Slashdot Mirror
Meeting and Hotel Booking Provider's Data Found in Public Amazon S3 Bucket (threatpost.com)
Leaks of personal and business information from unsecured Amazon S3 buckets are piling up. From a report: The latest belongs to Groupize, a Boston-area business that sells tools to manage small group meetings as well as a booking engine that handles hotel room-block reservations. Researchers at Kromtech Security found a publicly accessible bucket containing business and personal data, including contracts and agreements between hotels, customers and Groupize, Kromtech said. The data included some credit card payment authorization forms that contained full payment card information including expiration data and CVV code. The researchers said the database stored in S3 contained numerous folders, below; one called "documents" held close to 3,000 scanned contracts and agreements, while another called all_leads had more than 3,100 spreadsheets containing critical Groupize business data including earnings. There were 37 other folders in the bucket containing tens of thousands of files, most of them storing much more benign data.
He was embarrassed at having 3,100 spreadsheets in place of a database
Not anymore.
Not just that, but a license to manage every server you manage and/or create. It sure would cut down on stuff like this and IoT issues.
(Except that I'm certain that MSFT would use that as a technique for not licensing OSX and Linux users.)
"I don't know, therefore Aliens" Wafflebox1
Not very good at English either. In many places on their website, the Groupize trumpets that they can "Reign in your small meetings spend." One presumes they mean "Rein in" and perhaps "cost of small meetings."
This is no where near the vendors fault, this is 100% end-user error.
AWS sent an email to us a while ago alerting us to a single bucket (of many) still in use, for an old client running "legacy" code, having public read/write.
Within 5 minutes of reading the email, which was not requested, the permissions were fixed.
Nazi Germany has control of the newspapers and Goebbels supervised more than 3,600 newspapers and hundreds of magazines. He met the editors of the Berlin newspapers each morning and told them what could be printed and what could not.
making it licensed will lead to a lot of 1st amendment issues.
Really Helpful Keep It Up http://www.pakinewsnetwork.com/
Securing a bucket in S3 is not rocket science.... If the company doesn't know how to they should really hire someone to do it.
How did they even pass a PCI audit with that information?
Most convoluted permission system I have ever seen
What we are missing is the list of hotels that use these guys. Don't need to list all of them, just the big ones. Get enough media attention on big hotel names not keeping personal informantion secure and they will start paying attention.
It doesn't absolve them of their duties just because they hired a 3rd party. Maybe companies hiring out will pay more attention to details and operations after a few of these hit the news.
Just listing the party that screwed up means it goes away and another just like it fills the void. The people who took down your info have no incentive to respect its security.
Is the same day businesses like Groupize will actually care about securing their infrastructure. If they can no longer process credit cards anywhere, then they are out of business. Game over. End of story.
But the credit card industry has buffered data losses into their bottom lines and actually allows businesses to have multiple data breaches before the card companies even begin to ramp up PCI compliance rhetoric against offenders. Meanwhile, customers get their money stolen by thieves and legitimate businesses are harmed by lost merchandise, which raises the cost of living for the honest. Even with all the talk of PCI compliance that I see, I have never once seen enforcement of the policies other than a bunch of hand-waving.