Cloud misconfiguration a growing cause of security incidents

guest · Aug 6, 2021

Cloud misconfiguration a growing cause of security incidents
August 5, 2021
https://www.computerweekly.com/news...uration-a-growing-cause-of-security-incidents

Every organisation deploying Amazon Web Services (AWS) has experienced at least one security incident in its public cloud environment over the past year, with businesses’ rapid move to the cloud making secure configuration “nearly impossible”, according to threat detection and response specialist Vectra AI.

New research by the threat detection firm shows that AWS’s platform-as-a-service (PaaS) and infrastructure-as-a-service (IaaS) offerings have become increasingly vital components for many enterprises during the pandemic, largely because of the flexibility and scalability they can bring in the context of widespread remote working.
Click to expand...

According to the survey of 317 IT executives conducted by Vectra, 64% of organisations are deploying new AWS services on a weekly or daily basis, with 71% using four or more services, and only 29% using just its S3, IAM and EC2 services. It also found that 78% of organisations are running AWS across multiple regions, and 40% in at least three.

“Surprisingly, the survey shows that 30% of organisations surveyed don’t have formal deployment sign-off before pushing to production, and 40% have shared that they don’t have a DevSecOps workflow,” said the report, which added that 100% of the organisations surveyed had experienced a security incident on AWS in the past year.
Click to expand...

“Securing the cloud with confidence is nearly impossible due to its ever-changing nature,” said Matt Pieklik, senior consulting analyst at Vectra.

“To address this, companies need to limit the number of attack vectors malicious actors are able to take. This means creating formal sign-off processes, creating DevSecOps workflows and limiting the number of people that have access to their entire infrastructure as much as possible.
Click to expand...

guest · Aug 23, 2021

38M Records Were Exposed Online—Including Contact-Tracing Info
Misconfigured Power Apps from Microsoft led to more than a thousand web apps accessible to anyone
August 23, 2021
https://www.wired.com/story/microsoft-power-apps-data-exposed/

More than A thousand web apps mistakenly exposed 38 million records on the open internet, including data from a number of Covid-19 contact tracing platforms, vaccination sign-ups, job application portals, and employee databases. The data included a range of sensitive information, from people’s phone numbers and home addresses to social security numbers and Covid-19 vaccination status.

The incident affected major companies and organizations, including American Airlines, Ford, the transportation and logistics company J.B. Hunt, the Maryland Department of Health, the New York City Municipal Transportation Authority, and New York City public schools. And while the data exposures have since been addressed, they show how one bad configuration setting in a popular platform can have far-reaching consequences.
Click to expand...

The exposed data was all stored in Microsoft's Power Apps portal service, a development platform that makes it easy to create web or mobile apps for external use.

Beginning in May, researchers from the security firm Upguard began investigating a large number of Power Apps portals that publicly exposed data that should have been private—including in some Power Apps that Microsoft made for its own purposes.
Enabling privacy settings was a manual process. As a result, many customers misconfigured their apps by leaving the insecure default.

“We found one of these that was misconfigured to expose data and we thought, we’ve never heard of this, is this a one-off thing or is this a systemic issue?” says Greg Pollock, UpGuard's vice president of cyber research.
Click to expand...

UpGuard: By Design: How Default Permissions on Microsoft Power Apps Exposed Millions

Ultimately, Microsoft has done the best thing they can, which is to enable table permissions by default and provided tooling to help Power Apps users self-diagnose their portals. One potential learning for platform operators is to take ownership of misconfiguration issues sooner, rather than leave third-party researchers to identify and notify all instances of such misconfigurations.
Click to expand...

guest · Sep 20, 2021

EventBuilder misconfiguration exposes Microsoft event registrant data
September 20, 2021
https://www.bleepingcomputer.com/ne...tion-exposes-microsoft-event-registrant-data/

Personal details of registrants to virtual events available through the EventBuilder platform have stayed accessible over the public internet, open to indexing by various engines.

EventBuilder is a software solution for creating virtual events (webinars, training, online learning, conferences) using Microsoft technologies and integrates with Microsoft Teams and Teams Live Events extension.
Click to expand...

Microsoft event registrant's data
A report from security researcher Bob Diachenko in partnership with Clario Tech reveals that EventBuilder exposed more than one million CSV and JSON files with personal information belonging to registrants to events through Microsoft Teams.
A "registrant summary" was also present in the leaked data, which revealed information about the event, such as its name, date, tags, and if the registrant participated or not.
Click to expand...

The exposed data was present on Microsoft Azure Blob Storage, which is Microsoft’s cloud-based object storage solution. In their report, Diachenko and Clario Tech say that the storage was meant to host recorded sessions and provide access to them via a link.

Since EventBuilder is also used by Microsoft, Diachenko says that this data leak makes for “an interesting case study in how even the most advanced technology companies can expose themselves to data vulnerabilities.”
Click to expand...

guest · Sep 22, 2021

Plugging the holes: How to prevent corporate data leaks in the cloud
Misconfigurations of cloud resources can lead to various security incidents
September 22, 2021
https://www.welivesecurity.com/2021/09/22/plugging-holes-how-prevent-corporate-data-leaks-cloud/

When it comes to the cloud, there’s one particular trend that stands out above all others: misconfiguration. It’s responsible for the leak of billions of records every year and remains a major threat to corporate security, reputation and bottom line.
Mitigating this persistent human-shaped threat will require organizations to focus on gaining better visibility and control of their cloud environments – using automated tooling where possible.

