Hackers stole source code from govt agencies, private firms: FBI

San Francisco: The US Federal Bureau of Investigation (FBI) has issued a security alert saying threat actors have stolen source code from government agencies and private firms and are abusing it to gain access to critical information.

The FBI alert warned the owners of SonarQube, a web-based application that companies integrate into their software build chains to test source code and discover security flaws before rolling out code and applications into production environments.

The actors exploit known configuration vulnerabilities, allowing them to gain access to proprietary code, exfiltrate it and post the data publicly.

The FBI has identified multiple potential computer intrusions that correlate to leaks associated with SonarQube configuration vulnerabilities.

"SonarQube apps are installed on web servers and connected to source code hosting systems like BitBucket, GitHub, or GitLab accounts, or Azure DevOps systems," reports ZDNet.

According to the FBI, some companies have left these systems unprotected, running on their default configuration with default admin credentials.

"In August 2020, unknown threat actors leaked internal data from two organizations through a public lifecycle repository tool. The stolen data was sourced from SonarQube instances that used default port settings and admin credentials running on the affected organizations' networks," the FBI said in the alert.

This activity is similar toa previous data leak in July 2020, in which an identified cyber actor exfiltrated proprietary source code from enterprises through poorly secured SonarQube instances and published the exfiltrated source code on a self-hosted public repository.

The FBI suggested the firms change the SonarQube default settings, including changing default administrator username, password and port (9000).

"Place SonarQube instances behind a login screen, and check if unauthorized users have accessed the instance and revoke access to any application programming interface keys or other credentials that were exposed in a SonarQube instance, if feasible," the agency suggested.