The company's biggest security hole lived in the breakroom
Connected devices can leave an otherwise secure network vulnerable
Welcome to Pwned, The Register’s new column, where we highlight the worst infosec own goals so you can, hopefully, protect against them. Caffeine is an essential tool for most IT defenders, so, on balance, we’re sure it has protected against a lot more exploits than it has caused. But in this case, the desire for everyone’s favorite stimulant led to a massive breach.
Our story comes to us courtesy of a reader we’ll Regomize as TR, a digital forensics investigator with almost two decades of experience.
He describes a situation where a corporate client called because they thought that their server room had been invaded by a rival after suffering a data breach. Rather than jump to that conclusion, TR and his company spent several days looking for malware and other vulnerabilities on the network. What they found was rather surprising.
It turned out that the leak came not from malicious software, but from an internet-connected coffee machine that was on the client’s secure network. This device could output espresso, but it also came with a default password, an ancient OS, and no firewall.
Related Knowledge Center: Digital privacy and data security
If you’re online, you’re generating a constant stream of information about yourself — sometimes voluntarily, sometimes unwittingly — that is assembled and used to craft your online experience. And generate wealth for data brokers. Meanwhile, designers and managers of the digital infrastructure on which the world depends are engaged in a never-ending effort to thwart attempts, by both criminal enterprises and state actors, to exploit vulnerabilities in those systems.
Signalgate | State surveillance