Exclusive: Reverse assessment reveals KPMG's publicly accessible data
Publicly available information has been found on auditor and consultancy KPMG, on the day it released a report on the FTSE 350's security flaws.
In its report, KPMG said that according to research and simulated attacks carried out by its cyber response team, every company on the FTSE 350 list left employee usernames, email addresses and sensitive internal file location information online. It found that on average, 41 usernames, 44 email addresses and five sensitive internal file locations were available for each company.
In an email to SC Magazine, security researcher Robin Wood said that running two public, commonly available tools against the KPMG website achieved over 400 email addresses, 164 users, 112 PC names and quite a lot of internal directories. He also said that there were a handful of printers accessible, as well as software versions. “A quick check of www.us.kpmg.com showed they are running IIS 6.0 while the latest is version 8,” he said.
He confirmed that this was public information, and he gathered information that was available without hacking tactics. He showed SC a 62-page document of these details.
A spokesperson for KPMG said that the report was not designed to throw stones, but demonstrate how easy it is for hackers to get hold of information that can be used against companies.
The company said in a statement: “As you might expect, KPMG put its own site through the same examination as we did other sites. We recognise that many websites provide some level of data leakage and with this in mind, the purpose of our report is to highlight concerns so they can be dealt with, rather than highlight individual weak spots. We were careful not to reveal specific weaknesses of any company as it would be inappropriate to do so.”
KPMG said that as a partnership, it does not appear on the FTSE 350 Index and was not evaluated as part of its assessment. However it put its own site through the same examination as we did other sites.