An AI coal mine security camera network powered by plaintext passwords (eaton-works.com)

A recent investigation unveiled significant security vulnerabilities in “Project DigiCoal,” an initiative aimed at modernizing coal mines in India, led by Coal India with partners Accenture and DeepSight AI Labs. DeepSight’s AI vision platform, designed to detect anomalies across camera feeds in coal mines, suffered from a critical flaw: user credentials, including plaintext passwords, could be accessed without authentication through a poorly secured API. This oversight not only posed risks to user data with duplicated weak passwords but also enabled unauthorized access to the monitoring system controlling 7 coal mines' camera feeds. The implications of this discovery are significant for the AI and machine learning community, highlighting that while AI advancements can enhance operational security, foundational cybersecurity practices must keep pace. The exposure of such vulnerabilities raises concerns about the integrity of AI systems in sensitive industries, emphasizing the necessity for robust authentication mechanisms and security audits before deployment. CERT-IN assisted in the disclosure, confirming that the vulnerability was addressed, yet the incident underscores the ongoing challenges in securing AI infrastructure against exploitation.