19 April 2016

NASA leaks names of employees with Secret and TOP Secret clearance?


NASA leaks names of employees with Secret and TOP Secret clearance?

It appears, NASA has a huge public file server. According to Google, there are almost 25,000 indexed documents. These documents are mainly examples of forms, applications, contracts, etc. However, several documents attracted our attention due to their names, e.g. "DD Form 254", which is used to request access to classified information and should be approved by DoD (Department of Defense).

We briefly went through these documents, and here are our findings:

Google says there are 142 documents in .doc format labeled "DD Form 254". Some of them are actual applications, prepared for signing contracts with subcontractors. These documents contain names, phone numbers, (some of them even signatures), contact information, addresses of facilities, job titles of employees, who request security clearance for subcontractors. Certain contracts require TOP SECRET clearance:

And some personal information of employees:

Due to predictable filenames it is possible to view documents, not indexed by Google, just by changing the last digit in the filename. The above link https://prod.nais.nasa.gov/eps/eps_data/132356-SOL-001-008.doc can be modified to view other details of this particular contract:

The filenames can also be brute-forced. So, even if the file is not indexed by Google, it still can be accessible on the server.


Back to the list

Latest Posts

US charges Samourai cryptomixer founders for laundering $100 million

US charges Samourai cryptomixer founders for laundering $100 million

The cryptocurrency mixer facilitated over $2 billion in illegal transactions.
25 April 2024
ArcaneDoor state-sponsored malware campaign strikes Cisco networking gear

ArcaneDoor state-sponsored malware campaign strikes Cisco networking gear

The attackers exploited two zero-day vulnerabilities in Cisco networking equipment.
25 April 2024
Iranian hackers exploit RMM tools to deliver malware

Iranian hackers exploit RMM tools to deliver malware

One of the aspects of MuddyWater's strategy involves exploiting Atera's free trial offers.
24 April 2024