7 ms·

OCR Software Dev Exposes 200k Customer Documents

111 points by wglb 8y ago

Ftuuky 8y ago
This is why the bank where I work developed its own OCR software (and translation and entity recognition, etc.). It simply couldn't afford to have these kind of leaks.
tjoff 8y ago
As a user: just don't store (or even process) data in random clouds. As a developer: really try to minimize data collection at all costs. I'm waiting for a future where the above is considered common sense.
AJRF 8y ago
Aside; This was the OCR engine included with DEVON(think/note) applications. Thankfully the OCR engine processed documents offline, in a seemingly prescient move, adherence to the rule of processing and storing as little data as needed saved an anxiety inducing set of events from occurring. Shame that small teams (I think that team is less than 10 devs) are sometimes the only businesses with enough sense to ensure their risk when it comes to things like this is mitigated or reduced. https://blog.devontechnologies.com/2018/08/abbyy-data-leak/ https://blog.devontechnologies.com/2018/08/abbyy-data-leak/
- syn0byte 8y ago
  I think smaller teams are better at mitigating because there is much less "not my department". Dev: I don't gotta worry about setting up Auth on my mongo instance for dev/testing. Deploy/Admins will handle it in production... Admins: They delivered a container package from CI so we assumed they had set up authentication correctly... Skiddie: Om nom nom...
jglazko 8y ago
If I have the right 'Abbyy', I'm surprised that I don't see any information about this data release on their website. Or, maybe not. Are there disclosure laws that one would expect to come into play here?
- bdcravens 8y ago
  Not familiar that much, but I think disclosure means they must notify the customer, rather than being obligated to disclose on their website.
p1necone 8y ago
'The Cloud' is just 'Someone Elses Computer'. Would you process confidential documents on 'Someone Elses Computer'? The bigger mistake was made before this data breach even happened.
- golergka 8y ago
  > Would you process confidential documents on 'Someone Elses Computer'? If it's a big megacorp like Google or Microsoft, and I don't consider myself a target for state-level actors, easy.
- vkou 8y ago
  Every[1] computer is, at worst, a misconfigured firewall and a late security patch - or, at best, one moron clicking a phishing e-mail away from being 'Some Martian script kiddie's computer'. Keeping your data on cloud introduces new attack vendors. It closes others. If you're going to be an idiot[2][3], and host a production database which doesn't require any authentication on the cloud, I don't have much hope for your non-cloud-deployed security. [1] For most reasonable definitions of every. [2] I have had the dubious pleasure of working in a ~15 year-old software company where ~half of the machines were virus-infested (Mostly Conficker, but also some other shit that I forget. This was in 2012. If I recall correctly, we had one part-time IT guy for ~30 engineers. His job was ordering computer parts, and keeping e-mail working. The health of the dev machines was not his problem.) The SOP was to do all your work in a VM running Windows XP, and wipe it every few weeks, or whenever performance would grind to a halt - whichever came first. One of my tasks, a few months in, was to deal with the virus situation on the build server, so that we could 'securely' build the release, and sign it with the encryption key that only the VPs had access to. [3] I have also had a chance to work in a company obsessed with security (Because of the nature of their products). One of my discoveries, a few months before I left, was that one of their products' updates were pushed via an insecure HTTP downloader. While I was there, nobody budgeted time to get it fixed.
  - GhostVII 8y ago
    The difference with computers in the "cloud" is that there is a much higher incentive to hack them since there is much more data on them, and hackers can be fairly confident that they will get valuable data in a hack. This is not the case with your personal computer. So if you are bad at security, I would argue that it is much safer (from a security point of view, at least) to store things on your own computer, since your mistakes are much less likely to be noticed.
uses 8y ago
Another MongoDB misconfiguration, wow. How is it still so easy to configure mongo with no creds and an open port? Feels like these alone cause a large % of data leaks. If I was running a cloud platform of such a massive scale I'd probably scan my own ports to identify glaring problems like this one. Kind of surprising that isn't happening considering how bad it is to have the brand associated with a report like this.
- chatmasta 8y ago
  Isn't this still the default configuration?
  - sanityvampire 8y ago
    Allowing unauthenticated access is the default configuration, but I think you have to go out of your way to make it accessible from external systems, let alone by anyone on the open internet...
    - sb8244 8y ago
      Can you elaborate further? My thought process is deploying this on digital ocean would make it insecure by default.
      - aidos 8y ago
        It binds to localhost by default (now, didn't used to which caused all the issues in the past). https://docs.mongodb.com/manual/reference/configuration-options/#net.bindIp https://docs.mongodb.com/manual/reference/configuration-opti...
- acdha 8y ago
  Defaults matter but I think there’s also a lot of blame for developer culture, especially in the circles where Mongo is popular. Faster, faster, ship it…
  - 8y ago
snthd 8y ago
The million dollar question - did this affect EU citizens?
- notimetorelax 8y ago
  Yeah, as an EU resident and a client of one of their clients, I REALLY want to know if my data was affected. And I have the right under the GDPR.
zanchey 8y ago
Anyone remember the articles in Uplink? This feels like it could easily have been lifted from the game.
bigcity 8y ago
There is a severe lack of good LOCAL ocr options for documents. They only ones I know are Abbyy (very good and very expensive) and OCR.space Local (affordable but not as good) and of course Tesseract. But i feel Tesseract is increasingly left behind with regards to OCR quality and speed.
- jumelles 8y ago
  And this article is ABOUT Abbyy!
  - deleted 8y ago
    [deleted]
mirimir 8y ago
Isn't there still OCR software that does all processing locally?
person_of_color 8y ago
Wow. Software from 1993 still going strong.