According to Gartner, global spending on public cloud services is forecast to grow 18.4% in 2021 to total nearly $305 billion, and then increase by a further 19% next year.
Click to expand...

However, this opens the door to human error – as misconfigurations expose sensitive data to potentially malicious actors. Sometimes these records contain personally identifiable information (PII), such as the leak affecting millions at a Spanish developer of hotel reservation software last year. However, sometimes it’s arguably even more sensitive. Just last month it emerged that a classified US terrorist watchlist had been exposed to the public internet.

The bad news for organizations is that threat actors are increasingly scanning for these exposed databases.
Click to expand...

The scale of these leaks is astonishing: an IBM study from last year found that over 85% of the 8.5 billion breached records reported in 2019 were due to misconfigured cloud servers and other improperly configured systems. That’s up from less than half in 2018. The figure is likely to keep on rising until organizations take action.

Estimates suggest that 92% of enterprises today have a multi-cloud strategy, while 82% have a hybrid cloud strategy ramping up complexity.
Click to expand...

How to fix cloud misconfiguration
The key for organizations is to automatically find and fix any issues as quickly as possible. Yet they’re failing. According to one report, an attacker can detect misconfigurations within 10 minutes, but only 10% of organizations are remediating these issues within that time. In fact, half (45%) of organizations are fixing misconfigurations anywhere between one hour and one week later.

While CSPs are responsible for security of the cloud (hardware, software, networking and other infrastructure), customers must take on security in the cloud, which includes configuration of their assets.
Once this is established, here are a few best practice tips: [...]
Click to expand...

EASTER · Sep 22, 2021

Makes perfect sense.

guest · Sep 24, 2021

Colombian Real Estate Agency Leak Exposes Records of Over 100,000 Buyers
September 23, 2021
https://thehackernews.com/2021/09/colombian-real-estate-agency-leak.html

More than one terabyte of data containing 5.5 million files has been left exposed, leaking personal information of over 100,000 customers of a Colombian real estate firm, according to cybersecurity company WizCase.

The breach was discovered by Ata Hakçıl and his team in a database owned by Coninsa Ramon H, a company that specializes in architecture, engineering, construction, and real estate services. "There was no need for a password or login credentials to see this information, and the data was not encrypted," the researchers said in an exclusive report shared with The Hacker News.
Click to expand...

The data exposure is the result of a misconfigured Amazon Web Services (AWS) Simple Storage Service (S3) bucket, causing sensitive information such as clients' names, photos, and addresses to be disclosed. The details stored in the bucket range from invoices and income documents to quotes and account statements dating between 2014 and 2021.

"Based on viewing a sample of the documents, […] the misconfiguration revealed $140 to $200 billion in transactions, or an annual transaction history of at least $46 billion," the researchers said. "For perspective, that's roughly 14% of Colombia's total economy."
The highly confidential nature of the data contained within the database makes it highly susceptible to exploitation by cybercriminals to mount phishing attacks and conduct a variety of fraud or scam activities, including tricking users into making additional payments and worse, reveal more personally identifiable information by tampering with the website's backend infrastructure.
Click to expand...

WizCase: Over a Hundred Thousand People’s Personal Information Exposed in Colombian Real Estate Company Data Breach

guest · Oct 8, 2021

Silicon Valley VC Firm Leaked 'Deal Flow' Data
Plug and Play Ventures Left an Amazon S3 Bucket Open to the Internet
October 8, 2021
https://www.databreachtoday.com/silicon-valley-vc-firm-leaked-deal-flow-data-a-17696

A Silicon Valley venture capital firm that runs a matchmaking service linking investors with startups exposed 6GB of data, including deal flow information pertaining to investors and startups.

The data belongs to Plug and Play Ventures, which is headquartered in Sunnyvale, California, and has offices around the world. Plug and Play helps startups get off the ground and match those companies with investors. The firm itself says it has benefited from early investments in PayPal and Dropbox.
Click to expand...

The leaked data appears to be a PostgreSQL database for Playbook.vc, a networking and deal flow application from Plug and Play.

The unencrypted data includes personal contact information for investors, founders and CEOs. It includes personal information voluntarily submitted by those people to Plug and Play, including names, phone numbers and email addresses. There are more than 50,000 unique email addresses in the data.
There was also an exposed API key, although it isn't clear what kind of data that unlocks. Also, usernames and password hashes were exposed.
Click to expand...

Exposed for a Year
The data appears to have been exposed to the public since Oct. 20, 2020, due to a misconfiguration of an Amazon S3 storage bucket, according to the researcher who found it. The researcher wishes to remain anonymous.

Despite the contact, the data exposure continued. Finally, by Oct. 2, the data was secured after a tweet the previous day by Australian security researcher Troy Hunt, who created the Have I Been Pwned data breach notification service.

