Summary:
Mercedes-Benz faced a significant security breach when a private key was mistakenly left online, resulting in the exposure of sensitive internal data. The breach, discovered by RedHunt Labs security researchers, exposed critical internal information, intellectual property, and sensitive credentials. Mercedes-Benz swiftly took corrective actions, including revoking the compromised token and removing the public repository. However, questions remain about the extent of unauthorized access and the technical capabilities for detection.

It twas in January 2024 when the cybersecurity firm made a concerning discovery. They found a Mercedes-Benz employee’s authentication token in a public GitHub repository. This token, usually used to securely access code repositories, unintentionally gave full access to Mercedes’s GitHub Enterprise Server.

Security Officer Comments:
The exposure of this token meant that anyone with knowledge of its existence could gain unrestricted access to Mercedes-Benz’s internal source code repositories. These repositories contained not just the source code but a wealth of sensitive data:

• Intellectual property crucial to Mercedes-Benz’s operations.
• Connection strings and cloud access keys, exposing the company’s digital infrastructure.
• Critical internal documents, including blueprints and design documents.
• Sensitive credentials like single sign-on passwords and API keys.

The scope and scale of this breach painted a concerning picture of potential risks, both immediate and long-term, to Mercedes-Benz’s business operations and intellectual property security.

Suggested Corrections:
Following the discovery of the security breach, Mercedes-Benz swiftly took corrective actions to mitigate the potential damage caused by the exposed repositories. Upon being alerted to the security issue, Mercedes-Benz acted promptly:

• Revocation of the Compromised Token: The company immediately revoked the API token that had been exposed, effectively cutting off unauthorized access.
• Removal of the Public Repository: The public repository containing the sensitive token was promptly removed, preventing further exposure.
• Public Statement: Mercedes-Benz acknowledged the incident, confirming that the exposure was a result of human error and emphasizing their commitment to data security.

Link(s):
https://medium.com/dopplerhq/lessons-from-the-mercedes-benz-source-code-exposure-11df58336c9e