Unsecured Azure blob exposed confidential documents

guest · Dec 22, 2020

Unsecured Azure blob exposed 500,000+ highly confidential docs from UK firm's CRM customers
December 18, 2020
https://www.theregister.com/2020/12/18/probase_unsecured_azure_blob/

A business app developer's unsecured Microsoft Azure blob left more than half a million confidential and sensitive documents belonging to its customers freely exposed to the public internet, The Register can reveal.

No security controls were in place on the Azure blob, meaning it was entirely public-facing, and anyone with the address of the files stored in it could view them without authentication – so they didn't need to log in or pass any kind of security check.
The blob was operated by Surrey-based app developer Probase, and appeared to be in the public cloud underpinning one of its CRM products.
Click to expand...

Hough told The Register: "Finding a storage bucket like this where a provider has lumped all of their clients' files in a single bucket rather than creating separate storage for each client demonstrates how, in 2020, the basics of secure design are still not being followed."

In a statement, Probase director Paul Brown told The Register: "We are working closely with the Information Commissioner's Office at present and advise we have no further comment at all."
Click to expand...

Azure blob security has historically had a lower profile than AWS S3 buckets. With more and more evidence emerging that devs using Azure are relying on security through obscurity rather than proper access controls, it is to be hoped that IT admins start paying closer attention to their essential duties.
Click to expand...

Log in or Sign up

Unsecured Azure blob exposed confidential documents

guest Guest

Log in or Sign up

Unsecured Azure blob exposed confidential documents

guest Guest

Useful Searches