Anyone got a contact at @PlugandPlayTC that can take a serious security issue seriously? The kind of issue that usually results in a company sending a letter beginning with "We take security seriously..."
— Troy Hunt (@troyhunt) October 1, 2021
Click to expand...

guest · Oct 13, 2021

Brazilian marketplace integrator Hariexpress exposed 1.75 billion records
October 13, 2021
https://www.hackread.com/brazilian-marketplace-integrator-hariexpress-records/

The Brazilian E-commerce Marketplace Integrator platform Hariexpress (Hariexpress.com.br) has been caught exposing a massive trove of sensitive data belonging to its customers and vendors.
In total, the company has exposed more than 610 GB worth of data containing over 1.75 billion (1,751,023,279) records without any security authentication.

It is worth noting that this massive exposure has been caused by a misconfigured Elasticsearch server. This means anyone with knowledge of exploiting the misconfigured Elasticsearch servers can access these records without the need for login credentials.
What’s worse is that the company is yet to secure the data, while Brazilian Computer Emergency Readiness Team (BR CERT) also refrained from taking any steps to secure the data.
Click to expand...

Consequently, at the time of publishing this article, Hackread.com can confirm that the entire Elasticsearch cluster was still exposed and available online for public access.

We are contacting ASRC which is the Alibaba cloud security team as the server is hosted on AliCloud-US. Hoping they will take it offline, Sen told Hackread.com.
The fact that billions of records are currently open to public access could end up as a disaster for unsuspecting vendors and customers.
Click to expand...

Cybercriminals can use the data to carry out phishing scams, identity theft, and social engineering attacks, and competitors can use the data for corporate espionage.

Nevertheless, the data leak itself is a massive security threat to Hariexpress as hackers can hijack the entire Elasticsearch cluster to demand ransom or end up selling/leaking the data on hacker forums.
Click to expand...

SafetyDetectives: Brazilian Integrator Platform Leaked Over 1.75 Billion Sensitive Files

guest · Oct 14, 2021

Thingiverse Data Leak Affects 228,000 Subscribers
The Data Dump Is Being Broadly Circulated on a Popular Hacking Forum
October 14, 2021
https://www.databreachtoday.com/thingiverse-data-leak-affects-228000-subscribers-a-17729

Thingiverse, a website dedicated to sharing user-created digital design files, has reportedly leaked a 36GB backup file that contains 228,000 unique email addresses and other personally identifiable information, confirms Troy Hunt, creator of the Have I Been Pwned data breach notification service, citing the circulation of this data set on a popular hacking forum.

After analyzing the data file from the hacking forum, Hunt tells Information Security Media Group that the backup file was dumped publicly exactly a year ago on Oct. 13, 2020, and has remained exposed ever since. He adds that the leaked data appears to be a MySQL database that contains more than 255 million lines of data.

"The earliest date stamps in the data set appear to go back about a decade, however, I’ve not analyzed it closely enough," says Hunt.
Hunt says of the leaked data, "There is data on the 3D models that are publicly accessible, but there are also email and IP addresses, usernames, physical addresses and full names."
Click to expand...

The Discovery
The exposed data set was first discovered by a researcher and cyber enthusiast known by the alias "pompompurin" on Twitter and other forums.
Saying that he scanned the exposed database himself, Pompompurin confirms that the leaked data set was a result of a "misconfigured S3 bucket" from Thingiverse's backup data.

According to the latest correspondence from Hunt, he has advised Thingiverse that he will be publishing the leak information on Oct.14 after the company responded to him saying they are "taking this matter very seriously" but failed to provide an ETA on when they would be issuing a formal notice.
Click to expand...

guest · Oct 20, 2021

Chinese VPN app Quickfox caught exposing 1 million users’ data
October 19, 2021
https://www.hackread.com/chinese-vpn-app-quickfox-expose-users-data/

Wizcase’s team of ethical researchers, led by Ata Hakcil, discovered a “critical leak” that the researchers found to be exposing personally identifiable information of at least one million users of a Chinese VPN service.

The team revealed that the VPN leaking data is Quickfox, produced by Fuzhou Zixun Network Technology Co., Ltd.
The VPN is mainly used by Chinese citizens living abroad who need to access Chinese websites as most of these sites are geo-restricted. The VPN connects to servers in China and lets users avoid those restrictions.
Click to expand...

What Happened?
Reportedly, the leak was caused by a misconfiguration in the VPN. The product had insufficient ELK (Elasticsearch, Logstash, and Kibana) stack security, which refers to the three open-source programs responsible for streamlining searchers via large files, in this case, the logs of Quickfox.

Researchers identified that Quickfox had set up access restrictions from Kibana but hadn’t set up security measures for the Elasticsearch server. Hence, anyone with an internet connection and a browser could access Quickfox and retrieve sensitive PII information on the service’s users.
What’s worse is that there wasn’t any password protection in place or login credentials required to access the data, but the data wasn’t encrypted.
Click to expand...

