Facial Data of Millions Exposed in Security Breach
ClarityCheck's unsecured storage risked 9 million images despite 'private' claims.
1Massive Data Leak
Security researcher Jeremiah Fowler discovered that ClarityCheck, a people-search service, stored over 9 million facial images in an unsecured Amazon S3 bucket totaling 450GB. The photos in 'faces' and 'profiles' folders were accessible via URLs visible in the company's website code. The exposed data included profile pictures and screenshots of adults, teens, and children.
2Additional PII at Risk
Beyond images, misconfigured APIs allowed retrieval of sensitive data like email addresses, physical locations, and phone numbers simply by entering names. Despite Fowler's July 2023 warning, the vulnerability persisted for months. The company claimed this data came from 'public sources and licensed providers.'
3Unique Risks of Biometric Data
Unlike other personal information, facial biometrics cannot be changed once compromised. Such leaks enable severe cybercrimes from identity theft to deepfakes. ClarityCheck's promise to 'identify anyone in a photo within seconds' amplifies potential harm from this breach.
4Company's Controversial Defense
ClarityCheck argued data wasn't 'publicly exposed,' requiring 'specific unindexed URLs.' However, experts note these URLs were exposed in website code and manipulable via consumer browsers. Access was restricted after WIRED's report.
5Rise of People-Search Services
ClarityCheck belongs to a booming industry of services claiming to identify individuals via phone numbers, emails, or VINs. This 300% growth sector reached $250M in the US by 2022, but data security standards remain concerning.
6Recurring S3 Security Issues
AWS's simple storage service frequently appears in configuration-related leaks. Over 1,200 S3 datasets were found publicly accessible in early 2023. Experts emphasize disabling default 'public' settings and regular access control audits.
7Regulatory Gaps and Accountability
US people-search services operate under patchwork state laws. While regulations like CCPA grant deletion rights, companies often evade responsibility citing 'public data.' EU's GDPR offers stronger protection by classifying biometrics as sensitive.
8Cybersecurity Takeaways
This incident highlights the need to secure temporary storage locations. API security, access controls, and penetration testing are critical. Users should exercise caution with biometric data sharing and minimize digital footprints.
Original article: Slashdot — Milyonlarca Yüz Fotoğrafı Güvenlik Açığıyla Ortaya Çıktı