LocalBlox, a company that scrapes data from public web profiles, has left the details of over 48 million users on a publicly accessible Amazon Web Services (AWS) S3 bucket. IT security experts commented below.
Christopher Littlejohns, EMEA Engineer at Synopsys:
“Whilst this data breach has strong similarities to multiple other AWS misconfiguration issues that resulted in data breaches, and the data was “publicly available”, the data captured was interesting in that it consolidated personal information scraped from thousands of web sites. The net result is that it made it easy for an attacker to gain access to a pool of data that would be valuable for subsequent social engineering attacks, account hacking and identity fraud. Any company that collects, consolidates, but does not adequately secure such data is essentially exposing people to higher risk of being targeted. They therefore have an even stronger duty of care as they are effectively creating developed intelligence on people that can be used for criminal purposes.”
Javvad Malik, Security Advocate at AlienVault:
“Massive breaches through unsecured AWS S3 buckets continues to be a troubling trend. While cloud providers take care of certain aspects of security, it is imperative that organisations ensure they are doing their part to ensure the security of data that is uploaded. As with other aspects of security, cloud environments need to be continually monitored and the security assessed. Otherwise organizations have no assurance as to whether the data is secure or not, and can be left exposed for long periods of time.”
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.