Tobacco company smoked by leaving secret recipes exposed on an open file share
An exposed network share
Security tester Schloss began probing the company’s network with Metasploit, but Trend Micro antivirus did not alert during his vulnerability scans. Seeking more useful findings, he searched for file shares that permitted anonymous access.
One share held sensitive IT and HR records but had no access restrictions. A scan found ports 139 and 445 open, indicating the Windows SMB file-sharing protocol was running.
Recipes in a confidential folder
Schloss found a directory labeled “confidential” containing files named for recipes, products, sub-products and dates. One file described how a tobacco product was made, including ingredient weights, volumes and chemical percentages.
He said the discovery was serious and noted that employees could locate the file through Windows Explorer. His manager instructed him to delete the downloaded copy because the material was highly sensitive.
Company disputed the findings
Schloss informed the tobacco company’s security team, expecting it to restrict access to the recipe files. When he returned the next morning, his contact said the recipes were not real and denied a security problem existed.
Schloss included the filenames in his security report, but company security staff rejected his account and said he had not seen a genuine recipe. The disagreement continued for a year, and he could not produce the deleted file as evidence.
Key points
- An unrestricted company file share exposed recipes and sensitive IT and HR records.
- The recipes included manufacturing details and chemical proportions for a tobacco product.
- The tester deleted his downloaded copy at his manager’s direction.
- The company disputed that the files were genuine, and the disagreement lasted a year.