Google Cloud Buckets Exposed in Rampant Misconfiguration

guest · Sep 22, 2020

Google Cloud Buckets Exposed in Rampant Misconfiguration
A too-large percentage of cloud databases containing highly sensitive information are publicly available, an analysis shows
September 22, 2020
https://threatpost.com/google-cloud-buckets-exposed-misconfiguration/159429/

Six percent of all Google Cloud buckets are misconfigured and left open to the public internet, for anyone to access their contents.

In a survey of 2,064 Google Cloud buckets by Comparitech, 131 of them were found to be vulnerable to unauthorized access by users who could list, download and/or upload files. Among the exposed data that the firm uncovered were 6,000 scanned documents that included passports, birth certificates and personal profiles from children in India. Another database belonging to a Russian web developer included email server credentials and the developer’s chat logs.

“Those buckets can contain confidential files, databases, source code and credentials, among other things,” wrote researcher Paul Bischoff at the firm, in a posting on Tuesday.
Click to expand...

“Filtering based on the search input and the naming guidelines, they were able to find more than 2,000 buckets in about 2.5 hours. Our researchers noted they could likely improve their analysis to cover even more domains.”

“At the end of the day this is a symptom of immature IT hygiene. Most of this risk can be reduced through maturing processes to better track configuration, inventory, etc. Simply put: Better security through better IT.”
Click to expand...

Comparitech: 6% of all Google Cloud Buckets are vulnerable to unauthorized access

Amazon’s S3 buckets are the most popular means for apps, websites, and online services to store data in the cloud. So when data breaches and exposures occur, vulnerable S3 buckets are often cited as the target.

But Amazon Web Services is far from the only provider of cloud file storage. Google Cloud buckets, for instance, are also quite common, and they are just as vulnerable (due to misconfiguration) as their more popular counterparts, according to the latest research by Comparitech’s cybersecurity research team.
Click to expand...

Log in or Sign up

Google Cloud Buckets Exposed in Rampant Misconfiguration

guest Guest

Log in or Sign up

Google Cloud Buckets Exposed in Rampant Misconfiguration

guest Guest

Useful Searches