Tobacco Company's Secret Recipes Exposed on Unrestricted File Share

A penetration tester performing a network assessment for a tobacco company stumbled upon a critical security lapse: detailed product recipes, marked 'Confidential,' were left exposed on an internal file share accessible to all employees. The tester, Dahvid Schloss, initially found the company's security posture surprisingly lax, with its Trend Micro antivirus failing to flag his network scanning activities.

Following a suggestion from his senior manager to focus on data that would be highly detrimental if leaked, Schloss began searching for open file shares. He discovered a share that, despite containing sensitive IT and HR records, had no access controls. Within this share, a folder labeled 'confidential' housed files named after product lines, sub-products, and dates, containing precise manufacturing details including chemical percentages and weights.

Schloss identified one file as a "smoking gun" due to its explicit 'Confidential' and 'Do not share' markings. He downloaded the file to document the vulnerability, but his manager instructed him to delete it immediately due to its extreme sensitivity, a decision that later complicated his ability to prove the finding.

The following morning, Schloss reported the vulnerability to the company's security team. To his astonishment, his contact vehemently denied the existence of the files and dismissed the security concern. The security team insisted the recipes Schloss found were not real, despite their clear labeling, naming conventions, and location within a 'confidential' folder.

This denial persisted for approximately a year, during which Schloss was unable to present the downloaded file as evidence because he had been forced to erase it. However, a check towards the end of the engagement revealed that the files had indeed been removed or moved, suggesting the company was aware of their presence and took action after they were discovered.

The incident highlights a severe lack of basic security hygiene, where critical intellectual property was left unprotected on a network share accessible to the entire workforce. The company's subsequent denial of the vulnerability, even when confronted with evidence of its subsequent remediation, further underscores a potentially problematic security culture.

This case serves as a stark reminder for organizations to implement robust access controls on all file shares, especially those containing highly sensitive proprietary information. Regular security audits and a proactive approach to vulnerability management are crucial to prevent such self-inflicted data exposures.