Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

3/20/2020
06:15 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

200M Records of US Citizens Leaked in Unprotected Database

Researchers have not determined who owns the database, which was one of several large exposed instances disclosed this week.

Researchers discovered an unprotected database holding 800GB of personal user information, including 200 million detailed user records. The entirety of the database was wiped on March 3.

User records inside the database held what appeared to be profiles of US users, according to researchers with Lithuanian research group CyberNews. Data contained exposed individuals' full names and titles, email addresses, phone numbers, birthdates, credit ratings, home and mortgage real estate addresses, demographics, mortgage and tax records, and information about personal interests, and investments, as well as political, charitable, and religious donations.

"We were shocked by the sheer scale of the data exposed: The combination of personal, demographic and real estate asset data was an absolute goldmine for cybercriminals," the CyberNews team says.

It seems much of the data in this "main folder" may have originated in the United States Census Bureau, researchers report. When they found the database on Shodan.io in late January, they reached out to the US Census Bureau as a potential owner and have not heard a response. They watched the database for a couple of months, they say, but assume it was exposed for longer.

Finding the database was "not that difficult," the researchers say, but attackers would need some basic technical knowledge to understand what they were looking for. While someone could have accessed the database by mistake, the chances of this happening would be low.

In addition to the main folder of unsecured data, the database contained two more folders seemingly unrelated to the trove of personal records held in the main folder. These folders held the emergence call logs of a US-based fire department, as well as a list of some 74 bike stations that formerly belonged to a bike-share program. The bike-share stations are owned by Lyft.

While the two smaller folders did not hold personal data, the fire department call logs did have dates, time, locations, and other metadata dating back to 2010. "The presence of the folders that contained bike-sharing and fire department service call data was what confused us the most," they say. It's possible the data in these two folders may have been stolen or was used by several parties at the same time, the researchers hypothesize. They were unable to confirm this.

"The structure of the data led us to believe that the database belonged to a data marketing firm, or a credit or real estate company," the team says. For example, categories and sections were marked as codes in a fashion similar to the dictionaries used by data marketers. The codes themselves, they explain, were specific to the US Census Bureau or used in its classifications.

Information in this database, if accessed, could be "incredibly useful" to phishers, scammers, and other cybercriminals who could use the personal details within it to launch sophisticated phishing campaigns, spam attacks, and social engineering attempts.

This wasn't the only large misconfigured database found exposing sensitive information this week. Just yesterday, a misconfigured Elasticsearch database exposed more than 5 billion records related to data breaches between 2012 and 2019. A UK research firm collected detailed information on the breaches, including domain, source, contact email address, and password.

Earlier this week, vpnMentor researchers discovered an unprotected AWS S3 bucket holding 425GB of data, representing some 500,000 files related to MCA Wizard, a mobile app that acts as a tool for a Merchant Cash Advance. Data in the documents included credit reports, bank statements, contracts, legal documents, purchase orders, tax returns, and Social Security data.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "Security Lessons We've Learned (So Far) from COVID-19."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Ninja
3/26/2020 | 12:05:50 PM
Re: Comment on 200M Records of US Citizens Leaked in Unprotected Database
Wow, another breach where human error and misconfiguration played a role in 800 million records found on the Internet. The data privacy and the controls that were once supposed to be implemented are out of the door. AWS, Azure and GCP have put in measures to help with user error and oversight but it seems that it continues to happen. I am looking for GDPR or FTC to take a front seat to address this issue (sanctions and injunctions) but it seems that this will get brushed under the rug for someone's incompetence work. This is almost laughable but the sheer detail of informaiton found on the web, that had been monitoried months by a security team over the internet is sad. Someone's job or jail time needs to be involved because this PII infromation could be used for nefarious purposes that could affect the lives of citizens across the US (credit monitoring from Experian is not going to fix this, lol).

AWS S3 Bucket



I am trying to figure out why couldn't they do that on the various S3 buckets that were found in the public domain, just curious or someone from the inside set it up to make them look bad (disgruntled employee). I dont' put anything past emotional turmoil.

T

 
sakaarij2
50%
50%
sakaarij2,
User Rank: Apprentice
3/22/2020 | 12:39:04 AM
Comment on 200M Records of US Citizens Leaked in Unprotected Database
That was a very good article Kelly, I am not that technical but I see Data is the new gold as we are advancing in AI data is going to be the main target for hackers, I also learnt from this article single point of failure bound to happen in my opinion Blockchain technology will help to secure database. Thank you for sharing the wonderful article love to read more article and gain knowledge thank you again Kelly   
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
WannaCry Has IoT in Its Crosshairs
Ed Koehler, Distinguished Principal Security Engineer, Office of CTO, at Extreme Network,  9/25/2020
Safeguarding Schools Against RDP-Based Ransomware
James Lui, Ericom Group CTO, Americas,  9/28/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-26120
PUBLISHED: 2020-09-27
XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacement from PageGateway. Using crafted HTML, an attacker can elicit an XSS attack via jQuery's parseHTML method, which can cause image callbacks to fire even witho...
CVE-2020-26121
PUBLISHED: 2020-09-27
An issue was discovered in the FileImporter extension for MediaWiki before 1.34.4. An attacker can import a file even when the target page is protected against "page creation" and the attacker should not be able to create it. This occurs because of a mishandled distinction between an uploa...
CVE-2020-25812
PUBLISHED: 2020-09-27
An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw HTML.
CVE-2020-25813
PUBLISHED: 2020-09-27
In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, Special:UserRights exposes the existence of hidden users.
CVE-2020-25814
PUBLISHED: 2020-09-27
In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur. The attacker creates a message with [javascript:payload xss] and turns it into a jQuery object with mw.message().parse(). The expected result is that the jQuery object does not contain an <a> ...