Exclusive: US cargo tech company publicly exposed its shipping systems and customer data to the web

"For the past year, security researchers have been urging the global shipping industry to shore up their cyber defenses after a spate of cargo thefts were linked to hackers. The researchers say they have seen elaborate hacks targeting logistics companies to hijack and redirect large amounts of their customers' products into the hands of criminals, in what has become an alarming collusion between hackers and real-life organized crime gangs."

"One little-known and critical U.S. shipping tech company has spent the last few months patching its own systems following the discovery of a raft of simple vulnerabilities, which inadvertently left the doors to its shipping platform wide open to anyone on the internet. The company is Bluspark Global, a New York-based firm whose shipping and supply chain platform, Bluvoyix, allows hundreds of big companies to transport their products and track their cargo as it travels across the globe."

"Bluspark told TechCrunch this week that its security issues are now resolved. The company fixed five flaws in its platform, including the use of plaintext passwords by employees and customers, and the ability to remotely access and interact with Bluvoyix's shipping software. The flaws exposed access to all of the customer's data, including their shipment records, dating back decades. But for security researcher Eaton Zveare, who uncovered the vulnerabilities in Bluspark's systems back in October, alerting the company to the security flaws took"

Security researchers have warned the global shipping industry to strengthen cyber defenses after cargo thefts linked to hackers led to elaborate hacks that hijack and redirect customers' products and collude with organized crime. Bluspark Global, a New York-based shipping technology firm, recently patched a raft of simple vulnerabilities that left its Bluvoyix platform accessible from the internet. Five flaws were fixed, including use of plaintext passwords and remote access to the shipping software, which exposed customers' data and shipment records dating back decades. Researcher Eaton Zveare found the vulnerabilities in October and experienced difficulty notifying the company because Bluspark lacked clear contact methods.

Read at TechCrunch