8 ms·

Dating Apps Exposed 845 GB of Explicit Photos, Chats, and More

131 points by georgecmu 6y ago

ourmandave 6y ago
This would make a great dataset to train your AI on. "Yuri, why iz Lomonosov-2 supercomputer keep sending me dick pics?"
csunbird 6y ago
Another miss-configured S3 bucket, again? Really? I actually lost the count of this happening.
- RL_Quine 6y ago
  I know of companies who store all of their AML/KYC in AWS buckets, going back years. It's scary really.
- fragmede 6y ago
  If you're using AWS, where else would you put it? Fire up an EC2 instance and obscurely store it in /var/www/? These days S3 buckets start off private, and the AWS console warns you "hey, the data in this bucket is publicly accessible, are you sure?" Irresponsibility is irresponsibility, no matter the system being used. An SFTP server can be configured with PermitRootLogin yes and PermitEmptyPasswords yes so at some point it's not the software that's the issue.
  - Retric 6y ago
    Amazon allows S3 to be unsecured after multiple breaches. Simply the existence of the option is a security issue. PS: It's a basic question of convenience vs security. If you allow people to lower security settings, they will. However, if Amazon onky allowed the unsecured option to be temporary say 24 hours then it would be less convenient to leave things open.
    - Pfhreak 6y ago
      I used to agree with you, back when S3 defaulted to public or at the very least made public a very easy checkbox. These days it defaults to private and you have to click many warnings and unhide options to even expose the public options. That said, I don't know that many organizations practice good hygiene about which buckets they use. Like they might just use 'the one bucket that we have as a company' rather than separating their uses into many smaller buckets that are appropriately access controlled.
    - snazz 6y ago
      I'm not sure about S3, but I use Google Cloud Storage to host my websites and large file downloads. For that to work, "allUsers" has to have the "Cloud Storage Viewer" permission. Would it be possible for that to work without allowing GCS and S3 buckets to be public?
sosuke 6y ago
Looks like the developer in question took action to correct the situation the same day they became aware of it. That at least is good. If the data was never secured in the first place can you call it a breach? They found this, great, was there any indication it was accessed directly before that? Is that something that can even be investigated? You find a door to the data unlocked. You open the door. Can you tell if someone else had opened the door before you? Did you prevent 845 GB of data being found by a black hat or did you find that data because of a black hat?
- MaximumYComb 6y ago
  I doubt they have sufficient logging if they didn't have any security on their data.
- boomlinde 6y ago
  As a user concerned with my own privacy, I don't care about the color of the hat. If it's for my eyes only and someone else looks at it, it's a breach of privacy. If that's due to the incompetence of someone I've entrusted my private information to, it's a breach of trust. If that's someone with a legal responsibility not to share the information, it reflects very poorly on them, and this level of negligence should in my opinion be considered criminal.
  - ashtonkem 6y ago
    It’s a good practice for good faith security researchers to create their own account so that they can test the system without viewing an innocent users data. This is especially important for systems such as dating apps, which obviously contain extremely sensitive data.
- thephyber 6y ago
  > If the data was never secured in the first place can you call it a breach? Yes. It's a "breach" even if just a security researcher found it. It's sometimes even a breach even if only an employee found it (depending on the specific role of the employee and controls on the data). > They found this, great, was there any indication it was accessed directly before that? Is that something that can even be investigated? You can be found "not guilty" by a jury, but that doesn't mean you are innocent. Sometimes there just isn't enough evidence of the crime. We should care more about whether a crime happened than we care about whether we can prove the crime. In cybersecurity, not having enough logging should be something along the line of negligence. > Did you prevent 845 GB of data being found by a black hat or did you find that data because of a black hat? I've seen it both ways. Some employees are diligent and go out of their way to investigate proactively. Sometimes an employee only investigates if there is a sufficiently suspicious finding. I've seen instances where the only hint that a user breached a database was a SQL query error that got logged in an application such that the app as designed couldn't generate that query.
jodrellblank 6y ago
> "the researchers warn that a motivated hacker could have used the photos and other miscellaneous information available to identify many users" FaceBook has probably done it as a part of their regular business of stalking everyone on the planet. Isn't that more alarming than what "a motivated hacker" might be able to do?
MaximumYComb 6y ago
Exposing sensitive information this stupidly should be criminally negligent. People use these platforms under an implicit trust arrangement. I suspect if I made myself look like a successful trader and told people I was a trader then they would expect I'm a trader and I can be invested with. When I lose them money I'd be charged with some serious crimes for pretending to be a trader.
- toomuchtodo 6y ago
  Call your Congressperson. Without laws that create incentives to treat this data more carefully (think GDPR), nothing changes.
  - MaximumYComb 6y ago
    I'm not in the US, however with the global internet breaches often affect people from many countries.
    - solstice 6y ago
      That's true, but adopting that stance seems to be a case of "the perfect being the enemy of the good"
  - echelon 6y ago
    With increased regulation, comes an increased barrier to entry. I'm absolutely for protecting privacy, and I hate that companies like Facebook and Google peddle our personal details for profit. I worry that unless we are careful, however, that we'll wind up creating barriers to bootstrapping. I don't want EU-style cookie banners, required GDPR data export plumbing I want privacy. But I also want an escape trajectory and ability to do thins on my own as a sole proprietorship or startup. I don't want to have to work at one of the big firms because they are the only ones that can pay for lawyers and auditing. Maybe we scale regulation with the size of a business? That seems fairer than prohibiting small startups from getting off the ground.
