Various vulnerabilities in Intel’s internal sites allowed unauthorized users to access the personal data of approximately 270,000 employees, more than the company currently employs. Easy-to-circumvent logins and hard-coded login credentials were the weakest links.
Security researcher Eaton Zveare discovered the leaks. The login page for Intel India did not even require actual credentials to download data via the API. Zveare then found three other internal Intel sites where employee information could be obtained. Information about suppliers was also found, which explains why a higher number of employees than Intel’s workforce was exposed to the leak.
From report to solution
The incident spanned a period of more than ten months. The timeline of the responsible disclosure process ran from October 14 last year to yesterday (August 18), when Zveare detailed his findings in a blog post. All findings were reported to Intel through the appropriate channels, and the company has since resolved the vulnerabilities.
Remarkably, no reward was offered for the discoveries. Intel’s bug bounty program excludes internal websites from rewards, despite the seriousness of the findings.
Four gateways to employee data
The leak involved access to various Intel portal sites, including systems for human resources and external partners. Intel India’s business card website was particularly vulnerable due to an easily circumvented company login.
In addition to this internal business card site, Zveare identified three other entry points. The internal portals for “product hierarchy” and “product onboarding” also leaked employee data. SEIMS, an external platform for information exchange between Intel and suppliers about intellectual property, was the fourth route.
The security issues ranged from bypassing Microsoft Azure logins to hardcoded login credentials that were relatively easy to decrypt, the researcher said.
In the end, Zveare received only one email from Intel. The company has since expanded its bug bounty program, but this security researcher cannot benefit from these discoveries.
Read also: Dutch lab reported data breach in cervical cancer test only a month later