Latest / Tech Talks With Kinsoft / Non-Production Does Not Mean Non-Critical: The Uni Sydney Hack

Transcript

Non-Production Does Not Mean Non-Critical: The Uni Sydney Hack · Tech Talks With Kinsoft

• 0:00
  Hello and welcome back to Tech Talks with Ken
• 0:01
  Soft. I'm your host. And I have to be honest,
• 0:03
  looking at the stack of reports we have for this
• 0:05
  week, it's been a pretty heavy one. Volatile
• 0:08
  is the right word. Yeah. It really feels like
• 0:11
  a convergence of, I don't know, several different
• 0:13
  storm fronts hitting all at once. Exactly. I
• 0:15
  mean, we're seeing accidental exposure, malicious
• 0:18
  extortion, and critical code vulnerabilities
• 0:20
  all landing in the same, what, seven -day window?
• 0:23
  All at once. And we aren't talking about minor
• 0:26
  glitches here. We're looking at a massive data
• 0:29
  breach at one of our oldest universities, a really
• 0:32
  disturbing ransomware attack on a fertility provider.
• 0:35
  And then this red alert vulnerability in the
• 0:39
  code that powers a huge chunk of the modern web.
• 0:42
  OK, let's unpack this because, you know, it's
• 0:44
  not just about hackers and hoodies. Well, it's
• 0:47
  about the files we forgot we saved. That's exactly
• 0:49
  it. And what stands out to me looking at these
• 0:51
  collectively is that the root causes aren't what
• 0:55
  people expect. We always think about the Mission
• 0:57
  Impossible style hacks. Right. The Hollywood
• 1:00
  version of cybercrime. Precisely. But the theme
• 1:03
  emerging from this week is silent failures. It's
• 1:07
  about the test environments we thought were invisible,
• 1:10
  the bad habits we've let slide because we're
• 1:12
  just too busy. That concept of silent failures
• 1:14
  is really unsettling. It suggests the danger
• 1:17
  is already inside the house. So let's get into
• 1:19
  it. We have to start with the incident that really
• 1:22
  hit the headlines on December 18th, the University
• 1:24
  of Sydney. Yeah, this is a textbook case of what
• 1:27
  we call a non -production failure. Okay, set
• 1:29
  the scene for us. What exactly went wrong? So
• 1:32
  on December 18th, 2025... The university sends
• 1:35
  out a notification about unauthorized access.
• 1:38
  Now, usually you hear university breach. You're
• 1:40
  thinking student database, financial system.
• 1:42
  The crown jewels. The crown jewels. But the intruders
• 1:45
  didn't break down the front door. They found
• 1:47
  a window open in an online IT code library. A
• 1:53
  code library. So for those who aren't developers,
• 1:55
  that's like a workspace, right? A place to store
• 1:57
  code and test things out. Correct. It's a development
• 1:59
  environment. A digital workshop. It's meant for
• 2:02
  building and testing, not for secure storage.
• 2:06
  But, and this is the critical oversight, they
• 2:08
  found data files just sitting inside that library.
• 2:11
  Real data. Oh, very real data. The report from
• 2:16
  Lean Security points to this as a major DevSecOps
• 2:19
  failure. The specific issue is using production
• 2:23
  data. Actual people's information. Yes. Using
• 2:26
  actual people's information inside a non -production
• 2:29
  environment. I want to pause on that because
• 2:31
  I feel like this happens way more than anyone
• 2:34
  admits. I mean, developers need realistic data
• 2:37
  to test if their code works, so they just grab
• 2:39
  a copy of the live database. It is incredibly
• 2:41
  common and it is incredibly dangerous. It's like
• 2:43
  building a practice vault for a bank to train
• 2:46
  your security guards, but then you fill it with
• 2:48
  real stacks of cash just to see if they fit.
• 2:50
  Oh, OK. But the problem is because it's a practice
• 2:52
  fault, you don't put the same armed guards or
• 2:55
  long systems on it. That makes perfect sense.
• 2:57
  You assume nobody is looking at the practice
• 2:59
  fault. But clearly someone was. What was the
• 3:02
  scale of the exposure here? The numbers are pretty
• 3:06
  significant. You're looking at personal information
• 3:08
  for about 10 ,000 current staff and affiliates.
• 3:11
  And that's just the current payroll. Right. Add
• 3:13
  to that around 12 ,500 former staff members and
• 3:18
  then another 5 ,000 alumni and students. And
• 3:20
  what kind of data are we talking about? Names,
• 3:22
  dates of birth, phone numbers, home addresses,
• 3:25
  job titles, the works. I noticed something interesting
• 3:28
  in the timeline of that data. The university
• 3:30
  said these were historical extracts. The staff
• 3:34
  data was from 2018. Student data went back to
• 3:37
  2010. Why is data that old just sitting there?
• 3:41
  That is the million dollar question. It just
• 3:43
  points to a failure in data retention policies.