    - deleted 6y ago
deleted 6y ago
[deleted]
coding123 6y ago
I think to make some aspect of an S3 bucket public, you should be required to type into a box: YES, PUBLIC
- weikju 6y ago
  This is how it works since last year or so
  - coding123 6y ago
    Aah, didn't know, I thought it was the other way around for some reason.
    - ashtonkem 6y ago
      Used to be the other away around, IIRC.
jl2718 6y ago
Sounds like a CCP info harvesting op.
archeantus 6y ago
My experience with S3 buckets was that it was super painful and annoying to make the images publicly visible. So these people had to go out of their way to make this publicly accessible.
- cj 6y ago
  This is the case now. But was not the case 2-3+ years ago when most of the original infrastructure was probably set up. AWS S3 has made it significantly easier to restrict bucket access, but those are all (relatively) new changes.
whatever1 6y ago
We need a certification org like ISO to look into the practices of any data storing web service. Until recently we neglected it because the outsiders thought that it is straightforward to do so, but time after time we see ridiculous mistakes exposing sensitive data & passwords. This has to end yesterday. It is fine to fall victim of an elaborate hacking attack and lose customer data, it is not fine to not even follow a bare minimum of practices to protect their data.
- henryfjordan 6y ago
  I would like to see a Professional Personal Data Engineer license similar to becoming a PE in other engineering fields that would specifically qualify an engineer to build systems that contain PII. Then if you have a data breach you can investigate and potentially pull the license and assign personal liability similar to if a bridge fell over.
  - MrQuimico 6y ago
    Something like Europe's GDPR should be enough. And of course product certifications.
    - henryfjordan 6y ago
      I disagree. The GDPR and CCPA only have teeth against corporations. You will lose some money but nobody is going to jail over a GDPR violation. The investors will be sad but they aren't even really responsible, the employees who built the data-systems are. At the same time, you can ruin someone's life through a data-breach. Imagine you are on one of these dating apps and your boss takes a gander at the leaks and fires you because of your private life. Or worse, some bigots show up at your house and burn a cross in your yard. So how do we fix a situation where the person responsible for securing your data has no skin in the game? Put their head on the block. Other engineering disciplines hold the PE liable for mistakes because they recognize the stakes involved. I think that assigning liability is absolutely appropriate for building systems with PII. Product certifications would be great too, although that would be done by a PE so you'd kill two birds with one stone by licensing Data Engineers.
Animats 6y ago
Maybe there shouldn't be publicly accessible AWS buckets. Or, if you create one, you have to specify some public domain type license to make it clear that's your intent.
- nodesocket 6y ago
  agree, while AWS added a bunch of tooling around this, is it still entirely to easy to accidental or lazily make a bucket public. I honestly think they should consider splitting S3 into S3 public and S3 private independent services. Buckets in S3 private cannot be made public unless migrated to S3 public.
- Pfhreak 6y ago
  I set up a few websites for side projects that use Cloudfront + a public S3 bucket + Lambda for the backend when needed. It's extremely fire and forget web hosting for simple static sites and I think it costs me basically nothing. How do you enable S3 for my use case (where I am ok with all the assets being public because they are all static JS/HTML/CSS/images) but also prevent breaches like this?
  - toomuchtodo 6y ago
    > How do you enable S3 for my use case (where I am ok with all the assets being public because they are all static JS/HTML/CSS/images) but also prevent breaches like this? Do not put anything you don’t want to be public in your S3 bucket. Also, best practice would be for the bucket to be private but Cloudfront be authorized to access the objects to retrieve from the S3 origin and cache at the edge. Use a separate S3 bucket for sensitive data. Use lifecycle rules to delete objects as soon as feasible so you’re not storing sensitive data for longer than you need to. Ensure that cloudtrail logs and s3 logging is enabled for sensitive buckets, so you have access logs for forensics if you do unintentionally leak objects with sensitive data.
    - Pfhreak 6y ago
      Oh, sorry, yeah I'm aware of these things. I'm trying to square the circle where the parent suggested that maybe there shouldn't be public buckets. (And maybe that's actually true... maybe to serve from them you should be required to figure out Cloudfront.)
antibland 6y ago
Tech shops keep asking for more and more, beneath the ever-widening "full stack" moniker, and we developers do our best to oblige them. But, clearly, critical decisions are being made (or not) by people who are inexperienced yet afraid to ask for help. Maybe it's time to hire more "I-shaped" developers, rather than an org full of shaky generalists.
Noumenon72 6y ago
Would be fascinating to mine it for data about how flirting works linguistically. We've never had a corpus for that before right? Also to confirm/disconfirm those famous OKCupid posts about who wins in the dating game.
- stjo 6y ago
  Do have a link to those famous posts? I’m Interested, but the only thing I found was https://rstudio-pubs-static.s3.amazonaws.com/209370_b62220c849b946088b463fdbec935848.html https://rstudio-pubs-static.s3.amazonaws.com/209370_b62220c8...
LordAtlas 6y ago
OK, what is "Herpes Dating"? I really don't want to google it.
- jtnjns 6y ago
  I was also intrigued, it seems like you select the specific type of the herpes virus you have, and meet a partner who carries the same disease. Since these viruses are carried for life I suppose it prevents the fear of spreading it to a partner that doesn’t have it. There also actually seems to be several sites in the exact same niche which was surprising to me, when searching for the name of the site I got ads for 4 competing sites.
_salmon 6y ago
If you own buckets personally or at work and want to scan them from an outsider's perspective, you can use S3Scanner [1]. Disclosure: I wrote it and there's a major re-write coming soon(tm). [1] https://github.com/sa7mon/S3Scanner https://github.com/sa7mon/S3Scanner

