\n<\/p>\n
For the past year, security researchers have been urging the global shipping industry to shore up their cyber defenses after a spate of cargo thefts were linked to hackers. The researchers say they have seen elaborate hacks targeting logistics companies to hijack and redirect large amounts of their customers\u2019 products into the hands of criminals, in what has become an alarming collusion between hackers and real-life organized crime gangs.\u00a0<\/p>\n
A delivery truck of stolen vapes<\/a> here, a suspected lobster heist<\/a> there.<\/p>\n One little-known and critical U.S. shipping tech company has spent the last few months patching its own systems following the discovery of a raft of simple vulnerabilities, which inadvertently left the doors to its shipping platform wide open to anyone on the internet.<\/p>\n The company is Bluspark Global, a New York-based firm whose shipping and supply chain platform, Bluvoyix, allows hundreds of big companies to transport their products and track their cargo as it travels across the globe. While Bluspark may not be a household name, the company helps to power a large slice of worldwide freight shipments, including retail giants, grocery stores, furniture makers, and more. The company\u2019s software is also used by several other companies affiliated with Bluspark.<\/p>\n Bluspark told TechCrunch this week that its security issues are now resolved. The company fixed five flaws in its platform, including the use of plaintext passwords by employees and customers, and the ability to remotely access and interact with Bluvoyix\u2019s shipping software. The flaws exposed access to all of the customer\u2019s data, including their shipment records, dating back decades.\u00a0<\/p>\n But for security researcher Eaton Zveare, who uncovered the vulnerabilities in Bluspark\u2019s systems back in October, alerting the company to the security flaws took longer than the discovery of the bugs themselves \u2014 since Bluspark had no discernable way to contact it.<\/p>\n In a now-published blog post<\/a>, Zveare said he submitted details of the five flaws in Bluspark\u2019s platform to the Maritime Hacking Village<\/a>, a nonprofit that works to secure maritime space and, as with this case, helps researchers to notify companies working in the maritime industry of active security flaws.\u00a0<\/p>\n Weeks later, and following multiple emails, voicemails, and LinkedIn messages, the company had not responded to Zveare. All the while, the flaws could still be exploited by anyone on the internet.<\/p>\n As a last resort, Zveare contacted TechCrunch in an effort to get the issues flagged.\u00a0<\/p>\n TechCrunch sent emails to Bluspark CEO Ken O\u2019Brien and the company\u2019s senior leadership alerting them to a security lapse, but did not receive a response. TechCrunch later emailed a Bluspark customer, a U.S. publicly traded retail company, to alert them of the upstream security lapse, but we also did not hear back.<\/p>\n On the third time TechCrunch emailed Bluspark\u2019s CEO, we included a partial copy of his password to demonstrate the seriousness of the security lapse.<\/p>\n A couple of hours later, TechCrunch received a response \u2014 from a law firm representing Bluspark.\u00a0<\/p>\n In his blog post, Zveare explained he initially discovered the vulnerabilities after visiting the website of a Bluspark customer.<\/p>\n Zveare wrote that the customer\u2019s website had a contact form that allowed prospective customers to make inquiries. By viewing the web page source code with his browser\u2019s built-in tools, Zveare noticed the form would send the customer\u2019s message through Bluspark\u2019s servers via its API. (An API allows two or more connected systems to communicate with each other over the internet; in this case, a website contact form and the Bluspark customer\u2019s inbox.)<\/p>\n Since the email-sending code was embedded in the web page itself, this meant it was possible for anyone to modify the code and abuse this form to send malicious emails<\/a>, such as phishing lures, originating from a real Bluspark customer.<\/p>\n Zveare pasted the API\u2019s web address into his browser, which loaded a page containing the API\u2019s auto-generated documentation. This web page was a master list<\/a> of all the actions that can be performed with the company\u2019s API, such as requesting a list of users who have access to Bluspark\u2019s platforms, as well as creating new user accounts.<\/p>\n The API documentation page also had a feature allowing anyone the ability to \u201ctest\u201d the API by submitting commands to retrieve data from Bluspark\u2019s servers as a logged-in user.\u00a0<\/p>\n Zveare found that the API, despite the page claiming that it required authentication to use, did not need a password<\/a> or any credentials to return sensitive information from Bluspark\u2019s servers.<\/p>\n Using only the list of API commands, Zveare was able to retrieve reams of user account records of employees and customers who use Bluspark\u2019s platform, entirely unauthenticated. This included usernames and passwords, which were visible in plaintext<\/a> and not encrypted \u2014 including an account associated with the platform\u2019s administrator.<\/p>\n With the admin\u2019s username and password in hand, an attacker could have logged into this account and run amok. As a good-faith security researcher, Zveare could not use the credentials, as using someone else\u2019s password without their permission is unlawful.\u00a0<\/p>\nPlaintext passwords and an unauthenticated API<\/h2>\n