APNIC left a dump from its Whois SQL database in a public Google Cloud bucket

guest · Jun 22, 2021

APNIC left a dump from its Whois SQL database in a public Google Cloud bucket
June 22, 2021
https://www.theregister.com/2021/06/22/apnic_whois_data_exposed/

The Asia Pacific Network Information Centre (APNIC), the internet registry for the region, has admitted it left at least a portion of its Whois SQL database, which contains sensitive information, facing the public internet for three months.

Its Deputy Director General Sanjaya revealed details of the configuration blunder late last week. He explained the error occurred when staff were performing maintenance work on APNIC’s Registration Data Access Protocol (RDAP) service, which, ironically, is set to replace Whois.

“It is not known if the data was accessed, as complete log files are not available. However, initial investigations reveal no sign of suspicious update activity,” Sanjaya stated.
Click to expand...

The Deputy DG said the file in the exposed bucket “contained hashed authentication details for APNIC whois maintainer and IRT objects, and also included some private whois objects that are not visible on APNIC’s regular public whois service”.

We’re told the hashed passwords are used to protect entries in APNIC’s Whois database so that only authorised people can make changes to records.
Click to expand...

Log in or Sign up

APNIC left a dump from its Whois SQL database in a public Google Cloud bucket

guest Guest

Log in or Sign up

APNIC left a dump from its Whois SQL database in a public Google Cloud bucket

guest Guest

Useful Searches