Researcher finds 100K passwords, user IDs, on IEEE site

Danish CS teaching assistant says he stumbled upon IEEE cache during search for research material

A Danish graduate student said he was searching for research material on an IEEE FTP server last week when he stumbled upon the usernames and passwords of about 100,000 members of the professional association.

In a blog post on Tuesday, Radu Dragusin, a teaching assistant and computer science grad student at the University of Copenhagen, said the data appears to have been publicly available for at least a month before he found it.

The login credentials freely available on the site belonged to IEEE members from organizations such as NASA, Stanford University, Apple and Google, Dragusin said.

In addition to usernames and passwords, Dragusin said he was able to access more than 100GB of web server log data containing detailed information on 350 million-plus HTTP requests made by IEEE members over one month.

By accessing the log data, he said he could inspect pages that were accessed by logged in members, and determine when the pages were accessed and from where.

In an email to Computerworld, Dragusin said he discovered the data when looking for free research material from IEEE.

"I was merely surfing the public IEEE FTP server to see if they have a repository of freely available research articles," Dragusin said. "If you go on the FTP server yourself, you will see that the 'uploads' directory is among the most recently modified ones, so I opened it."

The directory contained many more directories including one containing the word "Akamai," which Dragusin said he knew was the name of a well-known content delivery network. He downloaded and decompressed one of the many GNU Zipped Archive files contained in the directory and then discovered detailed web-server logs.

At that point he downloaded everything in the Akamai directory and found more than 100GB of uncompressed log data.

"This looked interesting, because logs are not supposed to be public, as they often contain personal data," Dragusin said. "As a researcher, I saw the opportunity to study the logs to gain some insights into IEEE members, many of whom are researchers and engineers."

A closer inspection of the data showed that many of the log entries contained usernames and passwords.

That finding "was highly unusual and of course transformed this into a serious data breach," he said.

According to Dragusin, the files on the FTP server had been freely accessible since at least August 17.

Information on a Russian site that indexes FTP listings suggests that similar log data was publicly available some time last year as well, he added.

The breach is embarrassing for IEEE as it's a mistake -- storing login credentials in plain text -- that novice security professionals should know to avoid.

In a statement, an IEEE spokeswoman today said the organization is aware of an incident regarding "inadvertent access to unencrypted log files containing user IDs and passwords."

"We have conducted a thorough investigation and the issue has been addressed and resolved. We are in the process of notifying those who may have been affected," the statement said.

The spokeswoman did not say how the data could be available on a public FTP server, or why it was stored in unencrypted fashion.

An IEEE alert to members ( available here) said that no financial information was exposed as a result of the error.

"However, it was theoretically possible for an unauthorized third party, using your ID and your password, to have accessed your IEEE account," the alert cautioned.

As a precautionary measure, IEEE has terminated access to accounts with current passwords and users will be required to create a new one next time they attempt to log into their accounts, the statement said.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan, or subscribe to Jaikumar's RSS feed . His e-mail address is

Read more about security in Computerworld's Security Topic Center.

Join the CSO newsletter!

Error: Please check your email address.
Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jaikumar Vijayan

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place