Wizcase: A Million People’s Personal Information Leaked by Chinese VPN Application

guest · Oct 21, 2021

Data analytics firm exposed 2m Instagram and TikTok users’ data
October 21, 2021
https://www.hackread.com/data-analytics-firm-expose-instagram-tiktok-users-data/

The cybersecurity team at Safety Detectives, led by Anurag Sen, discovered an unsecured ElasticSearch server belonging to IGBlade.com, a social media analytics site. The server stored scraped data of millions of social media users. The data was taken from TikTok and Instagram.

Reportedly, at least 2.6 million user profiles have been exposed, equivalent to over 3.6 GB of data. The researchers dubbed it a shocking discovery since data scraping is banned on most social media websites, although it isn’t illegal.
Part of the exposed data were screenshots and links to profile pictures and other types of scraped personal data of social media users. It is worth noting that all data on the exposed database was publicly available.
Click to expand...

According to Safety Detectives’ blog post,

“The scraped data of users on the server is the same data that features each user’s corresponding IGBlade.com page, and the database often provides links back to IGBlade. This is how we know the database belongs to IGBlade.com,” researchers noted.
The exposed data was available online for more than a month until Safety Detectives’ researchers discovered it on July 5 and notified IGBlade. The company secured it on the same day.
Click to expand...

guest · Nov 23, 2021

Common Cloud Misconfigurations Exploited in Minutes, Report
November 23, 2021
https://threatpost.com/cloud-misconfigurations-exploited-in-minutes/176539/

Poorly configured cloud services can be exploit by threat actors in minutes and sometimes in under 30 seconds. Attacks include network intrusion, data theft and ransomware infections, researchers have found.

Researchers at Palo Alto Networks’ Unit 42 used a honeypot infrastructure of 320 nodes deployed globally in which they misconfigured key services within a cloud–including remote desktop protocol (RDP), secure shell protocol (SSH), server message block (Samba) and Postgres database.
Click to expand...

What they found was that attackers jumped at the opportunity to exploit the misconfigurations, with 80 percent of the 320 honeypots compromised within 24 hours and all compromised within a week, researchers disclosed in a report posted Monday.
Common Cloud Mistakes
The study clearly shows how quickly these common misconfigurations can lead to data breaches or attackers’ taking down an entire network—given that “most of these internet-facing services are connected to some other cloud workloads,” Chen wrote. This reinforces the importance of mitigating and patching security issues quickly, he said.
Click to expand...

Avoiding Common Cloud Mistakes
The good news for organizations making common cloud configuration mistakes that can be easily exploited is that they also are easy to avoid, researchers said. Chen listed several recommendations for system administrators to avoid leaving services exposed to attacks.
Click to expand...

Palo Alto Networks - Unit42: Observing Attacks Against Hundreds of Exposed Services in Public Clouds

Unit 42 researchers deployed multiple instances of remote desktop protocol (RDP), secure shell protocol (SSH), server message block (SMB) and Postgres database in the honeypot infrastructure. Researchers found that 80% of the 320 honeypots were compromised within 24 hours and all of the honeypots were compromised within a week. Some findings that stand out are:

SSH was the most attacked application. The number of attackers and compromising events was much higher than for the other three applications.

The most attacked SSH honeypot was compromised 169 times in a single day.

On average, each SSH honeypot was compromised 26 times daily.

One threat actor compromised 96% of our 80 Postgres honeypots globally within 30 seconds.

85% of the attacker IPs were observed only on a single day. This number indicates that Layer 3 IP-based firewalls are ineffective as attackers rarely reuse the same IPs to launch attacks. A list of malicious IPs created today will likely become outdated tomorrow.

Click to expand...

guest · Dec 6, 2021

Misconfigured Database Leaks Info on 150K E-commerce Buyers
December 3, 2021

Security researchers have found a misconfigured cloud-hosted database leaking over 300,000 records, including sensitive personal information on e-commerce buyers.

A team at Safety Detectives found the leaky Elasticsearch database on July 25 this year but claimed the content had been exposed without any password protection or encryption since November 2020.
Its efforts to close the leak have so far proven unsuccessful, after hosting firm Alibaba did not reply to the team’s outreach, and the identity of the database owner remains a mystery.
Click to expand...

All Safety Detectives has been able to ascertain from the 500MB data leak is that the owner is a Chinese ERP provider serving businesses that sell goods on platforms like Amazon and Shopify.
German, French and Danish e-commerce customers featured among the haul, with as many as 150,000 potentially exposed, the report claimed.

The leaked data would be a goldmine for scammers, who are past masters at reusing personal information in follow-on phishing and identity fraud attempts designed to elicit more sensitive financial info.
Click to expand...

SafetyDetectives: Anonymous ERP Platform Leaked Hundreds of Thousands of Records

The Safety Detectives cybersecurity team discovered a substantial data leak affecting an anonymous Chinese ERP software provider and exposing European customers.

The unclaimed ElasticSearch server has exposed more than 300,000 records, equating to around 500MB of data. This breach primarily affects eCommerce buyers, although some eCommerce sellers may be at risk too.
Click to expand...

guest · Dec 23, 2021

Ghana govt agency exposed 700k citizens’ data in a database mess up
December 22, 2021

VPNMentor’s cybersecurity researchers Noam Rotem and Ran Locar reported that Ghana’s National Service Secretariate – NSS – suffered a massive database misconfiguration that exposed data of up to 700,000 citizens from across the country, amounting to 55GB of data.

