Siemens Metaverse Leak

 Was Unaware of Siemens Metaverse, but here an example. Was this connected to ChatGPT use? In SecurityAffairs.    NVIDIA Connection. 

Siemens Metaverse, a virtual space built to mirror real machines, factories, and other highly complex systems, has exposed sensitive data, including the company’s office plans and internet of things (IoT) devices.

While metaverse is no longer a buzzword, amid the sudden popularity of ChatGPT and similar AI tools, those virtual worlds are still here, presenting exciting opportunities for companies, users, and, unfortunately, threat actors.

Siemens, a German multinational with over $71 trillion in revenue and 300,000 employees worldwide, has also jumped on the metaverse bandwagon. In 2022, it partnered with NVidia, an American multinational technology company, to build the industrial metaverse.

Recently, the Cybernews research team has discovered that Siemens Metaverse – a platform that aims to create digital ‘twins’ of its factories and offices – was leaking sensitive information.

If attackers got to the exposed data, it could have had devastating consequences for the company and other big corporations using its services, including ransomware attacks.

Siemens, on the other hand, said it considered the issue to be non-critical and added that it had been mitigated.

Metaverse leak: what we discovered

On March 1, the Cybernews research team discovered an environment file hosted on a metaverse.siemens.com domain. It contained ComfyApp credentials and endpoints. It also discovered Siemens leaking four sets of WordPress users, and three sets of backend and authentication endpoint URLs on different endpoints of the affected systems.

The WordPress sets only exposed user names and avatar pictures, but all four Siemens WordPress-based subdomains were vulnerable to a flaw that WordPress itself fixed in 2017, leaving researchers wondering whether there are more severe vulnerabilities on these sites.

Backend and authentication endpoint URLs, used to verify users before giving them access, could lead to attackers testing them for vulnerabilities and exploiting them.

The most worrying discovery was that of exposed office management platform ComfyApp user credentials. The Siemens-owned app helps with workspace management, meaning it’s hungry for sensitive data including floor plans, information about internet of things (IoT) devices, employee calendars, and interior pictures.

We can’t say for sure how much of the aforementioned data could be accessed using the ComfyApp credentials alone.

Siemens Metaverse

“We sincerely hope that threat actors didn’t discover the leak before Siemens managed to fix it,” said Cybernews researchers. “Having access, they could exfiltrate a treasure trove of sensitive data, given that Siemens manufactures and maintains a lot of technologies and machines used by critical infrastructure.”

The Cybernews team added: “Siemens customers include multi-billion [dollar] companies, handling extremely sensitive data, and attackers would definitely find it very valuable.”

A highly attractive target

So what if someone logs in and takes a peek at your office plans and pictures, even your calendar? Employees are well aware they shouldn’t let a stranger into their office, so why would the rules be any different when it comes to the digital workplace?

“After snooping around the digital office, attackers could simply show up in the physical office as if they’ve worked there for years, knowing all the spaces and being familiar with office devices, such as smart air conditioners. That just makes it easier for attackers to break in,” Cybernews researchers said.

And they won’t break in just to steal a pen. More likely, they’ll plug in an infected USB drive that could eventually even lead to ransomware.

Since the metaverse is built in such a way that it should have up-to-date factory data, attackers could even extract some trade secrets like manufacturing techniques.

“There are a lot of opportunities for threat actors here. But since it’s one of the first cases where the metaverse technologies are used in cases where they can leak sensitive real-world data, it is not very clear what methodologies would be adopted by threat actors to gain the most out of exploiting such issues,” the research team said.

If you want to have more info on Metaverse problems, give a look at the original post here, 

About the author: Jurgita Lapienytė, Chief Editor at CyberNews

The Great Resignation: How to Combat the Knowledge Drain Effect

 Not too different from other kinds of knowledge loss, though accelerated.  Tried many efforts to address this, rarely effective ..... '

The Great Resignation: How to Combat the Knowledge Drain Effect

One of the greatest threats is not only the risk of losing good talent and productivity, but also the valuable knowledge that departing employees take with them.

Kelly Griswold, Chief Operating Officer, Onna  In InformationWeek

The Great Resignation. The Great Reshuffle. The Big Quit. By now you’ve definitely heard of this monumental phenomenon that we are living through, if not experienced it first-hand. The pandemic encouraged a period of reflection that has driven many employees across all industries to explore new possibilities when it comes to their work, and as a result, people are leaving their companies in droves. According to the Labor Department, 4.5 million Americans quit their jobs in November 2021 alone -- a record-breaking month to follow previous record months.

For businesses, perhaps the greatest threat of these mass resignations is not only the risk of losing good talent and productivity, but also the valuable corporate knowledge that those departing employees take with them -- knowledge that may have been developed over years and is central to running to day-to-day operations, informing critical business decisions, or guiding future innovation.

While the Great Resignation may stabilize over time, it’s becoming clear that we’re not returning to the days of long-term employee tenure. It’s time for organizations to accept this new workforce dynamic and come to terms with its inevitable effects, including on corporate knowledge. Those who embrace this change -- acting proactively when it comes to retaining and transferring knowledge -- are the ones who will come out on top.

When developing effective strategies for the preservation, protection and sharing of knowledge, we see two key approaches:

1. Create a culture that embraces, encourages, and rewards knowledge sharing

Though some may argue that highly competitive work environments fuel creativity and productivity, they also implicitly encourage information hoarding. Collaborative environments, on the other hand, not only motivate teams to collectively deliver better results, but also reward individuals for surfacing and exchanging valuable knowledge that may have otherwise remained hidden.

Establishing any kind of company culture certainly takes time, but businesses can use this unique moment in history -- what some are calling the “Great Reset” -- to accelerate the culture change process. Most companies are already embracing new ways of creating community in the virtual office, figuring out how to recognize and support people when they aren’t all together, and tapping into collaboration tools to facilitate remote working. These are all great steppingstones toward a collaborative, knowledge-sharing culture, even when colleagues are apart.... '