Opinie o Ey Global Services Poland Wrocław

GoWork nie weryfikuje opinii przed publikacją...

Opinie(726)

Praca i zarobki

Kontakt i przychody

Aktualne oferty pracy w pobliskich miastach

Opinie o firmach w pobliskich miastach

Neo Security

01.11.2025 22:22

Inne

The 4TB time bomb: when EY's cloud went public (and what it taught us) Let's deep dive into cloud misconfigurations, attack surface management, and why responsible disclosure matters 29.10.2025 | 7 min read Cloud security Responsible disclosure Attack Surface Management Here at Neo Security, we don't just "scan." We practice a form of digital cartography. The modern internet isn't a fixed map; it's a constantly shifting, fluid landscape of assets, relationships, and data. Together with our partners, we map it, understand it, and find the parts that organizations have forgotten they own. During one of these recent mapping expeditions, our lead researcher found something that made him stop and double-check his work. Our engineers have real incident response experience. Worked on breaches where attackers found their way in through database files that were briefly exposed. We know the scenario well: a .BAK file leaked for five minutes. An exposure window measured in seconds. That's all it takes. We know what the theoretical looks like when it becomes real. The moment One of our hackers wasn't running a broad, noisy scan. No. Instead, he was doing focused, low-level tooling work: tweaking passive data sources, stepping through raw network traffic. Hours in, staring at output buffers, something caught his attention. A 200 OK... on a HEAD request. For context: a HEAD request is like knocking on a door and asking, "Who's in there, and how big is the room?" You're asking a server for metadata about a file (its size, type, last-modified date) without actually downloading it. It's supposed to be a fast, harmless query. The server's answer was anything but harmless. Content-Length: 4... terabytes? He sat back. Four terabytes. That's not a file. That's a data center. That's the entire collection of the British Library. That's massive. He stared at the screen. The file names looked exactly like SQL Server backup files. His mind went to the obvious: if this is what he thinks it is, it's bad. What is a SQL Server BAK file. Why did he take this seriously? An SQL Server BAK file is a complete database backup. It contains everything: the schema, all the data, stored procedures, and critically, every secret stored in those tables. API keys, session tokens, user credentials, cached authentication tokens, service account passwords. Whatever the application stored in the database. Not just one secret... all the secrets. Finding a 4TB SQL backup exposed to the public internet is like finding the master blueprint and the physical keys to a vault, just sitting there. With a note that says "free to a good home." He'd investigated breaches that started with less. Way less. He once traced an entire ransomware incident back to a single web.config file that leaked a connection string. That was 8 kilobytes. This was four terabytes. The investigation process He Googled the bucket and file specifics. A few unrelated results came up, but nothing clicked immediately. No obvious website. Someone was paying for that Azure subscription though. This was live. Trying to confirm ownership can be hard. He started digging. Company name searches led to business merger documents. In a south-central European language. He fed them through DeepL. The translation revealed the company was acquired in 2020 by a larger entity, but the parent company name wasn't immediately obvious. Then he ran an SOA record lookup. A "Start of Authority" DNS query, basically asking the internet's phonebook "who's really in charge of this domain?" The response came back pointing to an authoritative DNS server: ey.com. That's when everything clicked. His stomach sank. This wasn't some startup. This was Ernst & Young. One of the Big Four accounting firms. Global. Massive. The kind of organization that audits major corporations, handles M&A due diligence for multi-billion euro deals, and has access to financial records that could move markets. But he still had to be sure before reaching out. He couldn't download 4 terabytes, that's not research, that's a felony. So he did what an engineer would do: he downloaded the first thousand bytes. The bottle was half full Most file types have a "signature" in the start of the file, the very first few bytes. It's a digital fingerprint. A PDF starts with %PDF-. A ZIP with PK.... A JPEG with FF D8 FF. An ELF binary with 7F 45 4C 46. These "magic bytes" are how the file command on Unix systems works. It doesn't look at the file extension (which anyone can fake). It looks at the actual bytes. He parsed the magic bytes. sql-server backup. Confirmed. This wasn't encrypted. The file format was unmistakably a database backup. And that meant this was as bad as he thought. He sat back and exhaled. He'd been here before, not personally discovering something this big, but cleaning up after someone else had 🤮

