The personal details belonging to more than 202 million job seekers in China, including information like phone numbers, email addresses, driver licenses and salary expectations, were freely available to anyone who knew where to look for as long as three years due to an insecure database.
That’s according to findings published by security researcherÂ Bob Diachenko who locatedÂ an open and unprotected MongoDB instance in late December which containedÂ 202,730,434 “very detailed” records. The database was indexed in data search enginesÂ Binary EdgeÂ and Shodan, and was freely visible without a password or login. It was only made private afterÂ Diachenko released information about its existence on Twitter.
Diachenko, who is director of cyber risk research atÂ Hacken, wasn’t able to match the database with a specific service, but he did locateÂ a three-year-old GitHub repository for an app that included “identical structural patterns as those used in the exposed resumes.” Again, ownership is not clear at this point although the records do seem to contain data that was scraped from Chinese classifieds, including the Craigslist-like 58.com.
A 58.com spokesperson denied that the records were its creation. They instead claimed that their service had been the victim of scraping from a third-party.
“We have searched all over the database of us and investigated all the other storage, turned out that the sample data is not leaked from us.Â It seems that the data is leaked from a third party who scrape[d] data from many CV websites,” a spokesperson toldÂ Diachenko.
TechCrunch contacted 58.com but we have not yet received a response.
While the database has now been secured, it was potentially vulnerable for up to three years and there’s already evidence that it had been regularly accessed. Although, again, it isn’t clear who by.
“Itâ€™s worth noting that MongoDB log showed at least a dozen IPs who might have accessed the data before it was taken offline,”Â Diachenko wrote.
There’s plenty of mystery here — it isn’t clear whether 58.com was behind the hole, or if it is a rival service or a scraper — but what is more certain is thatÂ the vulnerability is one of the largest of its kind to be found in China.
Source: Techcrunch Disrupt