Wednesday, April 17, 2024

Sensitive Information of VirusTotal Users Exposed in Data Leak

Globally, security analysts and IT professionals heavily rely on Virustotal, a vast malware database, to scan files for viruses and malware. Even it also enables users to upload suspicious files or links to assess potential threats effectively.

VirusTotal, crucial in the battle against cyberattacks, is utilized by 70 antivirus manufacturers to compare submissions for suspicious code.

VirusTotal’s data breach exposed a subset of registered customers’ names and email addresses when an employee accidentally uploaded the data to the scanning portal of the platform.

Der Spiegel and Der Standard disclosed recently that in June, a small 313KB file unintentionally goes public, containing 5,600 names, including NSA and German secret service employees registered on VirusTotal.

Data Leak

VirusTotal, established in 2004, analyzes suspicious files and URLs for malware using antivirus engines and website scanners. However, Google acquired it in 2012, and in 2018, it became a Google Cloud Chronicle subsidiary.

Google confirmed the leak and acted quickly to remove the data, acknowledging an employee’s accidental distribution of customer group admin emails and organization names on VirusTotal.

Within an hour, Google removed the list and is now examining internal processes and technical controls for future improvements.

The data reveals government employees’ names, some present on LinkedIn, including reluctant ones, which adds importance, given their confidential nature and information access.

The leak impacts Austria’s Federal Ministry of Defense and Interior, including three BSI employees. It also affects German corporations like Deutsche Bahn, Bundesbank, and Dax giants such as:-

  • Allianz
  • BMW
  • Daimler
  • Deutsche Telekom

Abusive opportunities

Names and email addresses leaked, but passwords seem unaffected. However, the breach discloses IT security personnel in companies, services, and organizations, creating potential for social engineering and targeted phishing attacks.

The VDMA (The German Association of Mechanical Engineers) accidentally shared a portal link and password via email, visible to all Virustotal users, allowing hackers to access the portal and check for detected and undetected attacks. While the association claims they were unaware of the exposure.

Hackers employ Virustotal to evade antivirus detection for their spy software. While their basic version is free, but, paid options also exist, which enable storing files on their servers. 

Experts suspect secret services use it too, testing attack codes against 70 antivirus manufacturers and tracking hackers who upload their tools.

BSI employee impact is seen as “uncritical,” but for others, risk assessment remains uncertain. Besides this, there is a strong recommendation from BSI to not upload any files to the VirusTotal scanning portal.

Stay up-to-date with the latest Cyber Security News; follow us on GoogleNewsLinkedinTwitterand Facebook.


Latest articles

Xiid SealedTunnel: Unfazed by Yet Another Critical Firewall Vulnerability (CVE-2024-3400)

In the wake of the recent disclosure of a critical vulnerability (CVE-2024-3400) affecting a...

Cerber Linux Ransomware Exploits Atlassian Servers to Take Full Control

Security researchers at Cado Security Labs have uncovered a new variant of the Cerber...

FGVulDet – New Vulnerability Detector to Analyze Source Code

Detecting source code vulnerabilities aims to protect software systems from attacks by identifying inherent...

North Korean Hackers Abuse DMARC To Legitimize Their Emails

DMARC is targeted by hackers as this serves to act as a preventative measure...

L00KUPRU Ransomware Attackers discovered in the wild

A new variant of the Xorist ransomware, dubbed L00KUPRU, has been discovered in the...

Oracle Releases Biggest Security Update in 2024 – 372 Vulnerabilities Are Fixed – Update Now!

Oracle has released its April 2024 Critical Patch Update (CPU), addressing 372 security vulnerabilities...

Outlook Login Panel Themed Phishing Attack Evaded All Antivirus Detections

Cybersecurity researchers have uncovered a new phishing attack that has bypassed all antivirus detections.The...
Tushar Subhra Dutta
Tushar Subhra Dutta
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles