United Nations Breach

NHI Mgmt Group

Reporting

Sakura Samurai, following the principles of ethical hacking, carefully avoided accessing or exploiting the sensitive database contents. Instead, they limited their actions to verifying the vulnerabilities they discovered. Their primary focus was to act responsibly and report these security flaws to the United Nations, demonstrating their commitment to ethical practices in cybersecurity.

Lessons Learned

Secure Configuration Management: Protect sensitive files like .git directories and ensure they are not publicly accessible.
Robust Credential Policies: Implement multi-factor authentication, enforce password hygiene, and regularly scan for leaked credentials.
Proactive Vulnerability Testing: Employ ethical hacking programs and automate scans to identify and patch weaknesses before exploitation.
Improve Perimeter Security: Implement robust network segmentation to restrict lateral movement.

Conclusion

The UN data breach highlighted the importance of proactive cybersecurity, that the sensitive information should always be in tight control and that every entity needs to go through security audits. In this way, vulnerabilities like these can be sorted out, and entities such as the UN can protect both their operations and the stakeholders' privacy.

Lateral Movement:

Additional domains, including a subdomain for the UN Environment Programme (UNEP), were scanned.
A publicly accessible .gitcredentials file was discovered, providing access to private GitHub repositories.
These repositories contained:
- Seven database credential pairs.
- Backups of sensitive data, including Personally Identifiable Information (PII) of UN employees.

Overview

The United Nations data breach in January 2021 exposed the shocking reality that even the most high-profile organizations of the world may be blind to some pretty simple but catastrophic cybersecurity oversights. Orchestrated by the ethical hacking group Sakura Samurai, the attack showed how very low-tech, highly effective techniques can leave sensitive global data wide open. This report discusses the mechanics of the breach, the vulnerabilities taken advantage of, and implications for global cybersecurity.

What Happened?

Ethical hackers belonging to Sakura Samurai conducted a structured evaluation of the UN's Vulnerability Disclosure Program by enumerating the domains and assets that were to be assessed for security. The attack was anything but a chance occurrence, the UN systems were targeted with calculated accuracy in keeping with the simple, yet comprehensive, principles of reconnaissance and domain scanning. Intent upon not causing harm, they were out to responsibly expose vulnerabilities, a principle that ensured there would not be any disastrous misuse of the data.

How It Happened?

Reconnaissance - The attack began with scanning the targeted domains under the UN Vulnerability Disclosure Program and Hall of Fame, then the attackers started Fuzzing the URLs, URL Fuzzing is a technique to find hidden files and directories on a web server. They finally discovered an exposed .git repository on a subdomain ilo.org.

Exploitation - The attackers used tools like git-dumper to extract the repository contents and scan for vulnerabilities in the source code, which revealed:

Hardcoded Credentials.
Sensitive internal information.

These credentials allowed access to:

MySQL database.
Internal survey management platform.

Source GitGuardian

Screenshot from database backup containing UN employee PI - Source: GitGuardian