that is meaningless on its own. TTBA. SSKLR. URA. PIIY. What the hell? Both are awful. Please please please if you are responsible for naming something at your work, please choose something descriptive. E.g. instead of picking something "clever" or "cool" like "Boudicca Project" or "Skylark" or some useless acronym like "CTITT" please call your mundane CRM system something meaningful like "Customer Management Tools" or something understandable without knowing the backstory (e.g. "we called it Team Sofa because it replaced and old CouchDB instance, and everyone used to hangout on our sofa in our office when we did meetings - duh") and easily searchable. Future users and engineers trying to figure things out will thank you.
- adenadel 6y agoI think you make really good points, but I thought that the main reason for using internal names like you describe are so that if the names aren't recognizable if they are used indiscreetly (i.e. to protect projects that are in development from being leaked inadvertently).
- davidrm 6y agoOEMs use codenames because they're often sending/receiving parts to/from external suppliers, e.g. when driveshafts go around random warehouses and logistics companies they have the codenames on the boxes and stickers. they impose the same rules on tier 1 suppliers in order to maintain secrecy and streamline communication, that way everyone is referring to the same project using the same naming convention while preventing incidental leaks
- stretchcat 6y agoThis is how battle tanks came to be known as 'tanks'. At the time, any german spy who overheard the wrong conversation would think the British were talking about containers for holding water.
- deno 6y agoSo how ‘open’-source is that car now? This actually might make Nissan more attractive to some people.
- wizzwizz4 6y agoNot very. The car's core logic doesn't seem to have been affected – which is understandable; I wouldn't trust your average non-specialist to write that kind of software, and this code all looks like it's been written by generalists – if I'm guessing the kinds of project right from their acronym, anyway.
- gcblkjaidfj 6y agoIf you read any write up on reverse engineering cars ECUs you will pray that your car get hacked and opensourced asap. I mean, it will be better and safer coded by amateurs, but it might not pass emissions anymore ;)
- waiseristy 6y agoA car ECU programmed by amateurs will not be better or safer than the one flashed by the OEM.
- livueta 6y agoI dunno about that. I readily acknowledge that cars are a different bucket of fish, but the benefits of open-sourced firmware have been well-established in areas like routers. It's also (hopefully) not a binary choice between OEM firmware and a clean-room from-scratch implementation. If it was I might agree, but the ideal scenario is that the OEM releases the firmware, then community members (okay, whatever, generalists and amateurs) get to fix bugs/do long-term support when the business has moved on. Complimentary rather than adversarial. For instance, even a generalist could throw some static analysis at some code and come up with a bunch of trivial (but useful!) memory correctness fixes or something like that.
- flr03 6y agoShould I be waiting for the usual press communiqué "We were the target of a very complex Cyberattack" from Nissan?
- jessmay 6y agoa highly sophisticated threat actor if you will ...
- throwaway4good 6y agoA state actor. Likely China or Russia.
- YinglingLight 6y agoRussia will always be blamed. Too many financial connections with China and fallout. Solarwinds + China = huge deal. Solarwinds + Russia = nothingburger.
- dzhiurgis 6y agoNorth Korea about to enter EV market...
- encom 6y agoReadable link: https://archive.ph/Q9bKf https://archive.ph/Q9bKf
- dzhiurgis 6y agoPossibly can be best thing for them as they don’t bother to make EV that lasts (failing to heat/cool batteries, but great cars otherwise). Someone might hack something good now lol.
- driverdan 6y agoFrom the screenshot the torrent name is nissan-na-gitdump-EXCONFIDENTIAL. Searching for that lead me to these. I haven't confirmed if they're legit: https://git.rip/exconfidential/nna https://git.rip/exconfidential/nna Torrent: magnet:?xt=urn:btih:36cc1d89f8d5155bb08d05d0ed67a0e861f7b536&dn=nissan-na-gitdump-EXCONFIDENTIAL Torrent tracker: https://newtrackon.com/api/stable?include_ipv6_only_trackers=0 https://newtrackon.com/api/stable?include_ipv6_only_trackers...
- xyst 6y agofyi: should probably download this using a vpn
- paulie_a 6y agoWhy?
- TheDong 6y ago1. copyright infringement Downloading this torrent is willful copyright infringement of nissan's copyrighted code. 2. CFAA If you live in the US, the CFAA is a very poorly worded law that can be abused by a company with over-eager lawyers. Effectively, the law states that it's a crime to "exceed authorized access" of computer systems. It's borderline, but it's possible nissan could take anyone who downloads this data to court claiming that they were not authorized to access the data on the git server, and knowingly downloading that data constitutes a CFAA violation. I don't think it would stand up in court (other than the original hacker who guessed 'admin/admin', which was def a CFAA violation), but I also don't think most of us have enough money to spend on lawyers to defend ourselves.
- jmt_ 6y agoYep, and remember due to the peer-to-peer nature of torrents it's trivial for someone to monitor the IP addresses of the seeds and leeches. This is how people have gotten mean leaders from RIAA for torrenting music for example.
- mikestew 6y agoWhat "defaults"? There's no BitBucket default to make the admin account "admin/admin", someone did this intentionally.
- robotnikman 6y agoWhich makes this even worse
- darth_avocado 6y agoLol I'm more amazed that they have 1 repo, for pretty much everything, than I am that they forgot to change the default passwords. It's a nightmare.
- Stephen304 6y agoApparently it's a whole collection of repos - each .bundle file in the torrent can be expanded with git clone to a full repo according to the readme, there are about 250 bundle files in the torrent.
- darth_avocado 6y agoWell that makes sense. The article indicated otherwise, which made me wonder.
- brianwawok 6y agoMono-repo is not that unusual. Most of google is 1 repo.
- outworlder 6y agoMaybe people will be able to understand why their "Connect" apps are so horrible? On my Leaf I can theoretically send a route to the car. And theoretically check things like state of charge. These might work. Or might not. Random API RNG seems to dictate that.
- mikestew 6y agoTheoretically or not, it was often the case that I could walk to the garage to turn on the heat more quickly than I could using the Nissan app. "Sure", you say, "your garage is probably, what, at most 10-12 meters from where you're sitting? Slow, sure, but not that bad." No, not my garage at home, I was referring to the parking garage two blocks down the street. Which is why, when Nissan offered to do it for free, I had them rip out the GPRS cell radio that wasn't useful anymore when AT&T turned those frequencies off. As parent points out, it wasn't that useful to begin with; not if it's a crap shoot whether it works or not.
- jsight 6y agoI've never understood why they couldn't make more of the process asynchronous with a retry or three. It would make so much of the process more seemless. But these companies do not seem to value user experience in the same way that a software oriented car company (eg, Tesla) does[1]. [1] Yes, I know that this has consequences that are negative for Tesla too.
- that_guy_iain 6y agoSince Nissan and Renault are now one company, we could be seeing Renault code getting leaked soon too since they're 100% sharing code internally even if both Nissan and Renault both have projects to do the exact same thing with completely different suppliers.
- stunt 6y agoDefault passwords and not enforcing strong passwords are bad idea by design. I thought we learned that 10 years ago.
- cosmiccatnap 6y agoI promise this was a newish hire who was given whiteboard softballs and put in charge of what use to be the job of several people as a cost saving measure from management. You get what you pay for people and more importantly you get the people you pay for.
- iridium_core 6y agoTheir production source code has the salt for the encryption algorithm hard coded as the (presumably H1B worker's) name "Amalesh"