• 3:45
  In these huge organizations, you often get these
• 3:48
  zombie data sets. Zombie data. Yeah. You know,
• 3:51
  a project started in 2018. The devs pulled a
• 3:53
  data set to test it. The project finished. But
• 3:56
  nobody ever went back to delete the test file.
• 3:58
  So it's just digital hoarding, basically. Essentially.
• 4:00
  And while the university has purged those data
• 4:03
  sets now and is working with the NSW Privacy
• 4:05
  Commissioner, the damage is in the exposure.
• 4:07
  Your date of birth hasn't changed since 2018.
• 4:10
  Good point. It really highlights that data sprawl
• 4:12
  is a massive liability. You just can't protect
• 4:15
  what you don't remember you have. Exactly. And
• 4:18
  this isn't their first issue with this kind of
• 4:20
  peripheral exposure. Remember back in September
• 4:23
  2023, the breach with the international applicants.
• 4:26
  Through a third party provider, right? Yeah,
• 4:28
  it shows a pattern. The edge of the network is
• 4:30
  often softer than the core. Speaking of soft
• 4:33
  edges, we need to shift gears because while the
• 4:36
  Unisydney story is about oversight. An accident,
• 4:40
  really? The situation in the health care sector
• 4:42
  is much darker. This is aggressive extortion.
• 4:46
  It is. The health care sector is, I mean, it's
• 4:48
  under siege right now. And the emotional stakes
• 4:50
  are just incredibly high. We have to talk about
• 4:52
  Jania. They're a leading fertility service provider.
• 4:55
  Just days after the university news, reports
• 4:58
  concerned they were hit by the termite ransomware
• 5:00
  gang. Termite is a nasty group. They don't just
• 5:03
  lock up files. They steal them. They claim to
• 5:06
  have taken 700 gigabytes of data. OK, let's just
• 5:09
  stop there. 700 gigabytes. In the context of
• 5:13
  a fertility clinic, I mean, that is heavy. That's
• 5:15
  medical histories, diagnostic results. It's maximum
• 5:18
  leverage. Ransomware groups, they operate like
• 5:21
  businesses. They know if they steal designs for
• 5:24
  a new toaster, nobody really cares. But if they
• 5:26
  steal fertility data, the panic is immediate.
• 5:30
  The patients are going to pressure the organization
• 5:32
  to pay. It's sickening. And it wasn't just Genia.
• 5:36
  We saw Harbortown Doctors in Queensland pop up
• 5:38
  on the Rosita leak site in the same week. It
• 5:41
  feels like the whole sector is just bleeding.
• 5:43
  It is. But here's where we need to look at the
• 5:45
  why. It's easy to just blame the hackers, but
• 5:48
  I found a report, an audit from NSW Health that
• 5:51
  was released around the same time, and it sheds
• 5:53
  some light on why these places are so. This was
• 5:57
  the audit that talked about the normalization
• 5:58
  of noncompliance, right? That's the exact phrase,
• 6:01
  normalization of noncompliance. Which sounds
• 6:03
  like corporate speak for everyone's breaking
• 6:05
  the rules. It is, but it explains the motivation.
• 6:08
  The audit found that clinicians, doctors, nurses
• 6:11
  were routinely sharing passwords. They were using
• 6:13
  personal devices to handle patient data. Okay,
• 6:16
  let me play devil's advocate. These are doctors.
• 6:18
  They are under insane time pressure. If the security
• 6:21
  system makes you log in with a 20 -character
• 6:23
  password every time you move to a new room, isn't
• 6:26
  the security system the problem? That is a very
• 6:28
  valid point, and it's the core of the tension.
• 6:31
  The audit explicitly mentions time pressure.
• 6:35
  Clinicians aren't malicious. They're just trying
• 6:37
  to care for patients. If security gets in the
• 6:40
  way of patient care, security gets bypassed.
• 6:43
  It's just human nature. So you have the IT department
• 6:45
  building this fortress. But the people inside
• 6:48
  keep leaving the side door open because the main
• 6:50
  drawbridge takes too long to lower. That's it.
• 6:53
  But from an attacker's view, they don't care
• 6:55
  why the password was shared. They just care that
• 6:57
  it was. If we connect this to the bigger picture,
• 7:00
  we aren't just fighting hackers. We are fighting
• 7:03
  our own bad habits, our own workflow issues.
