Secret terrorist watchlist with 2 million records exposed online

guest · Aug 16, 2021

Secret terrorist watchlist with 2 million records exposed online
August 16, 2021
https://www.bleepingcomputer.com/ne...chlist-with-2-million-records-exposed-online/

A secret terrorist watchlist with 1.9 million records, including classified "no-fly" records was exposed on the internet.
The list was left accessible on an Elasticsearch cluster that had no password on it.
Millions of people on no-fly and terror watchlists exposed
July this year, Security Discovery researcher Bob Diachenko came across a plethora of JSON records in an exposed Elasticsearch cluster that piqued his interest.

The 1.9 million-strong recordset contained sensitive information on people, including their names, country citizenship, gender, date of birth, passport details, and no-fly status.
Click to expand...

The list is referenced by airlines and multiple agencies such as the Department of State, Department of Defense, Transportation Security Authority (TSA), and Customs and Border Protection (CBP) to check if a passenger is allowed to fly, inadmissible to the U.S. or assess their risk for various other activities.
Server taken offline 3 weeks after DHS notified
The researcher discovered the exposed database on July 19th, interestingly, on a server with a Bahrain IP address, not a US one.
However, the same day, he rushed to report the data leak to the U.S. Department of Homeland Security (DHS).
"I discovered the exposed data on the same day and reported it to the DHS."

"It's not clear why it took so long, and I don't know for sure whether any unauthorized parties accessed it," writes Diachenko in his report.
Click to expand...

Log in or Sign up

Secret terrorist watchlist with 2 million records exposed online

guest Guest

Log in or Sign up

Secret terrorist watchlist with 2 million records exposed online

guest Guest

Useful Searches