While giving a live demo on “Google Dorking”, security researcher Bright Gameli Mawudor\u00a0stumbled upon a treasure trove of MultiChoice credentials on the open Internet. He reported them to MultiChoice and they have since been taken down.<\/p>\n
Mawudor was a speaker at the recent MyBroadband CyberSec Conference. He is the head of Cyber Security Services at Internet Solutions in Kenya, and the co-founder of AfricaHackOn.<\/p>\n
In an interview with MyBroadband, Mawudor explained how he accidentally uncovered a text file full of MultiChoice credentials on a misconfigured web server in the middle of a live demo.<\/p>\n
He was demonstrating a technique known as Google Dorking \u2014\u00a0where you use Google\u2019s advanced search operators to find information people didn\u2019t think would be searchable on the open Internet.<\/p>\n
One example of this is where people put ripped media on Internet-connected servers, which Google inadvertently crawls and indexes.<\/p>\n
In this case, Mawudor wanted to demonstrate how easy it was to find credentials for streaming services like Netflix and Hulu with a Google search.<\/p>\n
\u201cThen I thought, wait, let me look for DStv.\u201d When Mawudor clicked on the file, he got more than he bargained for.<\/p>\n
\u201cNobody knew what happened,\u201d he said. \u201cI took it off quickly. I didn\u2019t want anybody to see. Later I went to analyse the details.\u201d<\/p>\n
Mawudor said that what he found was very concerning. If he was not an ethical hacker, he could have done a tremendous amount of damage with the information in the file.<\/p>\n
\u201cI would have been able to use those credentials to log into the monitoring of live [sports] matches that were going on, [or] into the VPN and into the internal network.\u201d<\/p>\n
From there, Mawudor said he could have shut down systems, or he could have manipulated live broadcasts if he wanted to.<\/p>\n
When asked what companies can do to try and catch such simple vulnerabilities before an attacker does, Mawudor said that it\u2019s a matter of prioritising security.<\/p>\n
\u201cThing is, security is usually an afterthought,\u201d he said.<\/p>\n
When you develop a system, security needs to be considered while you are designing it.<\/p>\n
\u201cIf you design for security from the outset [\u2026], you\u2019ll be able to see the gaps.\u201d<\/p>\n
You should also make sure that you have a checklist of \u201cdo\u2019s\u201d and \u201cdon’ts” with respect to security.<\/p>\n
Penetration testing is also useful to determine whether the security of your organisation is up to scratch, but Mawudor said that it\u2019s important to remember that such tests are only a snapshot.<\/p>\n
\u201cIt\u2019s like a doctor telling you: \u2018I\u2019ve checked you. You look like you\u2019re sick here and there.\u2019 That is it,\u201d he said.<\/p>\n
Organisations need to go beyond occasional penetration testing and do vulnerability management \u2014\u00a0frequently doing an assessment of all your systems, networks, and appliances to make sure they always screened for the latest vulnerabilities.<\/p>\n
Mawudor said that there are tools available for vulnerability management, and that frequent scans of your environment can be automated.<\/p>\n
In short: Build a cyber strategy for the whole year, set a budget of what you’re willing to spend on all of it every quarter, and execute it.<\/p>\n
While giving a live demo on “Google Dorking”, security researcher Bright Gameli Mawudor\u00a0stumbled upon a treasure trove of MultiChoice credentials on the open Internet.<\/p>\n","protected":false},"author":15,"featured_media":317465,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[24,27],"tags":[60641,85,35,475],"class_list":["post-317419","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-broadcasting","category-security","tag-bright-mawudor","tag-dstv","tag-headline","tag-multichoice"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/317419"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=317419"}],"version-history":[{"count":2,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/317419\/revisions"}],"predecessor-version":[{"id":317687,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/317419\/revisions\/317687"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/317465"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=317419"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=317419"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=317419"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}