Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

8/27/2019
05:00 PM
100%
0%

Imperva Customer Database Exposed

A subset of customers for the company's Incapsula web application firewall had their email addresses, hashed/salted passwords, and more open to unauthorized access, Imperva announced.

Imperva has announced that the cloud web application firewall product formerly called Incapsula suffered a data exposure that allowed unauthorized access to customer data. The company said that a third party informed it on August 20 of the exposure, which affets customers who had Incapsula accounts through September 15, 2017.

According to the notice posted on the CEO's blog, a subset of Incapsula customers had email addresses, hashed and salted passwords, API keys, and customer-provided SSL certificates exposed. The blog post notes that the company is taking a variety of actions addressing the exposure, from engaging forensics experts and informing affected customers to forcing password rotations.

For more, read here.

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "'Culture Eats Policy for Breakfast': Rethinking Security Awareness Training."

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Alexix
50%
50%
Alexix,
User Rank: Apprentice
9/3/2019 | 12:18:59 PM
Re: More of the same
your are right
tdsan
100%
0%
tdsan,
User Rank: Ninja
8/29/2019 | 2:29:54 PM
Re: More of the same
Also, the question you have to ask has anyone placed a payload or have they identified any malware communicating back to "command and control" location.

Someone needs to really look into the problem because I am quite sure this is not the end of it.

T
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:57:34 PM
Re: More of the same
"the keys have to be regenerated, patches have to be applied, sometimes, users apply the same key so it is going to be interesting how this all plays out."

Yes unless they have been regenerated already they are still at risk even if patch is applied.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:56:00 PM
Re: More of the same
"but the API keys and SSL certificates, now this is some serious stuff,"

I agree with this, passwords are hashed, what about APIs, SSL/TLS as they are more serious.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:54:00 PM
Re: More of the same
" data breach did not occur 2017 but only exposed data back to that date."

That is true, accounts since Sept 15th 2017. Most likely they were using different system prior to that, or that is when they started the business. :--))

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:51:47 PM
Re: Similar Exposure for Cap One?
"I wonder if the vulnerability in the Capital One WAF that led to their breach has any cross correlation with this exposure?"

I say, it is a good question to ask, obviously.

 

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/29/2019 | 1:50:57 PM
data exposured vs hacked

Not clear, this this data exposed by itself or hacked? Or, we are looking at another human mistake?

 

RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/29/2019 | 12:00:27 PM
Similar Exposure for Cap One?
I wonder if the vulnerability in the Capital One WAF that led to their breach has any cross correlation with this exposure?
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
8/28/2019 | 10:23:50 AM
Re: More of the same
I read the article in error - data breach did not occur 2017 but only exposed data back to that date.  My apologies.
tdsan
50%
50%
tdsan,
User Rank: Ninja
8/28/2019 | 8:53:38 AM
Re: More of the same
  • On August 20, 2019, we learned from a third party of a data exposure that impacts a subset of customers of our Cloud WAF product who had accounts through September 15, 2017.
  • Elements of our Incapsula customer database through September 15, 2017, were exposed. These included:
    • email addresses
    • hashed and salted passwords

And for a subset of the Incapsula customers through September 15, 2017:
    • API keys
    • customer-provided SSL certificates

 @Reisen1955 - I am inclined to agree with you, but again. I am not so concerned with the passwords and email addresses, but the API keys and SSL certificates, now this is some serious stuff, the keys have to be regenerated, patches have to be applied, sometimes, users apply the same key so it is going to be interesting how this all plays out.

One thing, since this took place in 2017, how do you account for the damage done to customers within the last two years, that could go into the hundreds of millions.

T
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Intel Issues Fix for 'Plundervolt' SGX Flaw
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5252
PUBLISHED: 2019-12-14
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
CVE-2019-5235
PUBLISHED: 2019-12-14
Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
CVE-2019-5264
PUBLISHED: 2019-12-13
There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition...
CVE-2019-5277
PUBLISHED: 2019-12-13
Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.
CVE-2019-5254
PUBLISHED: 2019-12-13
Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have an out-of-bounds read vulnerability. An attacker who logs in to the board m...