Brewer’s Token Gaffe Causes Massive PII Breach

An authentication mistake left the individual info of hundreds of thousands of BrewDog customers and Fairness for Punks shareholders exposed for a 12 months and a 50 percent. 

The gaffe involving an API bearer token was identified by researchers at security consulting and testing company Pen Examination Partners. 

“Each cell app person was provided the same hard-coded API Bearer Token, rendering request authorization useless,” wrote the scientists in a blog post published today.

The slip-up allowed any consumer to accessibility the private identifiable data (PII) belonging to an additional person. Other information uncovered in the incident provided users’ shareholding aspects and bar low cost.

Scientists mentioned that the aspects of around 200,000 shareholders “furthermore numerous far more customers” have been exposed “for about 18 months.”

The token error still left BrewDog susceptible to theft, according to scientists, who noted that shareholders can assert a no cost beer in the 3 days before or soon after their birthday beneath the conditions of the Equity for Punks scheme. 

“One particular would basically obtain an account with the needed day of beginning, create the QR code and the beers are on BrewDog!” wrote the researchers.

Pen Take a look at Companions has criticized BrewDog’s handling of the cybersecurity issue, proclaiming that “disclosure was fairly fraught.”

“Alternatively of getting ‘cool’ as we had hoped, supplied their status as remaining a little bit counter-tradition, BrewDog as an alternative declined to notify their shareholders and requested not to be named,” said Pen Take a look at.

The security consulting organization additional: “It took four failed fixes to appropriately resolve the difficulty.”

Michael Isbitski, technical evangelist at Salt Security, told Infosecurity Journal: “BrewDog all but laid out customers’ personal facts on a silver platter for attackers.”

Isbitski explained that in its place of using the sort of dynamic, expiring authorization tokens ordinarily viewed within a suitable OAuth2 implementation, the brewer employed static authorization tokens, which were being hard coded inside the software source code. 

“Those people static tokens granted obtain to BrewDog’s again-stop APIs, which attackers could simply call straight to extract info,” said Isbitski. 

“Additionally, BrewDog made use of account identifiers which could be easily predicted, creating it a trivial process for an attacker to enumerate by means of person accounts and siphon PII.”

Some parts of this article are sourced from:
www.infosecurity-magazine.com