131 points by georgecmu 6y ago

This would make a great dataset to train your AI on. "Yuri, why iz Lomonosov-2 supercomputer keep sending me dick pics?"

csunbird 6y ago

Another miss-configured S3 bucket, again? Really? I actually lost the count of this happening.

RL_Quine 6y ago
I know of companies who store all of their AML/KYC in AWS buckets, going back years. It's scary really.
fragmede 6y ago
If you're using AWS, where else would you put it? Fire up an EC2 instance and obscurely store it in /var/www/? These days S3 buckets start off private, and the AWS console warns you "hey, the data in this bucket is publicly accessible, are you sure?" Irresponsibility is irresponsibility, no matter the system being used. An SFTP server can be configured with PermitRootLogin yes and PermitEmptyPasswords yes so at some point it's not the software that's the issue.
- Retric 6y ago
  Amazon allows S3 to be unsecured after multiple breaches. Simply the existence of the option is a security issue. PS: It's a basic question of convenience vs security. If you allow people to lower security settings, they will. However, if Amazon onky allowed the unsecured option to be temporary say 24 hours then it would be less convenient to leave things open.
  - Pfhreak 6y ago
    I used to agree with you, back when S3 defaulted to public or at the very least made public a very easy checkbox. These days it defaults to private and you have to click many warnings and unhide options to even expose the public options. That said, I don't know that many organizations practice good hygiene about which buckets they use. Like they might just use 'the one bucket that we have as a company' rather than separating their uses into many smaller buckets that are appropriately access controlled.
  - snazz 6y ago
    I'm not sure about S3, but I use Google Cloud Storage to host my websites and large file downloads. For that to work, "allUsers" has to have the "Cloud Storage Viewer" permission. Would it be possible for that to work without allowing GCS and S3 buckets to be public?

sosuke 6y ago

Looks like the developer in question took action to correct the situation the same day they became aware of it. That at least is good. If the data was never secured in the first place can you call it a breach? They found this, great, was there any indication it was accessed directly before that? Is that something that can even be investigated? You find a door to the data unlocked. You open the door. Can you tell if someone else had opened the door before you? Did you prevent 845 GB of data being found by a black hat or did you find that data because of a black hat?

