securityaffairs.com Open in urlscan Pro
2606:4700:3031::6815:90b  Public Scan

Form analysis
1 forms found in the DOM

Name: searchform — GET https://securityaffairs.com/

<form role="search" method="get" name="searchform" id="searchform" action="https://securityaffairs.com/">
  <div>
    <input type="text" value="" name="s" id="s" autocomplete="off" title="Search..." class="blur">
    <button type="submit">
      <i class="fa fa-search"></i>
    </button>
  </div>
  <div id="autocomplete"></div>
</form>

Text Content

 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


MUST READ

Headlines
 * OCR Labs exposes its systems, jeopardizing major banking clients
 * Threat Report Portugal: Q3 & Q4 2022
 * Analyzing attacks conducted by North Korea-linked ARCHIPELAGO APT group
 * Nexx bugs allow to open garage doors, and take control of alarms and plugs
 * Tax preparation and e-file service eFile.com compromised to serve malware
 * HP would take up to 90 days to fix a critical bug in some business-grade
   printers



 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


OCR LABS EXPOSES ITS SYSTEMS, JEOPARDIZING MAJOR BANKING CLIENTS

April 6, 2023  By Pierluigi Paganini




A DIGITAL IDENTIFICATION TOOL PROVIDED BY OCR LABS TO MAJOR BANKS AND GOVERNMENT
AGENCIES LEAKED SENSITIVE CREDENTIALS, PUTTING CLIENTS AT SEVERE RISK.

 * London-based OCR Labs is a major provider of digital ID verification tools.
   Its services are used by companies and financial institutions including BMW,
   Vodafone, the Australian government, Westpac, ANZ, HSBC, and Virgin Money.
 * A misconfiguration of the company’s systems exposed sensitive credentials to
   the public.
 * Data leak affected QBANK, Defence Bank, Bloom Money, Admiral Money, MA Money,
   and Reed.
 * Using leaked data, threat actors could potentially breach banks’ backend
   infrastructure and consequently the infrastructure of their clients.
 * Financial services are the main target for cybercriminals, so the threat for
   the organizations and their customers is severe.
 * Cybernews contacted OCR Labs, and the company fixed the issue.

The Cybernews research team discovered a misconfiguration in the OCR Labs system
that exposed sensitive data.

The company is a leading provider of digital ID verification tools, with its
IDkit tool being used by major banks, telecoms companies, and governmental
agencies. IDKit verifies users by linking their faces to their identity
documents.

The discovered data leak impacted financial institutions in Australia – QBANK,
mainly used by government agency workers, Defence Bank, catering to the
Australian armed forces, and MA Money, a company that focuses on residential
mortgages.

The leak also affected Bloom Money and Admiral Money – two financial companies
based in the UK, and Reed, which is the UK’s top recruitment agency.

Using leaked data, threat actors could potentially breach companies’ backend
infrastructure and consequently the infrastructure of their clients. While
financial services are the main target for cybercriminals, the threat to the
organizations and their customers is severe.



Cybernews reached out to the company, and it fixed the issue.

A treasure trove of credentials

On March 8, 2023, the Cybernews research team discovered a publicly accessible
environment file (.env) belonging to idkit.com, owned by OCR Labs.

The file contained database credentials, including host, port, and
username, Amazon Web Services (AWS) with Simple Queue Service (SQS) access
credentials, application tokens, and various application programming interface
(API) keys.

Among the leaked data, researchers found Google and Liveness API keys. Liveness
is used in the digital identification process, determining whether the sample
belongs to a live person or a fake, thereby preventing spoofing or
account-holder impersonation.



The exposure of these keys is particularly dangerous because it potentially
allows an attacker to see all the API’s data and modify and update related
files, pipelines, and workflows.

Researchers also stumbled upon Engine v4 credentials: while they cannot
determine the exact impact of this discovery, it is related to the Know Your
Customer (KYC) service, which entails verifying a client’s identity when opening
an account and periodically over time to guard against money laundering. The
exposure of its ID and secret can potentially compromise KYC processes.

Leaked credentials for Defence Bank | Image by Cybernews

Financial data at risk

Another piece of sensitive information observed was the API key from Experian, a
well-known multinational data analytics and consumer credit reporting company.

Experian collects financial data on individuals to help rate their
creditworthiness. Having access to the API might enable the threat actor to
access private user data such as credit score, and edit all data associated with
the API.



Leaked app URLs, IDs, and tokens could have been used by threat actors to hijack
OCR Labs client applications.

The exposure of AWS and SQS access credentials has put OCR Labs clients in
danger. Leaking this kind of data opens up the possibility of disrupting the
company’s systems operations, hampers its ability to view internal server
communication, and potentially enables malicious actors to gain further access
to cause harm to customers.

The discovered OAuth endpoint URL and token for business metrics could help
malicious actors access private commercial information.

Wide range of attacks

This leak could have caused significant damage if malicious actors used it to
take over the application instance, enabling lateral movement with a targeted
system.