• 7:06
  That's a tough reality. The solution isn't just
• 7:09
  buy more software. It's fix the process. Precisely.
• 7:13
  But while human error is a huge factor there,
• 7:15
  there is a third storm front we have to talk
• 7:18
  about. And this one has nothing to do with bad
• 7:20
  habits. It's a pure technical failure in the
• 7:23
  bedrock of the Internet. You're talking about
• 7:24
  React 2 .0. I am. The name sounds almost playful,
• 7:27
  but I'm gathering the severity is anything but.
• 7:29
  It's catastrophic. The technical name is CVE
• 7:32
  -2025 -55182. But let's stick with React 2 .0.
• 7:37
  Please. So for the listeners. Maybe a business
• 7:40
  owner who is coding every day. What is this?
• 7:42
  Okay. Modern websites, they're not just static
• 7:44
  pages anymore. They're complex applications.
• 7:47
  They're built using frameworks. Think of it like
• 7:49
  the pre -built chassis and engine of a car. React
• 7:52
  and Next .js are two of the most popular frameworks
• 7:54
  in the world. They're everywhere. Startups, e
• 7:57
  -commerce, enterprises. Absolutely everywhere.
• 7:59
  And React 2 .0 is a vulnerability inside these
• 8:02
  frameworks. It's rated a CVSS 10 .0. A perfect
• 8:05
  10. That's rarely good news. It's the worst possible
• 8:08
  score. It means critical. And the reason it's
• 8:11
  a 10 is that it allows for remote code execution
• 8:14
  or RCE without authentication. Without authentication
• 8:18
  are the two scary words there. It means the attacker
• 8:21
  doesn't need to steal a password. They don't
• 8:24
  need to trick a doctor into clicking a link.
• 8:26
  They can just send a special request to your
• 8:28
  website and the server runs their command. It's
• 8:30
  not picking the lock. It's dissolving the door.
• 8:33
  And are we seeing this actually being used or
• 8:35
  is this still just theoretical? Oh, it is very
• 8:38
  much in the wild. Intelligence reports are suggesting
• 8:41
  China nexus groups are already all over this.
• 8:44
  We're seeing names like Earthlomia and Jackpot
• 8:47
  Panda. Jackpot Panda. I'm guessing they aren't
• 8:50
  looking for bamboo. No, they're using this exploit
• 8:54
  to plant back doors and deploy crypto miners.
• 8:56
  So you could have a perfectly secure network,
• 8:59
  trained staff. Great passwords. But because your
• 9:02
  website was built on React three years ago and
• 9:04
  you forgot to patch it, Dragpot Panda is mining
• 9:07
  Bitcoin on your servers. Or stealing your customer
• 9:10
  database. It's a supply chain risk. You didn't
• 9:12
  write the bad code, but you're running it. It
• 9:15
  reminds me a bit of that INET situation from
• 9:17
  the sitting duck source. Not the same method,
• 9:19
  obviously, but the scale of the blind spot. That's
• 9:22
  a great parallel. With iNet, you had 280 ,000
• 9:26
  customers exposed because of stolen employee
• 9:28
  credentials. Legitimate access used wrongly.
• 9:31
  With React to Shell, it's a flaw in the system
• 9:34
  itself. But both end in massive uninvited access.
• 9:38
  So let's just recap the volatility of this week.
• 9:41
  We've got zombie data leaking from universities.
• 9:42
  We have overworked health care staff bypassing
• 9:45
  security. And we have a foundational code vulnerability
• 9:48
  that just lets attackers walk right in. It feels...
• 9:52
  It can be. But the goal here isn't just to admire
• 9:55
  the problem. We need to distill this into action.
• 9:58
  And based on these three very distinct failures,
• 10:00
  we can actually draw a pretty clear map of what
• 10:03
  to do. Let's do it. If I'm a CTO listening to
• 10:05
  this or even just a business owner, what's my
• 10:08
  Monday morning to -do list? Okay, step one. This
• 10:10
  comes right from the University of Sydney incident.
• 10:12
  You have to inventory everything. And I don't
• 10:14
  mean sending an email asking what servers do
• 10:16
  we have. You mean automated discovery. Yes. You
• 10:19
  need tools that scan your network for everything
• 10:22
  connected to it. You cannot protect what you
• 10:24
  don't know exists. You have to find those forgotten
• 10:27
  code libraries, those test servers from 2018.
• 10:30
  The shadow IP problem. Find it and kill it if
• 10:33
  you don't need it. Yeah. Okay, what's step two?
• 10:35
  This is for the developers. No prod and non -prod.