Researchers believe this breach poses a great risk for the Ghanian government officials associated with the agency and thousands of its citizens. The exposed database was discovered on 29 September 2021, and NSS and CERT-GH were notified between 6th and 12th October 2021.
Click to expand...

How the NSS Got Attacked?
According to VPNMentor’s report, the NSS was using Amazon Web Services (AWS), where it stored over 3 million files from its different programs. Some of the files in the cloud storage account were password-protected, most of the files were still exposed to public access as well as the database.

“While the NSS had password-protected many documents stored on the S3 bucket, the bucket itself was left completely open, leaving the contents totally exposed and easily accessible to anyone with a web browser and technical skills,” VPNMentor’s report read.
Click to expand...

VPNMentor: Report: Ghana Government Agency Exposes 100,000s of Citizens in Massive Data Breach

The NSS is a government program managing a mandatory year of public service for graduates of certain educational institutions in Ghana. Every year, thousands of students join the program from across the country to work in various public sectors, including healthcare.

The NSS was using Amazon Web Services to store over 3 million files from its programs. Despite password protecting some of the files in its cloud storage account, simple oversights by whoever created the account and uploaded and organized the files on the S3 bucket made this insufficient, and many files were still exposed.
Click to expand...

guest · Dec 27, 2021

Logistics giant D.W. Morgan exposed 100 GB worth of clients’ data
The clients affected by the incident involving a misconfigured Amazon S3 bucket include Global 500 company Ericsson and Fortune 500 company Cisco
December 27, 2021

IT security researchers at Website Planet Security Team discovered a misconfigured Amazon S3 bucket that was owned by D.W. Morgan, a supply chain management and logistics giant D.W. Morgan. The company is headquartered in Pleasanton, California with global operations.

According to researchers, the database contained more than 100 GB worth of data with 2.5 million files detailing financial, shipment, transportation, personal and sensitive records belonging to D.W. Morgan’s employees and clients worldwide. These included Global 500 company Ericsson and Fortune 500 company Cisco.
Click to expand...

Although, the database was discovered on November 12th, 2021 the details of it were only shared by Website Planet last week.
Good news and bad news
The good news is that D.W. Morgan secured the database within four days of the initial alert sent by Website Planet. However, it is unclear whether the database was accessed by malicious threat actors during the period of exposure.

In its blog post, Website Planet Security Team also emphasized that “Businesses should educate employees about the threat of phishing, malware, scams, and other forms of cybercrime. In addition, exposed companies could implement systems that allow employees to authenticate themselves when contacting one another via phone or email.”
Click to expand...

Website Planet: Report: US Logistics Company Exposes Fortune 500 Clients

The Website Planet security team discovered a data breach affecting D.W. Morgan, a multinational supply chain management and logistics company based in the United States.
An Amazon S3 bucket owned by D.W. Morgan was left accessible without authorization controls in place, exposing sensitive data relating to shipments and the company’s clients.

As a market leader, D.W. Morgan provides services to some of the biggest companies in the world and there are major Fortune 500 organizations with data exposed on the open bucket.
Click to expand...

guest · Jan 3, 2022

SEGA Europe left AWS S3 bucket unsecured exposing data and infrastructure to attack
January 3, 2022

At the end of the year, gaming giant SEGA Europe inadvertently left users’ personal information publicly accessible on Amazon Web Services (AWS) S3 bucket, cybersecurity firm VPN Overview reported.

The unsecured S3 bucket contained multiple sets of AWS keys that could have allowed threat actors to access many of SEGA Europe’s cloud services along with MailChimp and Steam keys that allowed access to those services. in SEGA’s name.

“Researchers found compromised SNS notification queues and were able to run scripts and upload files on domains owned by SEGA Europe. Several popular SEGA websites and CDNs were affected.” reads the report published by VPN Overview.
Click to expand...

The researchers reported that they were able to upload files, execute scripts, alter existing web pages and modify the configuration of critically vulnerable SEGA domains.

The compromise of some of the company domain would have allowed attackers to distribute malware via SEGA’s infrastructure.
Click to expand...

VPN Overview: SEGA Europe Thoroughly Scrutinizes its Cloud Security

Security researcher Aaron Phillips worked with SEGA Europe to secure sensitive files that were inadvertently stored in a publicly accessible Amazon Web Services (AWS) S3 bucket. There were lapses in SEGA’s cloud security that could have potentially exposed SEGA’s users and workers to adverse effects. Luckily, the joint efforts of SEGA’s own cybersecurity team and external security researchers ensured no harm was done and all SEGA’s security measures were updated to today’s best practice standards. Users can safely access official SEGA websites and forums.
Click to expand...

guest · Jan 6, 2022

Insecure Amazon S3 bucket exposed personal data on 500,000 Ghanaian graduates
Cloud storage misconfiguration left sensitive data openly accessible
January 6, 2022

Authorities in Ghana are investigating an apparent data breach that may have exposed the personal information of hundreds of thousands of citizens of the west African country.

