Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

8/27/2019
05:00 PM
100%
0%

Imperva Customer Database Exposed

A subset of customers for the company's Incapsula web application firewall had their email addresses, hashed/salted passwords, and more open to unauthorized access, Imperva announced.

Imperva has announced that the cloud web application firewall product formerly called Incapsula suffered a data exposure that allowed unauthorized access to customer data. The company said that a third party informed it on August 20 of the exposure, which affets customers who had Incapsula accounts through September 15, 2017.

According to the notice posted on the CEO's blog, a subset of Incapsula customers had email addresses, hashed and salted passwords, API keys, and customer-provided SSL certificates exposed. The blog post notes that the company is taking a variety of actions addressing the exposure, from engaging forensics experts and informing affected customers to forcing password rotations.

For more, read here.

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "'Culture Eats Policy for Breakfast': Rethinking Security Awareness Training."

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Alexix
50%
50%
Alexix,
User Rank: Apprentice
9/3/2019 | 12:18:59 PM
Re: More of the same
your are right
tdsan
100%
0%
tdsan,
User Rank: Ninja
8/29/2019 | 2:29:54 PM
Re: More of the same
Also, the question you have to ask has anyone placed a payload or have they identified any malware communicating back to "command and control" location.

Someone needs to really look into the problem because I am quite sure this is not the end of it.

T
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:57:34 PM
Re: More of the same
"the keys have to be regenerated, patches have to be applied, sometimes, users apply the same key so it is going to be interesting how this all plays out."

Yes unless they have been regenerated already they are still at risk even if patch is applied.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:56:00 PM
Re: More of the same
"but the API keys and SSL certificates, now this is some serious stuff,"

I agree with this, passwords are hashed, what about APIs, SSL/TLS as they are more serious.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:54:00 PM
Re: More of the same
" data breach did not occur 2017 but only exposed data back to that date."

That is true, accounts since Sept 15th 2017. Most likely they were using different system prior to that, or that is when they started the business. :--))

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:51:47 PM
Re: Similar Exposure for Cap One?
"I wonder if the vulnerability in the Capital One WAF that led to their breach has any cross correlation with this exposure?"

I say, it is a good question to ask, obviously.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:50:57 PM
data exposured vs hacked

Not clear, this this data exposed by itself or hacked? Or, we are looking at another human mistake?

 

RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/29/2019 | 12:00:27 PM
Similar Exposure for Cap One?
I wonder if the vulnerability in the Capital One WAF that led to their breach has any cross correlation with this exposure?
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
8/28/2019 | 10:23:50 AM
Re: More of the same
I read the article in error - data breach did not occur 2017 but only exposed data back to that date.  My apologies.
tdsan
50%
50%
tdsan,
User Rank: Ninja
8/28/2019 | 8:53:38 AM
Re: More of the same
  • On August 20, 2019, we learned from a third party of a data exposure that impacts a subset of customers of our Cloud WAF product who had accounts through September 15, 2017.
  • Elements of our Incapsula customer database through September 15, 2017, were exposed. These included:
    • email addresses
    • hashed and salted passwords

And for a subset of the Incapsula customers through September 15, 2017:
    • API keys
    • customer-provided SSL certificates

 @Reisen1955 - I am inclined to agree with you, but again. I am not so concerned with the passwords and email addresses, but the API keys and SSL certificates, now this is some serious stuff, the keys have to be regenerated, patches have to be applied, sometimes, users apply the same key so it is going to be interesting how this all plays out.

One thing, since this took place in 2017, how do you account for the damage done to customers within the last two years, that could go into the hundreds of millions.

T
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
Architectural Analysis IDs 78 Specific Risks in Machine-Learning Systems
Jai Vijayan, Contributing Writer,  2/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5530
PUBLISHED: 2020-02-18
Cross-site request forgery (CSRF) vulnerability in Easy Property Listings versions prior to 3.4 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVE-2020-1842
PUBLISHED: 2020-02-18
Huawei HEGE-560 version 1.0.1.20(SP2); OSCA-550 and OSCA-550A version 1.0.0.71(SP1); and OSCA-550AX and OSCA-550X version 1.0.0.71(SP2) have an insufficient authentication vulnerability. An attacker can access the device physically and perform specific operations to exploit this vulnerability. Succe...
CVE-2020-8010
PUBLISHED: 2020-02-18
CA Unified Infrastructure Management (Nimsoft/UIM) 9.20 and below contains an improper ACL handling vulnerability in the robot (controller) component. A remote attacker can execute commands, read from, or write to the target system.
CVE-2020-8011
PUBLISHED: 2020-02-18
CA Unified Infrastructure Management (Nimsoft/UIM) 9.20 and below contains a null pointer dereference vulnerability in the robot (controller) component. A remote attacker can crash the Controller service.
CVE-2020-8012
PUBLISHED: 2020-02-18
CA Unified Infrastructure Management (Nimsoft/UIM) 9.20 and below contains a buffer overflow vulnerability in the robot (controller) component. A remote attacker can execute arbitrary code.