Topic
Unauthenticated object storage buckets and leaked bucket URLs as a recurring cause of large-scale data exposure.
Stave flagged 47 security findings in the documented AWS defaults of Mastodon, Discourse and Chatwoot, according to a dev.to post. None of the three configures bucket encryption, access logging or Public Access Block, so whoever creates the bucket has to add them.
Reality
CISA says Viidure's dashcam platform keeps user records, live footage and firmware in a cloud bucket that anyone on the internet can read. Viidure did not answer CISA and plans no fix, so the advisory can only point users to the vendor's support page.
Reality
Four HackerOne reports cited in a dev.to analysis trace to S3 write scope set wider than the one object an upload needs. Only one of them is the starts-with key condition that turns a signed upload form into write access across a whole prefix.
Reality
ClarityCheck exposed 450GB of photos plus a second leak of emails and phone numbers, according to researcher Jeremiah Fowler. The company disputes the word "exposed."
Perspective Coverage
4 publishersReality
A researcher found 450GB of uploaded photos with no authentication in front of them at US lookup service ClarityCheck. A face, unlike a password, cannot be reset.
Reality