MoveIt Transfer security breach exposes UK telecom watchdog Ofcom and Minnesota Department of Education data.
A security breach at file transfer tool MoveIt has exposed the data of thousands of users, including the UK telecom watchdog Ofcom and the Minnesota Department of Education.
The breach, first reported by The Register, exposed the names, email addresses, and IP addresses of thousands of MoveIt users. In some cases, the breach also exposed sensitive data such as passwords and phone numbers.
MoveIt is a popular file transfer tool used by businesses and individuals. It allows users to transfer files between computers over a network.
The breach is the latest in a string of security problems for MoveIt. In 2022, the company was fined $100,000 by the US Federal Trade Commission for failing to protect user data.
MoveIt has said that it is working to secure the affected systems and that it is notifying affected users. The company has also said that it offers affected users free credit monitoring.
A vulnerability in MoveIt’s software caused the breach. The vulnerability allowed attackers to steal data from MoveIt’s servers.
The exposed data includes the names, email addresses, IP addresses, and sometimes passwords and phone numbers of thousands of MoveIt users.
The breach has affected users worldwide, including the UK telecom watchdog Ofcom and the Minnesota Department of Education.
MoveIt has said that it is working to secure the affected systems and that it is notifying affected users. The company has also said that it offers affected users free credit monitoring.
A further security audit has found critical flaws in MoveIt Transfer. The flaws could allow attackers to steal sensitive data, take control of affected systems, or even launch denial-of-service attacks.
The audit was conducted by security firm Cure53, which found ten vulnerabilities in MoveIt Transfer. The most serious of these flaws is a remote code execution vulnerability that could allow attackers to execute arbitrary code on affected systems. Other vulnerabilities include SQL injection, cross-site scripting, and input validation flaws.
The vulnerabilities in MoveIt Transfer have been patched, but users are urged to update their software as soon as possible. If you are using MoveIt Transfer, you can download the latest version from the MoveIt Transfer website.
Here are some additional details about the vulnerabilities found in MoveIt Transfer:
- Remote code execution vulnerability: This vulnerability allows attackers to execute arbitrary code on affected systems. This could steal sensitive data, take control of affected systems, or even launch denial-of-service attacks.
- SQL injection flaws: These vulnerabilities allow attackers to inject malicious SQL code into MoveIt Transfer, which could be used to steal sensitive data from the database.
- Cross-site scripting flaws: These vulnerabilities allow attackers to inject malicious JavaScript code into MoveIt Transfer, which could be used to steal cookies or other sensitive information from users.
- Input validation flaws: These vulnerabilities allow attackers to bypass input validation checks, which could be used to upload malicious files or execute arbitrary commands.
If you are a MoveIt user, you should take the following steps:
- Change your password for MoveIt and any other online accounts where you use the same password.
- Monitor your credit report for any unauthorised activity.
- Report any suspicious activity to MoveIt immediately.
- Updating your software as soon as possible is crucial to patch these vulnerabilities. You can download the latest version of MoveIt Transfer from the MoveIt Transfer website.
