"US Physics Laboratory Exposed Documents, Credentials"

A group of security researchers found weaknesses at the Fermilab physics laboratory in the US that could lead to the exposure of documents, proprietary applications, project details, and more. Fermilab is a particle accelerator and physics laboratory in Batavia, Illinois, and is a part of the US Department of Energy (DOE). The lab has remediated the security issues that were unintentionally exposing a lot of information. One database they discovered allowed them to have unauthenticated access to over 5,700 documents and more than 50,000 file entries. They used Amass to enumerate Fermilab's subdomains. They also used dirsearch and Nmap for discovering open ports and enumerating services. These probes revealed multiple entry points. One of the entry points led into the lab's IT ticketing system, which revealed 4,500 trouble tickets. A malicious actor could gather project names, configuration data, and communication information by viewing the ticketing system. The researchers also found that part of a web application exposed names, emails, user IDs, security workgroups, assigned login groups, and documents. It was emphasized that Fermilab's security issues could have made its network and equipment targets for a ransomware attack. This article continues to discuss the discovery of Fermilab's security issues and the lab's quick response to the researchers' findings. 

Data Breach Today reports "US Physics Laboratory Exposed Documents, Credentials"