Archive — US — techcrunch
US cargo tech company publicly exposed its shipping systems and customer data tothe web
A U.S. cargo tech company, Bluspark Global, exposed its shipping platform and customer data to the internet for a year due to significant security vulnerabilities. After security researcher Eaton Zveare discovered the flaws, he reported them but struggled to contact the company. Bluspark has since patched the vulnerabilities and plans to implement a new security policy.
Key points
- Bluspark Global had multiple security flaws allowing unauthorized access to sensitive customer data.
- Eaton Zveare discovered the flaws, including plaintext passwords and an unauthenticated API.
- The company took months to respond to reports of the vulnerabilities and has since fixed them.
- No evidence suggests that customer shipments were manipulated as a result of the vulnerabilities.
- Bluspark plans to introduce a disclosure program for reporting security issues in the future.
Why it matters
- Increasing cybersecurity threats in the logistics sector, particularly related to organized crime.
- Similar vulnerabilities have prompted discussions about the need for enhanced cyber defenses across industries.
- The shift towards automation and reliance on technology in supply chains has raised concerns about system vulnerabilities.
Bluspark's security breaches underscore the urgent need for improved cybersecurity measures in logistics, reflecting wider trends in vulnerability disclosures and the interplay between technology and organized crime. As the company resolves its issues, the incident highlights the importance of clear communication channels for security researchers.