Imagine looking for a job, minding your own business and BAAAM! Your personal info is on display for everyone to see…
Well, that’s exactly what happened in December of last year when Bob Diachenko, Director of Cyber Risk Research at Hacken.io and bug bounty platform HackenProof, analyzed the data stream of BinaryEdge search engine and identified an open and unprotected MongoDB instance.
He found the same thing in Shodan search engine.
But what does all that mean?
Well to put into simple words, 854 GB of data that belongs to MILLIONS (202,730,434 individuals to be exact) was open for anyone to find. No password in the way. No login authentication. No protection whatsoever.
This data consists of user personal information. So the name, mobile phone number, email, marriage, children, politics, height, weight, driver license, literacy level, salary expectations and more.
How did it happen?
“Data import tool” is the answer. It is a tool created to scrape data from different Chinese classified like BJ.58 (as in this case) and others. We know this thanks to this GitHub repository (unfortunately, no longer available) which contained a web app source code with identical structural patterns as those used in the exposed resumes.
This is the statement from the security team at BJ.58We have searched all over the database of us and investigated all the other storage, turned out that the sample data is not leaked from us. It seems that the data is leaked from a third party who scrape data from many CV websites.
The good thing is that the database has been secured after Bob’s notification. The bad thing is that according to MongoDB, at least a dozen IPs might have accessed the data before it was taken down.
This incident is just one of many. In retrospect, 2018 was a year filled with data breaches and cybersecurity breaches. it’s unfortunate it had to end this way. However, we hope 2019 will be a safer year for all of us. Stay tuned to know about our new product that will help make the internet a safer place for everyone.