Elsevier, the company behind scientific journals such as The Lancet, left a server open to the public internet, exposing user email addresses and passwords. The impacted users include people from universities and educational institutions from across the world.
It’s not entirely clear how long the server was exposed or how many accounts were impacted, but it provided a rolling list of passwords as well as password reset links when a user requested to change their login credentials.
Videos by VICE
“Most users are .edu [educational institute] accounts, either students or teachers,” Mossab Hussein, chief security officer at cybersecurity company SpiderSilk who found the issue, told Motherboard in an online chat. “They could be using the same password for their emails, iCloud, etc.”
Elsevier is controversial, after acquiring a number of platforms that distributed academic material for free. Profit-driven Elsevier’s legal threats against other sites that openly host millions of scientific papers have forced them to go into the digital underground, and distribute their material with the protection of the Tor anonymity network. Some universities have boycotted Elsevier.
Got a tip? You can contact this reporter securely on Signal on +44 20 8133 5190, OTR chat on jfcox@jabber.ccc.de, or email joseph.cox@vice.com.
The data itself was displayed via Kibana, a popular tool for visualizing and sorting data.
Motherboard verified the data exposure by asking Hussein to reset his own password to a specific phrase provided by Motherboard before hand. A few minutes later, the plain text password appeared on the exposed server.
Elsevier secured the server after Motherboard approached the company for comment. Hussein also provided Elsevier with details of the security issue.
An Elsevier spokesperson told Motherboard in an emailed statement that “The issue has been remedied. We are still investigating how this happened, but it appears that a server was misconfigured due to human error. We have no indication that any data on the server has been misused. As a precautionary measure, we will also be informing our data protection authority, providing notice to individuals and taking appropriate steps to reset accounts.”
Subscribe to our new cybersecurity podcast, CYBER.
