iTnews

Insecure server left carmakers' trade secrets wide open

By Juha Saarinen on Jul 23, 2018 4:45AM
Insecure server left carmakers' trade secrets wide open

Exposes 157GB from Tesla, Toyota, GM and others.

A misconfigured data transfer server left sensitive data from big name car makers and their employees wide open to the internet, a security vendor has revealed.

Canada's Level One Robotics, which provides automation services for global companies such as VW, Chrysler, Ford, Toyota, Tesla and ThyssenKrupp, is at the centre of the incident.

The company uses the open source rsync data transfer and synchronisation utility to mirror information across internet-connected servers.

However, researchers at Upguard discovered and made public that Level One's Robotics rsync setup did not limit which clients could access it.

This meant anyone who could connect to the rsync server at Level One Robotics and download the data it stored.

All in all, some 157GB of sensitive information was left exposed by Level One Robotics.

This included customer data such as factory plans, assembly line schematics, robot configurations, identity badge requests and virtual private networking access forms, along with non-disclosure agreements.

Ford Thailand, Toyota Canada, GM, KUKA, Pratt & Whitney, Tesla, and VW Group of America are some of the big name manufacturers whose data was left exposed.

Upguard also found sensitive Level One Robotics data for employees, including scans of passports, driver's licenses and other identification.

Level One Robotics' corporate data was also included in the rsync collection with invoices, price lists, insurance polices and other enterprise business documents stored on the server.

Not only did Level One Robotics not limit access to the rsync server, but it was also configured to allow anyone write to it as well.

This left files stored on the rsync server open to manipulation and alteration.

Upguard said bank account numbers for direct deposits could have been changed in business documents, or malware planted in the files on the server.

The insecure server was discovered by Upguard on July 1, and Level One Robotics closed off access to it on July 10.

Neither Upguard nor Level One Robotics have said how long the rsync server was left exposed, or if there was any unauthorised access to it.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © iTnews.com.au . All rights reserved.
Tags:
gm level one robotics security tesla toyota

Partner Content

Why companies fail at picking cloud modernisation partners
Promoted Content Why companies fail at picking cloud modernisation partners
Setting a path to self-funded mainframe-to-cloud modernisation with Micro Focus
Promoted Content Setting a path to self-funded mainframe-to-cloud modernisation with Micro Focus
What conversations should executives be having about cyber security?
Partner Content What conversations should executives be having about cyber security?
Four data superpowers to harness before 2022
Promoted Content Four data superpowers to harness before 2022

Sponsored Whitepapers

Encryption: Protect your most critical data
Encryption: Protect your most critical data
Overcoming data security challenges in a hybrid, multicloud world
Overcoming data security challenges in a hybrid, multicloud world
Move beyond passwords
Move beyond passwords
The top 5 tech trends to deliver business outcomes
The top 5 tech trends to deliver business outcomes
10 reasons why businesses need to invest in cloud security training
10 reasons why businesses need to invest in cloud security training

Events

  • On-Demand Webinar: How Poly and Microsoft are Embracing Future Work Environments
By Juha Saarinen
Jul 23 2018
4:45AM
0 Comments

Related Articles

  • Researchers hack Tesla keyless entry to steal car
  • Judge narrows Tesla lawsuit against former employee
  • Tesla's Nevada factory was target of 'serious' cyber attack
  • Urgent patches out for exploited Exchange Server zero-days
Share on Twitter Share on Facebook Share on LinkedIn Share on Whatsapp Email A Friend

Most Read Articles

TPG Telecom to start enticing NBN customers to move

TPG Telecom to start enticing NBN customers to move

Infosys scores another $40m for Centrelink payments engine build

Infosys scores another $40m for Centrelink payments engine build

Telstra InfraCo opens up telco's own fibre network

Telstra InfraCo opens up telco's own fibre network

Transport for NSW data stolen in Accellion breach

Transport for NSW data stolen in Accellion breach

You must be a registered member of iTnews to post a comment.
Log In | Register
All rights reserved. This material may not be published, broadcast, rewritten or redistributed in any form without prior authorisation.
Your use of this website constitutes acceptance of nextmedia's Privacy Policy and Terms & Conditions.