Slashdot Mirror
Cloud-Based Repository Leak Exposes 123 Million American Households (zdnet.com)
"An Amazon Web Services (AWS) S3 cloud storage bucket containing information from data analytics firm Alteryx has been found publicly exposed, comprising the personal information of 123 million U.S. households," reports ZDNet. "The S3 bucked, located at the subdomain 'alteryxdownload,' was found by California cybersecurity firm UpGuard, with its Cyber Risk Team discovering the leak on October 6, 2017." From the report: The 36 GB data file titled "ConsumerView_10_2013" contained over 123 million rows, each one signifying a different American household. A similar file was seen by UpGuard when the personal details of 198 million American voters, compiled in a dataset by a data firm used by the Republican National Committee, were exposed. To highlight the breadth of the issue, UpGuard said the exposed data reveals over 3.5 billion fields of personally identifying details and data points about virtually every American household, including racial and ethnic information. The spreadsheet uses anonymized identifiers, but the information in the other few billion fields are very detailed, UpGuard said. Home addresses, contact information, mortgage status, financial histories, and very specific analysis of purchasing behavior -- such as domestic travel habits, if someone is a cat enthusiast, and their sporting interests -- is up for grabs in the exposed data. As for how this happened, ZDNet says, "the bucket was configured via permission settings to allow any AWS 'Authenticated Users' to download its stored data. Authenticated users are any user that has an AWS account."
And why do they have so much data on everyone?
And send the executives to prison for the rest of their lives.
...put all of the executives to death by tossing them into a pit full of concentrated nitric acid.
Don't worry. The invisible hand of the free market will solve this. That is also the reason nobody is in this database who did not volunteer for it.
Apparently Amazon doesn't understand security. Their cloud leaks more than most.
The cloud is insecure! Who would have thought? A locally controlled cloud, or a contract that has incentives for the owners NOT to be pants on head, window licking morons, can be a good thing. However, most clouds (as far as I have seen) are about a secure as a screen door on a submarine. And as long as the owner of the cloud keeps making money, and writing contracts that absolve them of all responsibility, this will keep happening.
As for how this happened, ZDNet says, "the bucket was configured via permission settings to allow any AWS 'Authenticated Users' to download its stored data. Authenticated users are any user that has an AWS account."
Hey, we had security protocols; that you find them inadequate, well, maybe that's a you problem.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
So, we're just going to keep doing this I guess?
I would expect such blatant racism on Fark, but on Slashdot? Mods please ban this asshole.
A private data analysis firm has detailed information on every American household.
Have you read my blog lately?
Just how many more stories about GOP connected entities just haphazardly leaving tons upon tons of VOTER data on publicly available (or for foreign powers to use) do we need to see before we start taking action!
The I've been assured that the cloud is completely secure by many random people on Slashdot.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Eh? Why is this what they pick to mention?
So... we're just going to keep doing this I guess?
(subject too long; "... is insecure?")
AWS leak, Cloud Offline, Google Chromebook incident, Cloudflare's Cloudbleed, etc etc.
Stop using Cloud and install WAF. Use ISP's packet throttle system to reduce DDoS damage. You can do it without cloud.
https://addons.mozilla.org/en-...
No matter how secure the communications between the app on your phone and the cloud service...no matter how secure the passwords or TFA methods are to prohibit unauthorized access...no matter how many guards and locks they put on the server room...if the administrator runs a full backup and throws it into an insecure Amazon S3 bucket (or some other cloud provider's bucket)...or copies it onto a portable drive and leaves the drive on his front seat while he runs into the store...or he is tempted by an offer from some hacker web site...or... then 'All your data belong to us!'
Now instead of a mistake causing a server to be open to your intranet, it's now exposed to the entire internet on a platform constantly scanned for unsecured servers.
Where is the data so I can check and see what they leaked about me?
Why does AWS recommend against public S3 buckets?
any AWS "Authenticated Users is all AWS and not just all in your group??
It's like windows ad where you think it's just any AD user on your domain or local system but is really any windows user on the web.
Good folks (viewer) and they help make the bucket problem visible. Technical on how to do something is fine. Get dumb with what you do with it without forethought is remarkable these days.
123 million households is pretty much everyone in the U.S..
If data about you has been compromised, clap your hands.
But it is good to know these companies will pay a hefty fine, right? Right? Guys?
Don't fight for your country, if your country does not fight for you.
Thanks for keeping your oath, US Census Bureau.
From: https://census.gov/programs-surveys/acs/about/is-my-privacy-protected.html
The Census Bureau is legally bound to strict confidentiality requirements. Individual records are not shared with anyone, including federal agencies and law enforcement entities. By law, the Census Bureau cannot share respondents' answers with anyone, -- not the IRS, not the FBI, not the CIA, and not with any other government agency.
All Census Bureau employees take an oath of nondisclosure and are sworn for life to protect all information that could identify individuals. Disclosing ANY information that could identify you or your family means 5 years in prison, or $250,000 in fines, or both.
From: https://www.census.gov/privacy/
We are committed to handling your information responsibly. Your information is kept confidential. This commitment applies to the individuals, households, and businesses that answer our surveys, and to those browsing our website.
This reminds me of when the U.S. Census Bureau gave up information leading to the detainment of Japanese Americans.
Somebody should be going to prison if these allegations prove to be true.
The latest US Census data.
Where can I get a copy?
I'd like to see how well de-identified it is.
That is pretty much all households in the USA, according to this there are 125.82 million households in your country.
https://www.statista.com/statistics/183635/number-of-households-in-the-us/
Many organizations have VPCs and any average person might think a setting of public means it is public within that context, not to the entire net. Am I wrong here or is a S3 bucket made public not to the world but to VPC. I tend to be careful, but cloud vendors really could improve this by making anything visible only to company VPC unless special effort is shown. I however do not think that this is an AWS fault in any way.
Anyone responsible would test this before dumping a DB there.