111 points by wglb 8y ago

This is why the bank where I work developed its own OCR software (and translation and entity recognition, etc.). It simply couldn't afford to have these kind of leaks.

tjoff 8y ago

As a user: just don't store (or even process) data in random clouds. As a developer: really try to minimize data collection at all costs. I'm waiting for a future where the above is considered common sense.

AJRF 8y ago

Aside; This was the OCR engine included with DEVON(think/note) applications. Thankfully the OCR engine processed documents offline, in a seemingly prescient move, adherence to the rule of processing and storing as little data as needed saved an anxiety inducing set of events from occurring. Shame that small teams (I think that team is less than 10 devs) are sometimes the only businesses with enough sense to ensure their risk when it comes to things like this is mitigated or reduced. https://blog.devontechnologies.com/2018/08/abbyy-data-leak/ https://blog.devontechnologies.com/2018/08/abbyy-data-leak/

syn0byte 8y ago
I think smaller teams are better at mitigating because there is much less "not my department". Dev: I don't gotta worry about setting up Auth on my mongo instance for dev/testing. Deploy/Admins will handle it in production... Admins: They delivered a container package from CI so we assumed they had set up authentication correctly... Skiddie: Om nom nom...

jglazko 8y ago

If I have the right 'Abbyy', I'm surprised that I don't see any information about this data release on their website. Or, maybe not. Are there disclosure laws that one would expect to come into play here?

bdcravens 8y ago
Not familiar that much, but I think disclosure means they must notify the customer, rather than being obligated to disclose on their website.

p1necone 8y ago

'The Cloud' is just 'Someone Elses Computer'. Would you process confidential documents on 'Someone Elses Computer'? The bigger mistake was made before this data breach even happened.

golergka 8y ago
> Would you process confidential documents on 'Someone Elses Computer'? If it's a big megacorp like Google or Microsoft, and I don't consider myself a target for state-level actors, easy.
vkou 8y ago
Every[1] computer is, at worst, a misconfigured firewall and a late security patch - or, at best, one moron clicking a phishing e-mail away from being 'Some Martian script kiddie's computer'. Keeping your data on cloud introduces new attack vendors. It closes others. If you're going to be an idiot[2][3], and host a production database which doesn't require any authentication on the cloud, I don't have much hope for your non-cloud-deployed security. [1] For most reasonable definitions of every. [2] I have had the dubious pleasure of working in a ~15 year-old software company where ~half of the machines were virus-infested (Mostly Conficker, but also some other shit that I forget. This was in 2012. If I recall correctly, we had one part-time IT guy for ~30 engineers. His job was ordering computer parts, and keeping e-mail working. The health of the dev machines was not his problem.) The SOP was to do all your work in a VM running Windows XP, and wipe it every few weeks, or whenever performance would grind to a halt - whichever came first. One of my tasks, a few months in, was to deal with the virus situation on the build server, so that we could 'securely' build the release, and sign it with the encryption key that only the VPs had access to. [3] I have also had a chance to work in a company obsessed with security (Because of the nature of their products). One of my discoveries, a few months before I left, was that one of their products' updates were pushed via an insecure HTTP downloader. While I was there, nobody budgeted time to get it fixed.
- GhostVII 8y ago
  The difference with computers in the "cloud" is that there is a much higher incentive to hack them since there is much more data on them, and hackers can be fairly confident that they will get valuable data in a hack. This is not the case with your personal computer. So if you are bad at security, I would argue that it is much safer (from a security point of view, at least) to store things on your own computer, since your mistakes are much less likely to be noticed.

uses 8y ago

Another MongoDB misconfiguration, wow. How is it still so easy to configure mongo with no creds and an open port? Feels like these alone cause a large % of data leaks. If I was running a cloud platform of such a massive scale I'd probably scan my own ports to identify glaring problems like this one. Kind of surprising that isn't happening considering how bad it is to have the brand associated with a report like this.

chatmasta 8y ago
Isn't this still the default configuration?
- sanityvampire 8y ago
  Allowing unauthenticated access is the default configuration, but I think you have to go out of your way to make it accessible from external systems, let alone by anyone on the open internet...
  - sb8244 8y ago
    Can you elaborate further? My thought process is deploying this on digital ocean would make it insecure by default.
    - aidos 8y ago
      It binds to localhost by default (now, didn't used to which caused all the issues in the past). https://docs.mongodb.com/manual/reference/configuration-options/#net.bindIp https://docs.mongodb.com/manual/reference/configuration-opti...
acdha 8y ago
Defaults matter but I think there’s also a lot of blame for developer culture, especially in the circles where Mongo is popular. Faster, faster, ship it…
- 8y ago

snthd 8y ago

The million dollar question - did this affect EU citizens?

notimetorelax 8y ago
Yeah, as an EU resident and a client of one of their clients, I REALLY want to know if my data was affected. And I have the right under the GDPR.

zanchey 8y ago

Anyone remember the articles in Uplink? This feels like it could easily have been lifted from the game.

bigcity 8y ago

There is a severe lack of good LOCAL ocr options for documents. They only ones I know are Abbyy (very good and very expensive) and OCR.space Local (affordable but not as good) and of course Tesseract. But i feel Tesseract is increasingly left behind with regards to OCR quality and speed.

jumelles 8y ago
And this article is ABOUT Abbyy!
- deleted 8y ago
  [deleted]

mirimir 8y ago

Isn't there still OCR software that does all processing locally?

person_of_color 8y ago

Wow. Software from 1993 still going strong.