Sensitive Information of VirusTotal Users Exposed in Data Leak

Globally, security analysts and IT professionals heavily rely on Virustotal, a vast malware database, to scan files for viruses and malware. Even it also enables users to upload suspicious files or links to assess potential threats effectively.

VirusTotal, crucial in the battle against cyberattacks, is utilized by 70 antivirus manufacturers to compare submissions for suspicious code.

VirusTotal’s data breach exposed a subset of registered customers’ names and email addresses when an employee accidentally uploaded the data to the scanning portal of the platform.

Der Spiegel and Der Standard disclosed recently that in June, a small 313KB file unintentionally goes public, containing 5,600 names, including NSA and German secret service employees registered on VirusTotal.

Data Leak

VirusTotal, established in 2004, analyzes suspicious files and URLs for malware using antivirus engines and website scanners. However, Google acquired it in 2012, and in 2018, it became a Google Cloud Chronicle subsidiary.

Google confirmed the leak and acted quickly to remove the data, acknowledging an employee’s accidental distribution of customer group admin emails and organization names on VirusTotal.

Within an hour, Google removed the list and is now examining internal processes and technical controls for future improvements.

The data reveals government employees’ names, some present on LinkedIn, including reluctant ones, which adds importance, given their confidential nature and information access.

The leak impacts Austria’s Federal Ministry of Defense and Interior, including three BSI employees. It also affects German corporations like Deutsche Bahn, Bundesbank, and Dax giants such as:-

• Allianz
• BMW
• Daimler
• Deutsche Telekom

Abusive opportunities

Names and email addresses leaked, but passwords seem unaffected. However, the breach discloses IT security personnel in companies, services, and organizations, creating potential for social engineering and targeted phishing attacks.

The VDMA (The German Association of Mechanical Engineers) accidentally shared a portal link and password via email, visible to all Virustotal users, allowing hackers to access the portal and check for detected and undetected attacks. While the association claims they were unaware of the exposure.

Hackers employ Virustotal to evade antivirus detection for their spy software. While their basic version is free, but, paid options also exist, which enable storing files on their servers. 

Experts suspect secret services use it too, testing attack codes against 70 antivirus manufacturers and tracking hackers who upload their tools.

BSI employee impact is seen as “uncritical,” but for others, risk assessment remains uncertain. Besides this, there is a strong recommendation from BSI to not upload any files to the VirusTotal scanning portal.

Stay up-to-date with the latest Cyber Security News; follow us on GoogleNews, Linkedin, Twitter, and Facebook.