Out In The Open: Corporate Secrets Exposed Through Misconfigured Services

For organizations dealing with proprietary information or assets, one of the greatest concerns is the threat of competitors getting hold of trade secrets. But what if organizations are already leaving their precious Intellectual Property (IP) publicly exposed, within easy reach of attackers?

Our latest research report, “Too Much Information”, highlights the sheer scale of this occurrence. The reality is that a lot of organizations are giving up this information freely, by unintentionally exposing IP through Amazon S3 buckets, rsync, SMB, FTP, NAS drives, and misconfigured websites.

Would you like any secret source with that?

Among the 1.5 billion files we found exposed through these services were over 95,000 examples of source code information, 900 patent applications, and 69 copyright applications.

Figure 1: Types of publicly-available intellectual property

In one instance, we detected a document containing proprietary source code that was submitted as part of a copyright application (Figure 2). The file included code that outlined the workflow and design of a site providing Electronic Medical Records, all of which was uploaded onto a publicly accessible Amazon S3 bucket.

Figure 2: Introductory page for copyright application containing source code for a company’s app

In another example, we came across an archive of patent summaries for a renewable energy technology company (Figure 3). These documents were marked as “strictly confidential” and contained a copious selection of patent applications complete with detailed labelled diagrams, patent application numbers, filing dates and patent descriptions that discussed the advantages and disadvantages of their product.

Figure 3: Redacted page from patent documents belonging to renewable energy company 

Corporate espionage made easy

Of all the data organizations look to control, IP is among the most precious. Loss of IP can have a number of considerable impacts:

• Financial loss. There are obvious economic consequences to losing your most sensitive IP. First there’s the actual costs associated with dealing with the security incident. Resources will have to be assigned to investigate how the exposure occurred, improving security measures, and dealing with the PR response. Perhaps, more damagingly, the release of product information ahead of schedule can seriously damage an organization’s financial performance. For technology companies, the source code your developers have spent months putting together could suddenly be released by malicious actors ahead of schedule, seriously dampening your sales prospects. For some companies, this could put their future in grave jeopardy.
• Competitive de-positioning. Imagine a pharmaceutical company that has spent years researching a new drug; all that time and financial input would go to waste if a competitor on the other side of the world now had all the information needed to put that drug into production. Proprietary code, patent applications and copyright information would give your closest business rivals some very timely and useful competitive intelligence.
• Reputational damage. Loss of IP might cost you customers and contracts, credit ratings, stock market value or brand reputation. No organization wants to be known as a company that can’t keep its own source code under wraps. If companies can’t be trusted to protect their most prized assets, then customers will likely assume that their overall approach to data protection, including protecting personal data, is also lacking.
• National security risk. Certain industries such as defense, manufacturing and national infrastructure worry of being caught in the midst of great power struggles between states. Nation state or state-affiliated actors conduct espionage campaigns to steal information that can improve a country’s military, market or export trade position. The stakes for properly securing sensitive assets are therefore far higher in certain industries, and extend beyond the immediate concerns of the particular organization involved.

While organizations may worry about corporate espionage conducted through insiders, network intrusions and phishing campaigns, these findings demonstrate that there is already a large amount of sensitive data publicly available. Talk about making the competition’s job even easier.

To learn more about the other types of sensitive data that these services are exposing, download a copy of our report.

Want more Digital Shadows (now ReliaQuest) research? Subscribe to our threat intelligence emails here.