The environment file could potentially provide threat actors with various attack
options. Ransomware deployment, and access to sensitive customer data such as
personally identifiable information (PII), deposits, withdrawals, and transfers,
are just a few examples of what could be done with the leaked data.



Leaked data could be highly beneficial for phishers and fraudsters who may
exploit the opportunity to impersonate brokers or banks and deceive unsuspecting
individuals and businesses into transferring money to scammers.

Moreover, the risk of identity theft and establishing fraudulent bank accounts,
also known as bank drops, using stolen customer credentials, cannot be
overlooked.

OCR Labs’ response

Immediately after Cybernews informed the company about the misconfiguration, it
took all the necessary actions to remedy the situation. OCR Labs says it adheres
to a vulnerability disclosure program (VDP) framework “to securely accept,
triage, and rapidly remediate vulnerabilities.”

Following the framework, the company claims to have notified all impacted
clients as part of their response. After an internal investigation, it stated
that there was “no risk to the security of our client’s data or any of our other
clients.”

“After more than 40 hours of investigation, we discovered that these reports
pertained to unused demo and non-production environments and the keys which were
discovered by the bots were of offline systems,” said Paul Warren-Tape of OCR
Labs.

Cybernews reached out to the affected clients, but at the time of writing has
not received their comment yet.

If you want to read the OCR Labs’ response and how to secure your data give a
look at the original post:



https://cybernews.com/security/ocr-labs-exposes-its-systems/



About the author: Paulina Okunytė, Journalist at cyberNews

Please vote for Security Affairs (https://securityaffairs.com/) as the best
European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections:

 * The Teacher – Most Educational Blog
 * The Entertainer – Most Entertaining Blog
 * The Tech Whizz – Best Technical Blog
 * Best Social Media Account to Follow (@securityaffairs)

Please nominate Security Affairs as your favorite blog.

> > Nominate
> > here: https://docs.google.com/forms/d/e/1FAIpQLSfaFMkrMlrLhOBsRPKdv56Y4HgC88Bcji4V7OCxCm_OmyPoLw/viewform

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, North Korea)




SHARE THIS:

 * Email
 * Twitter
 * Print
 * LinkedIn
 * Facebook
 * More
 * 

 * Tumblr
 * Pocket
 * 


data leakHackinghacking newsinformation security newsIT Information SecurityOCR
LabsPierluigi PaganiniSecurity AffairsSecurity News


--------------------------------------------------------------------------------

SHARE ON

 * 
 * 
 * 
 * 
 * 
 * 
 * 


PIERLUIGI PAGANINI

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and
Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he
is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security
expert with over 20 years experience in the field, he is Certified Ethical
Hacker at EC Council in London. The passion for writing and a strong belief that
security is founded on sharing and awareness led Pierluigi to find the security
blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some
major publications in the field such as Cyber War Zone, ICTTF, Infosec Island,
Infosec Institute, The Hacker News Magazine and for many other Security
magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency
and Bitcoin”.




--------------------------------------------------------------------------------

PREVIOUS ARTICLE

Threat Report Portugal: Q3 & Q4 2022


--------------------------------------------------------------------------------





YOU MIGHT ALSO LIKE


THREAT REPORT PORTUGAL: Q3 & Q4 2022

April 6, 2023  By Pierluigi Paganini

ANALYZING ATTACKS CONDUCTED BY NORTH KOREA-LINKED ARCHIPELAGO APT GROUP

April 6, 2023  By Pierluigi Paganini






 * DIGGING THE DEEP WEB: EXPLORING THE DARK SIDE OF THE WEB


 * CENTER FOR CYBER SECURITY AND INTERNATIONAL RELATIONS STUDIES


 * SUBSCRIBE SECURITY AFFAIRS NEWSLETTER
   
   


 * SECURITYAFFAIRS AWARDED AS BEST EUROPEAN CYBERSECURITY TECH BLOG AT EUROPEAN
   CYBERSECURITY BLOGGER AWARDS




More Story

THREAT REPORT PORTUGAL: Q3 & Q4 2022

The Threat Report Portugal: H2 2022 compiles data collected on the malicious
campaigns that occurred from July to December,...
Copyright 2021 Security Affairs by Pierluigi Paganini All Right Reserved.
Back to top
 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me

We use cookies on our website to give you the most relevant experience by
remembering your preferences and repeat visits. By clicking “Accept All”, you
consent to the use of ALL the cookies. However, you may visit "Cookie Settings"
to provide a controlled consent.
Cookie SettingsAccept All
Manage consent
Close

PRIVACY OVERVIEW

This website uses cookies to improve your experience while you navigate through
the website. Out of these cookies, the cookies that are categorized as necessary
are stored on your browser as they are essential for the working of basic
functionalities...
Necessary
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly.
This category only includes cookies that ensures basic functionalities and
security features of the website. These cookies do not store any personal
information.
Non-necessary
Non-necessary
Any cookies that may not be particularly necessary for the website to function
and is used specifically to collect user personal data via analytics, ads, other
embedded contents are termed as non-necessary cookies. It is mandatory to
procure user consent prior to running these cookies on your website.
SAVE & ACCEPT


Go to mobile version