Following up on the release of a huge trove of publicly available financial information from Myanmar’s Directorate of Investment and Company Administration (DICA) scraped by freedom-of-information hacktivist @donk_enby, the whistleblower site Distributed Denial of Secrets will make publicly available (currently under press embargo until March 2nd, 9am Yangon time1) a collection of 3,339 confidential documents from the Myanmar Investment Commission, related to 3,293 investment proposals/approvals.

In this blog post, we will go over our complementary red-team engagement on DICA’s Investment Monitoring System that led our team to discover multiple vulnerabilities that could (and did) allow an attacker to exfiltrate highly confidential information.

In the initial stages, we discovered a user enumeration API endpoint that listed the emails of all the users with access to the monitoring system. We used this to develop a simple password spraying script, which combined with the data from the well-known “Compilation of Many Breaches” gained us an initial foothold to a regular user account with access to the Yangon Region Investment Committee part of the system, due to password re-use.

From there, we continued reverse engineering the API which led to the discovery of a Privilege Escalation exploit that allowed us to create a new user account and assign it administration privileges with roles to access all the investment data from the Myanmar Investment Commission.

At this point we proceeded to follow our standard responsible disclosure procedure, by posting a screenshot of what we found on Twitter, falling out of our chairs laughing and uploading all their shit to Distributed Denial of Secrets.

Amongst other things, the confidential information that will be made public directly relates to the finances behind the displacement and genocide of the Rohingya people - with details of foreign investments in the mining and petroleum industry directly linked to war crimes and crimes against humanity.

We hope that our work here can serve as a giant three-fingered salute in solidarity with the people of Myanmar, to support their fight against tyranny.

My message to the Tatmadaw and the Junta? They can all Sugondese.

Bofa Deez Nutz (she/her), Cyber Jihad Operative, Anonymous (we/us)