EyExposed

01.11.2025 11:01

Inne

A Dutch cybersecurity outfit says its lead researcher recently stumbled upon a 4TB+ SQL Server backup file belonging to EY exposed to the web, effectively leaking the accounting and consulting megacorp's secrets. Among the BAK file's data were API keys, cached authentication tokens, session tokens, service account passwords, and user credentials, Neo Security's writeup explained. "Finding a 4TB SQL backup exposed to the public internet is like finding the master blueprint and the physical keys to a vault, just sitting there," it said. "With a note that says 'free to a good home.' "[The lead researcher had] investigated breaches that started with less. Way less. He once traced an entire ransomware incident back to a single web.config file that leaked a connection string. That was 8 kilobytes. This was four terabytes." The researcher, who was not named in the company's report, downloaded the first thousand bytes of the file and found that the BAK file was also unencrypted. It became exposed via a classic cloud bucket misconfiguration. Neo Security said the case was reminiscent of a similar breach it saw years ago when investigating a ransomware case. In that case, one of its engineers was caught being lazy during a database migration. Not wanting to deal with extra hassle, they simply set a bucket to public for five minutes, downloaded the full SQL database backup to migrate, and made it private again. But that was enough time for attackers' automated scans to pick up on the exposure. They downloaded the file for themselves, along with trade secrets and credentials. Neo Security said the company went under after issuing the breach notification. The security shop said: "Modern cloud platforms make it trivially easy to export and back up your database. A few clicks, select your database, choose a destination bucket, and you're done. The export happens automatically in the background. "But here's where it gets dangerous: one wrong click, one typo in a bucket name, and suddenly your private data is sitting in a public bucket… It's that easy to accidentally leak terabytes of sensitive data. "The tools are designed for convenience, not security. They assume you know what you're doing. They don't warn you that you just exported your entire customer database to a bucket that's readable by anyone on the internet." It's not clear for how long EY's database was exposed, but usually in these scenarios it's wise to assume the file was compromised at the point of realizing it was exposed. By the time the researcher confirmed their findings, it was the weekend, and it took some frantic cold messaging on LinkedIn to be put through to the company's incident responders. The security firm praised EY's response as professional and effective, and a week later the incident ...

EydataExposure

01.11.2025 10:07

Inne

Ernst & Young, one of the Big Four accounting firms, inadvertently exposed a massive 4-terabyte SQL Server backup file on Microsoft Azure, a configuration error that could have provided attackers with access to sensitive financial records, credentials, and authentication tokens belonging to major corporations. Security researchers from Neo Security discovered the publicly accessible database backup through routine attack surface mapping, highlighting a critical vulnerability in modern cloud infrastructure management. The exposure represents one of the most significant cloud misconfiguration incidents in recent memory. A single 4TB SQL Server backup (.BAK) file contained not just database schemas and stored procedures, but potentially millions of API keys, session tokens, user credentials, cached authentication tokens, and service account passwords. For any organization handling sensitive financial data and corporate intelligence, this represents an existential threat to data security and client confidentiality. The discovery process began with passive reconnaissance. A Neo Security researcher noticed an unusual HTTP response during routine network traffic analysis a HEAD request returned metadata indicating a 4-terabyte file accessible from the public internet. The file naming conventions and magic bytes (the digital fingerprint of file types) immediately confirmed the worst-case scenario: an unencrypted SQL Server database backup sitting openly accessible to anyone with an internet connection. The Verification and Responsible Disclosure Confirming the exposure belonged to EY required meticulous detective work. DNS SOA record lookups ultimately pointed to ey.com, revealing the organization behind the misconfigured Azure storage. Rather than downloading the entire file, which would constitute a felony, the researcher analyzed the first kilobytes to confirm file integrity and format authenticity. The attack surface was unmistakably a complete database backup containing mission-critical data. Neo Security faced the challenging reality of responsible disclosure. With no readily available security contact information and the incident occurring over a weekend, the team conducted cold outreach through LinkedIn, eventually connecting with EY’s security team. The response was exceptional: no defensiveness, no legal threats, just professional incident response. Within one week, EY’s CSIRT had triaged and fully