Nissan GIT fail, admin/admin (Source code and some marketting data)

[wanderingfool2]

Nissan has had some of their code leaked and some customer data when they setup a GIT server using the most secure username and password ever invented...admin/admin.  Obviously people found it and leaked it.

 

Quotes

Quote

The leak originated from a Git server that was left exposed on the internet with its default username and password combo of admin/admin, Tillie Kottmann, a Swiss-based software engineer, told ZDNet in an interview this week.

Kottmann, who learned of the leak from an anonymous source and analyzed the Nissan data on Monday, said the Git repository contained the source code of:

• Nissan NA Mobile apps
• some parts of the Nissan ASIST diagnostics tool
• the Dealer Business Systems / Dealer Portal
• Nissan internal core mobile library
• Nissan/Infiniti NCAR/ICAR services
• client acquisition and retention tools
• sale / market research tools + data
• various marketing tools
• the vehicle logistics portal
• vehicle connected services / Nissan connect things
• and various other backends and internal tools

 

With the amount of source that was released, I am wondering whether there will be exploits found in the software that might allow for remote access to a vehicle (i.e. unlocking it, or doing other things that the mobile app can do).  It's does get a bit scary that they left so much of their code exposed with the default password.  Then again, it's another great example of how some of the old school car manufactures don't seem to worry as much about security and often lag behind.

 

Sources

https://www.bleepingcomputer.com/news/security/nissan-na-source-code-leaked-due-to-default-admin-admin-credentials/

https://www.zdnet.com/article/nissan-source-code-leaked-online-after-git-repo-misconfiguration/

[StDragon]

3 hours ago, wanderingfool2 said:

Nissan has had some of their code leaked and some customer data when they setup a GIT server using the most secure username and password ever invented...admin/admin.

This is a failure of the software development community. When logging into something for the first time, it should be mandatory that the password be changed. Otherwise "do not pass GO, do not collect $200" . And no, you can't use 12345678, password, Password01, or any of those other silly useless variants that are typically found in a dictionary attack. 

 

 

[wanderingfool2]

1 hour ago, StDragon said:

This is a failure of the software development community. When logging into something for the first time, it should be mandatory that the password be changed. Otherwise "do not pass GO, do not collect $200" . And no, you can't use 12345678, password, Password01, or any of those other silly useless variants that are typically found in a dictionary attack. 

 

 

I agree and disagree.  There does need to be more done in terms of the initial installation, and getting users to set new defaults...but at the same time, that isn't an excuse for a company to host very important information and not change a default password.

[rcmaehl]

Don't worry they'll update it to the most secure password known

Spoiler

hunter2

 

[williamcll]

7 hours ago, StDragon said:

This is a failure of the software development community. When logging into something for the first time, it should be mandatory that the password be changed. Otherwise "do not pass GO, do not collect $200" . And no, you can't use 12345678, password, Password01, or any of those other silly useless variants that are typically found in a dictionary attack. 

 

 

Or like routers, have a random password already set as default.

[Sarra]

13 hours ago, yaboistar said:

remote access to a vehicle?

 

oh, PLEASE. give us a cyberpunk "call your vehicle" button complete with IRL physics glitches

Only if it only costs $100 to completely replace a destroyed vehicle.

[D13H4RD]

Who would win?

 

admin/admin

 

VS

 

username/password

[Fnige]

6 hours ago, rcmaehl said:

Don't worry they'll update it to the most secure password known

  Hide contents

hunter2

 

oh come on theyre more original than that. It would be hunter3

[Master Disaster]

13 hours ago, StDragon said:

This is a failure of the software development community. When logging into something for the first time, it should be mandatory that the password be changed. Otherwise "do not pass GO, do not collect $200" . And no, you can't use 12345678, password, Password01, or any of those other silly useless variants that are typically found in a dictionary attack. 

I'd go even further than that. Default credentials should not be a thing, any device/software that requires a secure login should require the user to create it at the point of installation before working at all.

[RejZoR]

17 hours ago, yaboistar said:

remote access to a vehicle?

 

oh, PLEASE. give us a cyberpunk "call your vehicle" button complete with IRL physics glitches

New BMW i8 summoned straight in your face.