Researchers at vpnMentor say they discovered a trove of unencrypted data tied to Ghana's National Service Secretariate (NSS) in a storage silo from Amazon Web Services (AWS).
Some of the three million files related to NSS's work and held on an AWS S3 bucket were password protected but many were not – an oversight that exposed data of an estimated 500,000-600,000 people from March 2018 to the end of 2021, vpnMentor said.
Click to expand...

Cloud storage misconfiguration
The AWS S3 bucket itself was neither encrypted nor password protected. The instance was misconfigured, and password protection was applied inconsistently so that open versions of sensitive passwords-protected files were accessible in other directories, vpnMentor reports.

The incident (along with suggested remediation advice) was reported both to NSS and Ghana’s Computer Emergency Response Team (GH-CERT).
The Daily Swig approached GH-CERT for comment on the incident. In response, GH-CERT confirmed the alleged breach was under investigation: [...]
Click to expand...

vpnMentor: Report: Ghana Government Agency Exposes 100,000s of Citizens in Massive Data Breach

The NSS could have easily avoided exposing its participants’ data if it had taken some basic security measures. These include, but are not limited to:

Secure its servers.

Implement proper access rules.

Never leave a system that doesn’t require authentication open to the internet.

Any company can replicate the same steps, no matter its size.
Click to expand...

guest · Jul 18, 2022

No password protection cause of Shanghai's police database leak
July 18, 2022

A dashboard used to manage the database of Shanghai police authorities was not secured by a password for over a year and could be freely accessed via the Internet. This is likely the cause of the recently leaked Shanghain Police Files, which reveal data on over 1 billion Chinese visitors

The whole thing is hosted in the Alibaba Cloud, using – according to experts – outdated technology with security problems. Something rings a bell in the back of my head, some places in Europe (e.g. Switzerland) rely on the Chinese cheap cloud for data storage. Details on the above case and the open database can be found in the blog post Hacker sells 1 billion personal data from Shanghai police data base for 10 bitcoins.
Click to expand...

Hacker sells 1 billion personal data from Shanghai police data base for 10 bitcoins (July 5, 2022)

From the scans of the leaked database, security researchers concluded that it was hosted on Alibaba's cloud platform. Employees of the company also confirmed this connection.

Meanwhile, Alibaba employees have blocked access to the database and are in the process of reviewing the code of the cloud environment in question.
Click to expand...

No database password protection
Brief addendum: Meanwhile, it turns out that the "hack" did not really require a hack. Rather, the Shanghai police database was openly available on the Internet for more than a year. The Wallstreet Journal reports (citing its own sources) in this July 14, 2022 piece that executives from Alibaba Group Holding's cloud division were summoned for talks by Shanghai authorities in connection with the theft of a huge police database.

The company's share price fell 5.98% since June 13, 2022 (which is when the first rumors of the problem surfaced) Reuters reports in this article.
Click to expand...

guest · Aug 5, 2022

Sensitive data of Indian pension fund holders exposed online
August 3, 2022

A huge cache of data containing the full name, bank account number and nominee information of pension fund holders in India has surfaced online.

Security researcher Bob Diachenko found two separate IP addresses storing more than 288 million records — with some 280 million records available under one IP address and about 8.4 million a part of the second IP address. Both IP addresses were publicly exposing the data to the internet but were not protected by passwords, the researcher said.
The records were a part of cluster indices titled “UAN”, which apparently refers to the Universal Account Number allotted to pension fund holders by the state-owned Employees’ Provident Fund Organization (EPFO) in the country.

“From what I understood, information from the database could have been used to put together a complete profile of an Indian citizen and make them a target for a phishing or scamming attack,” Diachenko told TechCrunch.
Click to expand...

Diachenko discovered the IP addresses leaking the sensitive data earlier this week. He tweeted on Wednesday a screenshot showing the data fields exposing personal information, alongside tagging India’s Computer Emergency Response Team (CERT-In). Less than a day after posting his tweet, both IP addresses in question were no longer accessible.

But Diachenko said it wasn’t clear who should claim responsibility for the exposed data that surfaced online. It is also unclear whether anyone other than Diachenko found the exposed data.
TechCrunch reached out to India’s EPFO, CERT-In and the country’s IT ministry for comment, but did not hear back.
Click to expand...

Indian UAN personal data exposure: what we know so far

On August 2nd, 2022, an internal report caught my attention. Our systems identified 2 (two) separate IPs with passwordless Elasticsearch clusters containing indices called "UAN". After quick review of the samples (using a simple browser), I was sure that I am looking at something big and important.

First IP with Elasticsearch cluster contained 280,472,941 records. Second IP contained 8,390,524 records.
Click to expand...

guest · Sep 3, 2022

Major Database Mess Up Leaves Indian Federal Police and Banking Records Exposed
By Deeba Ahmed - August 24, 2022

In total, the publically exposed Elasticsearch database contained a whopping 335 million records or roughly 24GB worth of highly sensitive data.
The IT security researchers at Cybernews have discovered a database containing financial fraud investigation records and other sensitive data belonging to the Indian federal police.

