Rallyhood exposed a decade of users’ private data

guest · Feb 23, 2020

Rallyhood exposed a decade of users’ private data
February 24, 2020
https://techcrunch.com/2020/02/23/rallyhood-exposed-decade-data/

Rallyhood says it’s “private and secure.” But for some time, it wasn’t.

The social network designed to help groups communicate and coordinate left one of its cloud storage buckets containing user data open and exposed. The bucket, hosted on Amazon Web Services (AWS), was not protected with a password, allowing anyone who knew the easily-guessable web address access to a decade’s worth of user files.

The bucket contained group data as far back to 2011 up to and including last month. In total, the bucket contained 4.1 terabytes of uploaded files, representing millions of users’ files.
Some of the files we reviewed contained sensitive data, like shared password lists and contracts or other permission slips and agreements.
Click to expand...

A security researcher who goes by the handle Timeless found the exposed bucket and informed TechCrunch, so that the bucket and its files could be secured.

When reached, Rallyhood chief technology officer Chris Alderson initially claimed that the bucket was for “testing” and that all user data was stored “in a highly secured bucket,” but later admitted that during a migration project, “there was a brief period when permissions were mistakenly left open.”
At the time of writing, Rallyhood has made no statement on its website or any of its social media profiles of the incident.
Click to expand...

Log in or Sign up

Rallyhood exposed a decade of users’ private data

guest Guest

Log in or Sign up

Rallyhood exposed a decade of users’ private data

guest Guest

Useful Searches