The source code used in smart car components designed by Mercedes-Benz has been found exposed online via a misconfigured Git registration system.

Discovered by software engineer Till Kottmann and first reported today by ZDNet, the source code was found on a Git web portal belonging to Mercedes-Benz’s parent company Daimler AG. Kottman was able to freely register an account on the portal, then download 580 Git repositories that included the source code belonging to Mercedes vans.

The repository itself was found via Google search. Kottmann said he often hunts for interesting GitLab instances and was lucky to stumble across this one.

Although the data primarily included information relating to the smart car component, further analysis also found passwords and application programming interface tokens for Daimler’s internal systems. The Git repositories have since been taken offline.

“In this GitLab instance, bad actors could register an account on Daimler’s code-hosting portal and download over 580 Git repositories containing the Mercedes source code and sell that information to the company’s competitors,” Chris DeRamus, vice president of technology, cloud security practice at  security operations firm Rapid7 Inc., told SiliconANGLE. “Additionally, hackers could leverage the exposed passwords and API tokens of Daimler’s systems to access and steal even more of the company’s sensitive information.”

The exposure highlights how developers and security teams must work toward proactively identifying compliance and security issues before cloud resources are deployed, he added. “Instead of primarily relying on runtime security, organizations should ‘shift left’ by taking preventative measures early on in their continuous integration and continuous delivery (CI/CD) pipelines,” he said. “Such a proactive approach will allow organizations to prevent security issues from occurring and will enable security teams to catch misconfigurations before leaks occur.”

Lior Levy, co-founder and chief executive officer of source code management and security firm Cycode Ltd., noted that this shows once again that source code remains a critical unprotected asset in organizations.

“The fact that such a major component’s source code and all the classified corporate data it entails was leaked from an on-premise server, proves the need for a dedicated system protecting it,” Levy said. “The exposed repository, which contained both API tokens and passwords as well as the technical configuration and source code, can be used by attackers for vulnerability research, and for a targeted attack against the corporate infrastructure.”

Photo: Vauxford/Wikimedia Commons