Education and Science Giant Elsevier Left Users' Passwords Exposed Online (vice.com) 43
The world's largest scientific publisher, Elsevier, left a server open to the public internet, exposing user email addresses and passwords. "The impacted users include people from universities and educational institutions from across the world," reports Motherboard. "It's not entirely clear how long the server was exposed or how many accounts were impacted, but it provided a rolling list of passwords as well as password reset links when a user requested to change their login credentials." From the report: "Most users are .edu [educational institute] accounts, either students or teachers," Mossab Hussein, chief security officer at cybersecurity company SpiderSilk who found the issue, told Motherboard in an online chat. "They could be using the same password for their emails, iCloud, etc." Motherboard verified the data exposure by asking Hussein to reset his own password to a specific phrase provided by Motherboard before hand. A few minutes later, the plain text password appeared on the exposed server. Elsevier secured the server after Motherboard approached the company for comment. Hussein also provided Elsevier with details of the security issue.
An Elsevier spokesperson told Motherboard in an emailed statement that "The issue has been remedied. We are still investigating how this happened, but it appears that a server was misconfigured due to human error. We have no indication that any data on the server has been misused. As a precautionary measure, we will also be informing our data protection authority, providing notice to individuals and taking appropriate steps to reset accounts."
An Elsevier spokesperson told Motherboard in an emailed statement that "The issue has been remedied. We are still investigating how this happened, but it appears that a server was misconfigured due to human error. We have no indication that any data on the server has been misused. As a precautionary measure, we will also be informing our data protection authority, providing notice to individuals and taking appropriate steps to reset accounts."
Small wonder (Score:2)
They suck!
Re: (Score:2)
Hey! Small Wonder [wikipedia.org] was rad(ical).
"The hacker blinded me with science!" (Score:1)
https://www.youtube.com/watch?... [youtube.com]
"Education and Science Giant"? (Score:3, Informative)
"Education and Science Giant"? You fucking whores. Try MASSIVE PURVEYOR OF SCIENTIFIC FRAUD [slashdot.org] next time, if you can find your spine and get it working.
Ditto --- great comments! (Score:2)
Passwords still not hashed??? (Score:5, Interesting)
How can any company STILL not be hashing their user's passwords?
Re: (Score:2)
Came here to say the same thing. Why would anyone store passwords???? Isn't that just too well known that you store hashes?
Is there some common CMS that does it that way or something?
Re: (Score:1)
they probably just store it all in Oracle or mysql.
Re: (Score:2)
they probably just store it all in Oracle or mysql.
That's what I do most of the time and it doesn't prevent me from hashing and salting so I am not sure that I understand your point.
Re: (Score:1)
I thought LinkedIn was unbelievably negligent when they were not using salt. But Elsevier doesn't even hash?!?! What is this, 1980?
Logging (Score:2)
IIRC I’ve seen passwords in transcripts of HTTP authentication logged into a big retailers Splunk. It was fixed days after mentioning it.
I guess this was similar with Elsevier‘s Kibana, with the addition of no “user accounts” and “publicly accessible”
I prefer the password management of sci-hub,
Re: (Score:2)
Re: (Score:2)
Because getting hacked works like it does on TV... some kid in a hoodie types really fast, and there's nothing you can do unless you have another kid in a hoodie to type back.
Hashing passwords? Is that some kind of drug thing?
How can you trust anyone... (Score:2)
Re: (Score:2)
lolz you're talking about a place that stores passwords in plain text, they're morons. forget about your advanced concepts being something actionable by them.
Re: (Score:1)
Get a new hobby. Your trolls are mediocre.
Re: (Score:2)
oh you think storing passwords in readable form is fine, and saying that's bad is trolling?
You are the one who is less than mediocre at certain things
Re: (Score:2)
oops, sorry, slashdot suppressed troll and showed you post as reply to me
Elsevier is not a science giant... (Score:3, Insightful)
It's not science at all, is a giant peddler of stolen goods that made a monopoly from public research.
Shouldn't Slashdot Denizens Be Cheering? (Score:1)
This sounds like a mecca of open and free scientific documents.
Re: (Score:2)
Cheering that some dumbass disclosed it instead of helping out the folks at https://sci-hub.tw/ [sci-hub.tw] ?
No, this is a loss for citizen scientists everywhere.
Open Science (Score:1)
Well at least they tried open science for a while. How do we get them to do that permanently?
Well, and arxiv and (Score:2)
Library Genesis don't need passwords, so not really possible to "expose" them.
Re: (Score:2)
Naturally, but let's compare apples to apples. The leaked passwords for Elsevier aren't of authors, but of readers.
Why even store passwords? (Score:3)
Its 2019, why would anyone even be storing passwords in plaintext (or reversible encryption) instead of using password hashes?
another unsecured ELK cluster (Score:3)
From TFA: "The data itself was displayed via Kibana, a popular tool for visualizing and sorting data."
So this is yet another case of an unsecured ELK (Elasticsearch, Logstash, and Kibana) cluster sitting wide open on the public internet. Most likely an AWS managed ES cluster - which have lately become notorious for their terrible security. Terrible because AWS refuses to give a dime to the company that wrote the software and therefore gets no cooperation from them, yet is also too cheap to implement their own security layer.
I've been a reasonably satisfied user of AWS for many years. But I do not hesitate to call the AWS managed Elasticsearch offering a security nightmare. And a social affront to the open source community.
My company recently switched from AWS ES (with a home-rolled security layer) to Elastic Co's managed ES service. Dealing with Elastic's enterprise-y salescreatures is a real pain. But their managed ES service is simultaneously much better and (in some configurations) slightly cheaper than the AWS offering.
Re: (Score:3)
Re: another unsecured ELK cluster (Score:2)
In AWS ES default configuration, any IP that can reach Kibana - the web UI often used by business analysts to explore the data - also has access to ES on its JSON/HTTP API.
That's why AWS ES clusters are so often left wide open. So the business users can access Kibana from wherever. They hope for security by obscurity. No one outside the company knows the URL, so it's "secure".
By itself, AWS ES does not offer any reasonable way to grant access to Kibana without also granting access to ES API. And it provides
Re: (Score:2)
This defect can be mitigated with a proxy that provides authentication and URL filtering.
I strongly suggest setting up a VPN, there are several free packages and it shouldn't take more than a day to set up.
Finally Open Access :) (Score:2)