The publicly exposed database also included bank account holder names, balances, account numbers, transaction types, amounts, destinations, and cases taken up by the Central Bureau of Intelligence (CBI) India.
Click to expand...

In total, the database contained 335 million records or roughly 24GB worth of data. The dataset was discovered when the researchers performed an open-source intelligence investigation of Elasticsearch and Kibana hosted by France-based cloud computing firm OVHCloud.

What’s even worse, researchers identified records of more than 200 banks in the open database. Furthermore, the database included case-related information of private companies, which were investigated by local police regarding fraudulent practices and taken to court.
Click to expand...

Potential Dangers
Threat actors can exploit financial information to illegally access accounts and steal funds from them. Using financial inquiry data, scammers can approach people who have been named in fraud cases and cheat them.

Although the database was secured quickly, it is still quite risky considering that highly sensitive data was publicly exposed.
Click to expand...

Cybernews: Federal police and banking records exposed by database leak in India

The open dataset held financial fraud investigation records alongside sensitive data such as bank account numbers, account holder names, and cases related to India’s Central Bureau of Investigations (CBI).

"While attackers could not use this data alone to cause any damage, it can be used in combination with data gathered from other attacks,” Nazarovas added. “It can also be useful to attackers who want to find target accounts with high balances. Payment descriptions could be used to track a target's spending habits.”
Click to expand...

guest · Sep 3, 2022

A huge Chinese database of faces and vehicle license plates spilled online
By Zack Whittaker @zackwhittaker - August 30, 2022

A massive Chinese database storing millions of faces and vehicle license plates was left exposed on the internet for months before it quietly disappeared in August.

While its contents might seem unremarkable for China, where facial recognition is routine and state surveillance is ubiquitous, the sheer size of the exposed database is staggering. At its peak the database held over 800 million records, representing one of the biggest known data security lapses of the year by scale, second to a massive data leak of 1 billion records from a Shanghai police database in June. In both cases, the data was likely exposed inadvertently and as a result of human error.
Click to expand...

The exposed data belongs to a tech company called Xinai Electronics based in Hangzhou on China’s east coast. The company builds systems for controlling access for people and vehicles to workplaces, schools, construction sites, and parking garages across China. [...] its cloud-based vehicle license plate recognition system allows drivers to pay for parking in unattended garages that are managed by staff remotely.

It’s through a vast network of cameras that Xinai has amassed millions of face prints and license plates, which its website claims the data is “securely stored” on its servers.
But it wasn’t.
Click to expand...

Security researcher Anurag Sen found the company’s exposed database on an Alibaba-hosted server in China and asked for TechCrunch’s help in reporting the security lapse to Xinai.

Sen said the database contained an alarming amount of information that was rapidly growing by the day, and included hundreds of millions of records and full web addresses of image files hosted on several domains owned by Xinai. But neither the database nor the hosted image files were protected by passwords and could be accessed from the web browser by anyone who knew where to look.
Click to expand...

TechCrunch sent several messages about the exposed database to email addresses known to be associated with Xinai’s founder but our emails were not returned. The database was no longer accessible by mid-August.

But now with two mass data exposures in recent months, both the Chinese government and tech companies are finding themselves ill-equipped to protect the vast amount of data that their surveillance systems collect.
Click to expand...

guest · Jan 6, 2023

Database of the Cricketsocial.com platform left open online
By Pierluigi Paganini - January 4, 2023

Cricketsocial.com, is a social platform developed for the cricket community online. CyberNews discovered that a database used by the platform was left open online, it contains a huge trove of data.

The Social platform for the cricket community exposed over 100k entries of private customer data and credentials.
Click to expand...

The database, hosted by Amazon Web Services (AWS) in the US, contained admin credentials and private customer data, including email, phone numbers, names, hashed user passwords, dates of birth, and addresses. The experts noticed that most of the records in the database seem to be test data, however, the experts discovered it also includes personally identifiable information (PII) of legitimate site users. The data stored in the database includes posts, comments, number of likes, and links to images kept on the AWS storage bucket.

“Even if all the information stored was test data, leaving data in plaintext is a poignant indication of bad security practices being employed. That creates unnecessary risks for unsound practices creeping into the production environment if left unchecked.” Cybernews researchers said.
The experts discovered the database also exposed plaintext credentials for a website administrator account, a piece of information that could allow an attacker to take over the platform.
Click to expand...

Experts also found a second open instance of the database owned by cricketsocial.com that contains all the same types of information found in the first one. However, the second database was much smaller, likely because it was part of a development and quality assurance environment.
Click to expand...

guest · Jan 12, 2023

Social marketplace Trustanduse exposes nearly half a million users
By Pierluigi Paganini - January 12, 2023

Disclosing personal data on platforms providing digital services is always risky. The Cybernews research team identified a publicly accessible database storing up to 855GB of sensitive user and business data that belongs to social marketplace trustanduse.com.

The leaked database was first found on June 21 and remained potentially accessible to threat actors for at least six months. We reached out to trustanduse.com, and the company fixed the issue.
Click to expand...

