RoboCent, a firma americana de robocall, expôs dados pessoais de centenas de milhares de eleitores americanos.
O investigador Bob Diachenko, da Kromtech Security, descobriu que a base de dados da empresa estava exposta online. O investigador estava a usar o serviço online GrayhatWarfare, que pode ser usado para encontrar buckets públicos de armazenamento de dados do Amazon Web Services (AWS) S3.
Consultando o sistema com o termo “eleitores”, ele encontrou o bucket da AWS usado pelo RoboCent.
Os registos descobertos pelo especialista continham:
- Full Name, suffix, prefix
- Phone numbers (cell and landlines)
- Address with house, street, city, state, zip, precinct
- Political affiliation provided by state, or inferred based on voting trends/history
- Age and birth year
- Gender
- Jurisdiction breakdown based on district, zip code, precinct, county, state
- Demographics based on ethnicity, language, education
O servidor também continha ficheiros de áudio com mensagens políticas pré-gravadas, usadas para o serviço de robo-calling.
“Just when I thought the days of misconfigured AWS S3 buckets are over, I discovered a massive US voter data online, apparently being part of Robocent, Virginia Beach-based political autodial firm’s cloud storage.” wroteDiachenko.
“Many of the files did not originate at Robocent, but are instead the aggregate of outside data firms such as NationalBuilder.”
Diachenko endereçou o problema para a empresa responsável, que prontamente resolveu o problema.
“We’re a small shop (I’m the only developer) so keeping track of everything can be tough”.
Este não é o primeiro caso de buckets inseguros do Amazon S3 expostos on-line. Em junho de 2017, a empresa DRA deixou 1,1 TB de dados públicos num bucket semelhante, 198 milhões de registos de eleitores dos EUA foram expostos online.
Pedro Tavares is a professional in the field of information security working as an Ethical Hacker/Pentester, Malware Researcher and also a Security Evangelist. He is also a founding member at CSIRT.UBI and Editor-in-Chief of the security computer blog seguranca-informatica.pt.
In recent years he has invested in the field of information security, exploring and analyzing a wide range of topics, such as pentesting (Kali Linux), malware, exploitation, hacking, IoT and security in Active Directory networks. He is also Freelance Writer (Infosec. Resources Institute and Cyber Defense Magazine) and developer of the 0xSI_f33d – a feed that compiles phishing and malware campaigns targeting Portuguese citizens.
Read more here.