• 10:38
  It's the golden rule that was broken at the uni.
• 10:40
  Never use real customer data for testing. Period.
• 10:44
  But the developers always say, we need real data
• 10:46
  to catch the edge cases. Then they need to use
• 10:48
  synthetic data or masked data. There are tools
• 10:51
  that take real data and just scramble the personal
• 10:53
  info, change the names, the addresses, but keep
• 10:57
  the structure. There's no excuse in 2026 for
• 10:59
  having real names in a test environment. Right.
• 11:02
  Okay. Step three. MFA is non -negotiable. Multi
• 11:05
  -factor authentication. This hits the healthcare
• 11:07
  and the INET issues. If a doctor writes a password
• 11:10
  on a sticky note, that's bad. But if the system
• 11:13
  also requires a thumbprint or a code from a phone,
• 11:16
  that sticky note is useless to a hacker. It stops
• 11:18
  credential theft. Patch. Immediately. If you
• 11:21
  use modern JavaScript frameworks, you need to
• 11:23
  check your version. Now. If it's vulnerable,
• 11:26
  patch it today. Don't wait for your quarterly
• 11:28
  maintenance window. A CVSS 10 is an open door.
• 11:32
  I want to pivot just for a second to the individual
• 11:34
  listener. We have a lot of people listening who
• 11:36
  might actually be in that Uni of Sydney data
• 11:38
  set or a patient at Genia. If I'm listening and
• 11:42
  I think, oh, that's me, what should I do? First,
• 11:45
  don't panic. But you have to be hypervigilant.
• 11:48
  The university noted there's no evidence yet
• 11:50
  of publication, but that can change at any moment.
• 11:53
  It's the phishing risk, isn't it? It's huge.
• 11:55
  If I'm a scammer and I know your name, your address,
• 11:58
  and that you worked at Sydney Uni as a professor
• 12:00
  of biology in 2018, I can write a very convincing
• 12:02
  email to you. Dear professor, regarding your
• 12:05
  pension. Exactly. So look at every single email
• 12:07
  with suspicion. And there's one other piece of
• 12:10
  advice the university gave, which I think is
• 12:11
  brilliant. Do not... post about the breach on
• 12:14
  social media really why is that people usually
• 12:17
  vent on twitter or linkedin straight away because
• 12:20
  it paints a target on your back if you post i
• 12:22
  can't believe i'm caught up in this hack you
• 12:25
  are basically signaling to scammers hello i am
• 12:29
  a victim and i am emotional and confused right
• 12:31
  now you are inviting them to target you that
• 12:34
  is solid advice Silence is safety in that regard.
• 12:37
  It really is. You know, we started this expecting
• 12:40
  to talk about high -tech cyber warfare. But when
• 12:43
  you boil it all down, deleting old files, not
• 12:46
  sharing passwords, and patching software, it's
• 12:49
  pretty basic hygiene. It is. But as this week
• 12:52
  proves, if you ignore the basics, the consequences
• 12:55
  are catastrophic. Well, we are just about out
• 12:57
  of time. But before we go, I want to leave our
• 12:59
  listeners with one last thought. Give us something
• 13:01
  to chew on. Okay. We worry a lot about the sophisticated
• 13:04
  threats. We worry about AI hackers and state
• 13:07
  -sponsored groups like Jackpot Panda, and we
• 13:09
  should. But I want to ask everyone listening,
• 13:12
  are you ignoring the boring risks to chase the
• 13:15
  exciting ones? Because this week proves that
• 13:17
  your biggest threat might not be some super virus.
• 13:19
  It might be a test file from 2018 that you just
• 13:22
  forgot to delete. The boring stuff will get you
• 13:24
  every time. That's the thought for the week.
• 13:26
  It really will. Well, thank you all for tuning
• 13:28
  in to this edition of Tech Talks with Ken Soft.
• 13:31
  Pleasure to be here. If all this talk of React
• 13:33
  2 Shell and DevSecOps has you worrying about
• 13:36
  your own business's safety, or if you're suddenly
• 13:39
  remembering a test server you haven't checked
• 13:41
  in three years, You don't have to figure it out
• 13:43
  alone. Absolutely not. Security is a team sport.
• 13:46
  If you need help auditing your systems or securing
• 13:49
  your IT infrastructure, reach out to the professionals.
• 13:51
  Head over to www .kinsoft .com .au. That's www
• 13:55
  .kinsoft .com .au to discuss your security and
• 13:59
  IT needs. They can help you find those silent
• 14:01
  failures before the bad guys do. Stay safe out
• 14:04
  there. Catch you next time.