Cloud misconfiguration a growing cause of security incidents

guest · Jan 23, 2023

A Major App Flaw Exposed the Data of Millions of Indian Students
By Vittoria Elliott, Dhruv Mehrotra @dmehro - January 23, 2023

A security lapse in an app operated by India’s Education Ministry exposed the personally identifying information of millions of students and teachers for over a year.

The data was stored by the Digital Infrastructure for Knowledge Sharing app, or Diksha, a public education app launched in 2017. At the height of the Covid-19 pandemic, when the government was forced to shutter schools across the country, Diksha became a primary tool for allowing students to access materials and coursework from home.
Click to expand...

But a cloud server storing Diksha’s data was left unprotected, exposing millions of individuals’ data to hackers, scammers, and virtually anyone who knew where to look.

Files stored on the unsecured server contained the full names, phone numbers, and email addresses of more than 1 million teachers. According to data in the files, verified by WIRED, the teachers worked for hundreds of thousands of schools located in every state in India. Another file contained information about nearly 600,000 students.
Click to expand...

After initially discovering the exposure in June, the researcher contacted the Diksha support email, alerting them to the data breach, identifying the source, and offering to share more information. They received no response. “There's zero chance that it hasn't been accessed and downloaded by a bunch of other people,” the employee says of the exposed data.
Click to expand...

The unsecured storage server was hosted on Azure, Microsoft’s cloud storage service. It’s unknown how long the data was left unprotected, but Google indexed more than 100 files from this server as early as October 2018. In other words, information stored on this vulnerable server was likely findable through a simple Google search for at least four years.
Click to expand...

guest · Feb 9, 2023

Russian e-commerce giant exposed buyers' delivery addresses
By Jurgita Lapienytė @lapienyte - February 7, 2023

A leading electrical engineering company in Russia, Elevel, has exposed its customers' personally identifiable information (PII,) including full names and addresses.
Click to expand...

Founded in 1991, Elevel (previously Eleko) positions itself as the leading Russian electrical engineering company that runs both an e-commerce business and wholesale stores.

On January 24, the Cybernews research team discovered an open dataset with 1.1TB of data and attributed it to e.way – an Elevel-owned online shop with 25,000 monthly visitors.
Click to expand...

The dataset with seven million data entries leaked two years' worth of sensitive data, including names, surnames, phone numbers, email addresses, and delivery addresses of customers.

"If left exposed, threat actors could download and clone the cluster's data and use it for nefarious purposes, including phishing attacks, as they possess sufficient PII and to make their scam seem legitimate," Cybernews researchers said.
Moreover, it contained login data and passwords in URL encoding, which is considered a relatively weak protection mechanism since it can be decoded easily.

"As a number of usernames and passwords are exposed, it could enable threat actors with valid credentials to gain further sensitive data and to impersonate users to make fraudulent purchases," Cybernews researchers noted.
Click to expand...

Log in or Sign up

Cloud misconfiguration a growing cause of security incidents

guest Guest

guest Guest

Log in or Sign up

Cloud misconfiguration a growing cause of security incidents

guest Guest

guest Guest

Useful Searches