MaximumYComb 6y ago
I doubt they have sufficient logging if they didn't have any security on their data.
boomlinde 6y ago
As a user concerned with my own privacy, I don't care about the color of the hat. If it's for my eyes only and someone else looks at it, it's a breach of privacy. If that's due to the incompetence of someone I've entrusted my private information to, it's a breach of trust. If that's someone with a legal responsibility not to share the information, it reflects very poorly on them, and this level of negligence should in my opinion be considered criminal.
- ashtonkem 6y ago
  It’s a good practice for good faith security researchers to create their own account so that they can test the system without viewing an innocent users data. This is especially important for systems such as dating apps, which obviously contain extremely sensitive data.
thephyber 6y ago
> If the data was never secured in the first place can you call it a breach? Yes. It's a "breach" even if just a security researcher found it. It's sometimes even a breach even if only an employee found it (depending on the specific role of the employee and controls on the data). > They found this, great, was there any indication it was accessed directly before that? Is that something that can even be investigated? You can be found "not guilty" by a jury, but that doesn't mean you are innocent. Sometimes there just isn't enough evidence of the crime. We should care more about whether a crime happened than we care about whether we can prove the crime. In cybersecurity, not having enough logging should be something along the line of negligence. > Did you prevent 845 GB of data being found by a black hat or did you find that data because of a black hat? I've seen it both ways. Some employees are diligent and go out of their way to investigate proactively. Sometimes an employee only investigates if there is a sufficiently suspicious finding. I've seen instances where the only hint that a user breached a database was a SQL query error that got logged in an application such that the app as designed couldn't generate that query.

jodrellblank 6y ago

> "the researchers warn that a motivated hacker could have used the photos and other miscellaneous information available to identify many users" FaceBook has probably done it as a part of their regular business of stalking everyone on the planet. Isn't that more alarming than what "a motivated hacker" might be able to do?

MaximumYComb 6y ago

Exposing sensitive information this stupidly should be criminally negligent. People use these platforms under an implicit trust arrangement. I suspect if I made myself look like a successful trader and told people I was a trader then they would expect I'm a trader and I can be invested with. When I lose them money I'd be charged with some serious crimes for pretending to be a trader.

toomuchtodo 6y ago
Call your Congressperson. Without laws that create incentives to treat this data more carefully (think GDPR), nothing changes.
- MaximumYComb 6y ago
  I'm not in the US, however with the global internet breaches often affect people from many countries.
  - solstice 6y ago
    That's true, but adopting that stance seems to be a case of "the perfect being the enemy of the good"
- echelon 6y ago
  With increased regulation, comes an increased barrier to entry. I'm absolutely for protecting privacy, and I hate that companies like Facebook and Google peddle our personal details for profit. I worry that unless we are careful, however, that we'll wind up creating barriers to bootstrapping. I don't want EU-style cookie banners, required GDPR data export plumbing I want privacy. But I also want an escape trajectory and ability to do thins on my own as a sole proprietorship or startup. I don't want to have to work at one of the big firms because they are the only ones that can pay for lawyers and auditing. Maybe we scale regulation with the size of a business? That seems fairer than prohibiting small startups from getting off the ground.
  - deleted 6y ago

deleted 6y ago

[deleted]

coding123 6y ago

I think to make some aspect of an S3 bucket public, you should be required to type into a box: YES, PUBLIC

weikju 6y ago
This is how it works since last year or so
- coding123 6y ago
  Aah, didn't know, I thought it was the other way around for some reason.
  - ashtonkem 6y ago
    Used to be the other away around, IIRC.

jl2718 6y ago

Sounds like a CCP info harvesting op.

archeantus 6y ago

My experience with S3 buckets was that it was super painful and annoying to make the images publicly visible. So these people had to go out of their way to make this publicly accessible.

cj 6y ago
This is the case now. But was not the case 2-3+ years ago when most of the original infrastructure was probably set up. AWS S3 has made it significantly easier to restrict bucket access, but those are all (relatively) new changes.

whatever1 6y ago

We need a certification org like ISO to look into the practices of any data storing web service. Until recently we neglected it because the outsiders thought that it is straightforward to do so, but time after time we see ridiculous mistakes exposing sensitive data & passwords. This has to end yesterday. It is fine to fall victim of an elaborate hacking attack and lose customer data, it is not fine to not even follow a bare minimum of practices to protect their data.