The discovered database included sensitive data such as usernames, full personal names, Facebook IDs, phone numbers, and passwords hashed with the BCrypt algorithm, which is considered safe.
However, threat actors could use the data for spam and spear-phishing campaigns, most often in the form of con emails that try to dupe the victim into parting with money or further valuable information.

During the investigation, researchers were able to view publicly accessible information with business-related data, such as information about products, services, and partnerships.
Click to expand...

Leaving such data publicly accessible can have a negative effect on businesses, as it exposes commercial secrets.

“The leaked information reveals companies they collaborate with, market strategies, and how the company operates. It also leaked access to their products, such as the API. All of this information can be used to gather insights on how they operate, what their partners are, links between their products, and their business strategies as a whole,” explained the research team.
Click to expand...

The research team discovered an Elasticsearch instance through the use of open-source intelligence methods (OSINT), which is the process of identifying, harvesting, processing, and analyzing information obtained by request from publicly available sources, such as social media platforms, deep web forums, and other online communities and platforms.

Misconfigurations, as in the case of trustanduse.com, can be avoided by using monitoring tools to check if sensitive resources are not accessible from the internet.
Click to expand...

guest · Jan 16, 2023

The Dangers of Default Cloud Configurations
By Nathan Schmidt - January 16, 2023

When you hear "default settings" in the context of the cloud, a few things can come to mind: default admin passwords when setting up a new application, a public AWS S3 bucket, or default user access. Often, vendors and providers consider customer usability and ease more important than security, resulting in default settings. One thing needs to be clear: Just because a setting or control is default doesn't mean it's recommended or secure.

Below, we'll review some examples of defaults that can leave your organization at risk.
Click to expand...

Azure
Azure SQL Databases, unlike Azure SQL Managed Instances, have a built-in firewall that can be configured to allow connectivity at the server or database level. This gives users a lot of options to ensure the right things are talking.

One thing to note is whether there are any public IP addresses allowed to the Azure SQL Database. It is unusual to do so and, while you can use the default, it doesn't mean you should. You’ll want to reduce the attack surface for an SQL server — one way to do this is by defining firewall rules with granular IP addresses. Define the exact list of available addresses from both data centers and other resources.
Click to expand...

Amazon Web Services (AWS)
EMR is a big-data solution from Amazon. It offers data processing, interactive analytics, and machine learning using open source frameworks. Yet Another Resource Negotiator (YARN) is a prerequisite for the Hadoop framework, which EMR uses.

This is a default configuration that may not be noticed because it sits at a couple of different crossroads. This issue is something we find with our own policies looking for open ports open to the Internet, but because it is a platform, customers can get confused that there is an underlying EC2 infrastructure making EMR work.
Even with this default setting enabled, EMR exposes port 22 and 8088, which can be used for remote code execution.
Click to expand...

Google Cloud Platform (GCP)
GCP embodies the idea of identity being the new perimeter of the cloud. It utilizes a powerful and granular permissions system. However, the one pervasive issue that affects people the most concerns Service Accounts. This issue resides in the CIS Benchmarks for GCP.

Because Service Accounts are used to give services in GCP the ability to make authorized API calls, the defaults in the creation are frequently misused. Service Accounts allow other Users or other Service Accounts to impersonate it.
In other words, in the cloud, a simple misconfiguration can have a greater blast radius than what meets the eye. A cloud attack path can start at a misconfiguration, but end at your sensitive data through privilege escalations, lateral movement, and covert effective permissions.
Click to expand...

guest · Jan 18, 2023

Myrocket HR platform’s data leak turns into privacy nightmare for employees
By Pierluigi Paganini - January 18, 2023

Original post at CyberNews
On December 12, 2022, the Cybernews research team discovered a publicly accessible database with 260GB of sensitive personal data belonging to myrocket.co, offering ‘end-to-end’ recruitment solutions and HR services for companies in India.

The leak is estimated to have affected nearly 200,000 employees and almost nine million job candidates.
Click to expand...

Researchers warn that such data leaks are hazardous as they might help threat actors craft targeted phishing campaigns, assist in forgery and identity theft, and trick companies into making payments.

The company said the issue was caused by a misconfiguration and fixed the issue upon notification.
Treasure trove of data
The discovered database was not protected by authentication. The security loophole resulted in millions of private documents being revealed to the public. Worryingly, it also allowed threat actors to modify the data, changing salary amounts and details of bank accounts used for salary payments.
Click to expand...

Researchers could also see the data of around nine million job candidates, including insecurely hashed emails, phone numbers, names, home addresses, and automatically generated resumes.

The generated files included the hashed names and contact information in plain text. Additionally, researchers found nearly 15 million entries of job interview-related information.

“Incidents like this are usually caused by misconfigurations and lack of proper access control while not monitoring sensitive infrastructure. The issue could have been detected and fixed sooner if the company had monitored its infrastructure,” explained the research team.
Click to expand...

Log in or Sign up

Cloud misconfiguration a growing cause of security incidents

guest Guest

guest Guest

guest Guest

guest Guest

EASTER Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Cloud misconfiguration a growing cause of security incidents

guest Guest

guest Guest

guest Guest

guest Guest

EASTER Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches