🚨ClarityCheck's Image Database Left Exposed for Months
Sensitive data exposed for months before fix
TL;DR
ClarityCheck's database of over 450GB of images was exposed in an unsecured S3 bucket. The leak included personal photos and biometric data, raising privacy concerns.
ClarityCheck inadvertently left a massive database containing roughly 9 million image files publicly accessible for months. This includes profile pictures, screenshots, and photographs of adults, teenagers, and children stored in Amazon's unsecured S3 bucket with folders named 'faces' and 'profiles'. The exposure highlights the risks associated with misconfigured data storage solutions, especially when dealing with sensitive biometric information like facial recognition data. ClarityCheck disputes the characterization but security experts consider this an accidental data leak due to API misconfigurations that allowed unauthorized access.
Key Points
Over 450GB of image files were stored in an unsecured Amazon S3 bucket, including profile photos and screenshots.
The database was left open for months before being secured after WIRED contacted the company.
ClarityCheck's face-search feature allows users to upload images and receive reports on where they appear online.
Security experts consider data exposed if it can be accessed by unauthorized individuals, regardless of ClarityCheck’s stance.
The service requires user permission for uploads but people may not know their image has been uploaded.
Why It Matters
If you're storing sensitive biometric or personal data online, this is a wake-up call. The exposure of over 9 million images highlights the risks of misconfigured APIs and storage solutions. Anyone relying on ClarityCheck's services should be wary of potential privacy breaches.
Frequently Asked Questions
Why does this matter?
If you're storing sensitive biometric or personal data online, this is a wake-up call. The exposure of over 9 million images highlights the risks of misconfigured APIs and storage solutions. Anyone relying on ClarityCheck's services should be wary of potential privacy breaches.
What happened?
ClarityCheck's database of over 450GB of images was exposed in an unsecured S3 bucket. The leak included personal photos and biometric data, raising privacy concerns.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,191 builders reading daily.