henryfjordan 6y ago
I would like to see a Professional Personal Data Engineer license similar to becoming a PE in other engineering fields that would specifically qualify an engineer to build systems that contain PII. Then if you have a data breach you can investigate and potentially pull the license and assign personal liability similar to if a bridge fell over.
- MrQuimico 6y ago
  Something like Europe's GDPR should be enough. And of course product certifications.
  - henryfjordan 6y ago
    I disagree. The GDPR and CCPA only have teeth against corporations. You will lose some money but nobody is going to jail over a GDPR violation. The investors will be sad but they aren't even really responsible, the employees who built the data-systems are. At the same time, you can ruin someone's life through a data-breach. Imagine you are on one of these dating apps and your boss takes a gander at the leaks and fires you because of your private life. Or worse, some bigots show up at your house and burn a cross in your yard. So how do we fix a situation where the person responsible for securing your data has no skin in the game? Put their head on the block. Other engineering disciplines hold the PE liable for mistakes because they recognize the stakes involved. I think that assigning liability is absolutely appropriate for building systems with PII. Product certifications would be great too, although that would be done by a PE so you'd kill two birds with one stone by licensing Data Engineers.

Animats 6y ago

Maybe there shouldn't be publicly accessible AWS buckets. Or, if you create one, you have to specify some public domain type license to make it clear that's your intent.

nodesocket 6y ago
agree, while AWS added a bunch of tooling around this, is it still entirely to easy to accidental or lazily make a bucket public. I honestly think they should consider splitting S3 into S3 public and S3 private independent services. Buckets in S3 private cannot be made public unless migrated to S3 public.
Pfhreak 6y ago
I set up a few websites for side projects that use Cloudfront + a public S3 bucket + Lambda for the backend when needed. It's extremely fire and forget web hosting for simple static sites and I think it costs me basically nothing. How do you enable S3 for my use case (where I am ok with all the assets being public because they are all static JS/HTML/CSS/images) but also prevent breaches like this?
- toomuchtodo 6y ago
  > How do you enable S3 for my use case (where I am ok with all the assets being public because they are all static JS/HTML/CSS/images) but also prevent breaches like this? Do not put anything you don’t want to be public in your S3 bucket. Also, best practice would be for the bucket to be private but Cloudfront be authorized to access the objects to retrieve from the S3 origin and cache at the edge. Use a separate S3 bucket for sensitive data. Use lifecycle rules to delete objects as soon as feasible so you’re not storing sensitive data for longer than you need to. Ensure that cloudtrail logs and s3 logging is enabled for sensitive buckets, so you have access logs for forensics if you do unintentionally leak objects with sensitive data.
  - Pfhreak 6y ago
    Oh, sorry, yeah I'm aware of these things. I'm trying to square the circle where the parent suggested that maybe there shouldn't be public buckets. (And maybe that's actually true... maybe to serve from them you should be required to figure out Cloudfront.)

antibland 6y ago

Tech shops keep asking for more and more, beneath the ever-widening "full stack" moniker, and we developers do our best to oblige them. But, clearly, critical decisions are being made (or not) by people who are inexperienced yet afraid to ask for help. Maybe it's time to hire more "I-shaped" developers, rather than an org full of shaky generalists.

Noumenon72 6y ago

Would be fascinating to mine it for data about how flirting works linguistically. We've never had a corpus for that before right? Also to confirm/disconfirm those famous OKCupid posts about who wins in the dating game.

stjo 6y ago
Do have a link to those famous posts? I’m Interested, but the only thing I found was https://rstudio-pubs-static.s3.amazonaws.com/209370_b62220c849b946088b463fdbec935848.html https://rstudio-pubs-static.s3.amazonaws.com/209370_b62220c8...

LordAtlas 6y ago

OK, what is "Herpes Dating"? I really don't want to google it.

jtnjns 6y ago
I was also intrigued, it seems like you select the specific type of the herpes virus you have, and meet a partner who carries the same disease. Since these viruses are carried for life I suppose it prevents the fear of spreading it to a partner that doesn’t have it. There also actually seems to be several sites in the exact same niche which was surprising to me, when searching for the name of the site I got ads for 4 competing sites.

_salmon 6y ago

If you own buckets personally or at work and want to scan them from an outsider's perspective, you can use S3Scanner [1]. Disclosure: I wrote it and there's a major re-write coming soon(tm). [1] https://github.com/sa7mon/S3Scanner https://github.com/sa7mon/S3Scanner