Slashdot Mirror
119,000 Passports, Photo IDs of FedEx Customers Found On Unsecured Amazon Server (gizmodo.com)
FedEx left scanned passports, drivers licenses, and other documentation belonging to thousands of its customers exposed on a publicly accessible Amazon S3 server, reports Gizmodo. "The scanned IDs originated from countries all over the world, including the United States, Mexico, Canada, Australia, Saudi Arabia, Japan, China, and several European countries. The IDs were attached to forms that included several pieces of personal information, including names, home addresses, phone numbers, and zip codes." From the report: The server, discovered by researchers at the Kromtech Security Center, was secured as of Tuesday. According to Kromtech, the server belonged to Bongo International LLC, a company that aided customers in performing shipping calculations and currency conversations, among other services. Bongo was purchased by FedEx in 2014 and renamed FedEx Cross-Border International a little over a year later. The service was discontinued in April 2017. According to Kromtech, more than 119,000 scanned documents were discovered on the server. As the documents were dated within the 2009-2012 range, its unclear if FedEx was aware of the server's existence when it purchased Bongo in 2014, the company said.
Hell, I don't even have a passport, yet I use FedEx to send/receive stuff all the time.
Why are people giving FedEx passport and other info of that nature?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Who works for FedEx in their IT department... I sure hope he isn't the one who takes the fall for this, because you KNOW that some low level IT guy is going to be crucified for this lapse of security procedures.
Never mind that NONE of this data should EVER live unencrypted on hardware outside of your direct control and only decrypted when needed.... OR that FedEx actually collects such information in the first place....
Man I sure hope it's not his "fault" because he's got a large family to feed there..
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
RememberFedex bought Kinko's which used to copy people's documents, paperwork, sometimes their licenses, and passports. When yobuy a company as large as that, then you buy into another one with even more sensitive stuff, then I guess you pay the piper.But their focus was shipping, not documents, which was kept on some hardware somewhere.
This is why I won't use any service that needs me to take a picture of my ID for uploading. Even if you put watermarks all over it, it is very risky. Apparently a lot of people will do things like this without thinking twice about it.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
Why the fuck does amazon provide the ability to have insecure data/servers??
They operate on a open network why there is an option to not have at least a password is beyond stupid!!!
Why is there an option to setup a data store without any protection???
S3 is a Service, not a "Server."
The title makes it sound like Amazon has lousy security.
Somebody rented a server from amazon; it could have been from anyone. There's no reason to call them out in the title.
Well I hope he hasn't been on anybody's sh*tlist, because you know how corporate politics works. If he's low-tier man on the totem pole, he better start playing it smart now.
Roll on May 2018. The EU GDPR regulations kick in, and this shit means companies get shut down.
If this happens after May, Fedex companies in all European nations will be obligated to report themselves to their respective Information Commissioners Office. The ICO will then investigate and has the power to fine them €20 million, or 4% of the *global* turnover of the whole company (whichever is the greater). So for the likes of Fedex (with global revenue measured in billions), that could run into hundreds of millions of Euro. If Fedex wants to deliver (or receive) a parcel in Europe ever again, they'll pay up. Otherwise, they'll have to cease trading in Europe (and no, popping up as Fexde shortly afterwards as an attempt to evade the fine won't wash either).
Of course, we have no way to know how the ICO will react to things like this, so it may not be as bad as all that. Leaving stuff on a publicly accessible server is unlikely to go down well though. Passport picture pages seem like a pretty bad thing to lose too, so again, unlikely to go down well.
I ordered a pair of sneakers. They of course shipped via UPS who in my area is more famous for doing tag and run than delivering packages.
So I had to go down to the depot to get the package. First she asks for ID - I asked was she law enforcement? If no then you cannot see it. She places the package on the counter i pick it up and walk out. She chases after me because I didn't sign for it either. It was too funny.
I go through this when looking for dedicated servers sometimes. Leaseweb is a particularly bad one for that, and it's why they've lost thousands of dollars of my business over the years. Online and even OVH have no issue with me renting European servers without needing to see a scanned copy of a document that's really important to me.
My standard response to a passport request over the internet has become "suck my dick." It goes something like this: Them: "Thank you for your order! Before we can continue, we require a copy of your passport or similar photo identification for our records." Me: "Suck my dick." (either that or straight up silence)
To date, nobody has ever broken into a server (or freely accessed it, well done FedEx) and stolen a scan of my passport, because I'm not crazy enough to leave that kind of thing in the hands of an incompetent retard playing security expert.