6 ms·
I would also point here that not everything which is publicly available is sensitive data. I've tried one of the tools posted on HN a while back to find read-ac
by realusername 9y ago
I would also point here that not everything which is publicly available is sensitive data. I've tried one of the tools posted on HN a while back to find read-access to random S3 buckets, I only found HTML files used for static websites. You can just get these files with curl on the website as well.
- diggan 9y agoI was thinking this as well, but then I continued to read the blog post and found the following: > Publicly exposed data contains a large amount of the employee data such as Payroll files (707,960) and Tax Return files (64,048). More than 2 Million of files that contain personal health information like MRIs based in Italy exposed. > The exposed data includes the Source Code, Patient List accounted about 95,434 and 4,548 respectively. Exposed data is a goldmine for attackers they can use the publicly available data to launch cyber attacks. the exposed information cut’s off their reconnaissance. > Shockingly some highly sensitive information’s such as security audit reports, network infrastructure details and penetration testing reports are stored online publicly. But it's not clear really how much percentage of 1.5B files was actually sensitive.
- _salmon 9y agoCorrect, a lot of sites have their static files hosted in s3 buckets. Also, shameless plug for my tool if you want to go bucket hunting: https://github.com/sa7mon/S3Scanner https://github.com/sa7mon/S3Scanner