Endpoint //

Privacy

4/6/2018
10:21 AM
50%
50%

Study Finds Petabytes of Sensitive Data Open to the Internet

New research by Digital Shadows finds more than 1.5 billion sensitive files are open to discovery on the internet.

Companies are putting their sensitive data on the internet for all the world to see. That's the conclusion of research published by security firm Digital Shadows, which found more than 1.5 billion sensitive files visible on the internet.

Misconfigured S3 buckets, NAS devices, FTP servers, and other storage and gateway systems were responsible for the vast majority of the visible files, the company says.

Visible data includes everything from patent applications to employee information, though payroll and tax return information accounted for the largest group of files available, with more than three-quarters of a million total files of these types seen. In all, Digital Shadows found more than 12 petabytes of sensitive information available to anyone bothering to look.

Third-party contractors misconfiguring systems was seen as the most significant cause of the open information. While S3 buckets have been in the news recently as a source of free data, Digital Shadows found that they only account for 7% of exposed data; technologies such as SMB (33%), rsync (28%), and FTP (26%) were responsible for the bulk of the data availability.

Digital Shadows notes that the rapidly approaching implementation of GDPR should provide companies with additional impetus to review the status of their systems and make configuration changes where necessary.

For more, read here.

Interop ITX 2018

Join Dark Reading LIVE for a two-day Cybersecurity Crash Course at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the agenda here. Register with Promo Code DR200 and save $200.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
Most Malware Arrives Via Email
Dark Reading Staff 10/11/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18361
PUBLISHED: 2018-10-15
An issue was discovered in nc-cms through 2017-03-10. index.php?action=edit_html allows XSS via the name parameter, as demonstrated by a value beginning with home_content and containing a crafted SRC attribute of an IMG element.
CVE-2018-1744
PUBLISHED: 2018-10-15
IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 148423.
CVE-2018-1747
PUBLISHED: 2018-10-15
IBM Security Key Lifecycle Manager 2.5, 2.6, 2.7, and 3.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 148428.
CVE-2018-18324
PUBLISHED: 2018-10-15
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm_current_dir parameter, or the admin/index.php module, service_start, service_fullstatus, service_restart, service_stop, or file (within the file_editor) parameter.
CVE-2018-18322
PUBLISHED: 2018-10-15
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php service_start, service_restart, service_fullstatus, or service_stop parameter.