Experts Alarmed Over Gyazo’s Breach of 490 Million Metadata Records

Security experts have warned that a major data breach at a Japanese image-sharing service could pose a significant security and privacy risk to users via exposed metadata records.

The breach at Gyazo, disclosed on September 11, exposed nearly 24 million customer records after attackers exploited a vulnerability in an upload server. 

However, an additional 490 million metadata records related to images were also exposed in the incident. This includes image IDs, source IP addresses, user agent, EXFIL location data, OCR text extracted from images, titles, source URLs, hashed passphrases, and more.

“The affected metadata includes information used to construct Gyazo image URLs,” Gyazo developer Helpfeel said in a blog post on September 16. “This information could be used by a third party to access and view the corresponding images without authorization. We have temporarily disabled viewing of some images to prevent further harm.”

Michael Bell, founder and CEO at Suzu Labs, said the incident could be bad news for developers and the projects they were working on.

“Gyazo is a screenshot tool. Developers use it constantly to share what is on their screen, which means those images contain terminal output, API keys, credentials in config files, internal application screenshots, and sensitive documents,” he explained.

“The OCR feature that makes captures searchable also extracted and stored all of that text. Whatever text was visible in those screenshots is now in an attacker's hands as searchable, indexed data, not just pixels.”

Bell added that EXIF location may compound these risks, potentially exposing home addresses, workplace locations, and regularly visited places.

Seemant Sehgal, CEO at BreachLock, agreed that metadata presents the biggest potential risk to victims.

“The metadata layer is where the real reach is,” he argued. “EXIF coordinates, OCR-extracted text, session IDs, and image URL construction data give an attacker enough to reconstruct user behavior and location history for tens of millions of people who uploaded a screenshot and never thought about it again.”

However, others were more sanguine about the metadata breach. Damian Skeeles, senior solutions engineer manager at Filigran, pointed out that the stolen data is associated with images registered in or before January 2019.

“The fact this is mostly data more than six years old reduces the impact of screenshot leaks that could include API keys and other secrets, and reinforces the value of regularly cycling credentials,” he said.

Helpfeel Urges Password Reset

As part of its incident response efforts, Helpfeel said it has remediated the vulnerability that was targeted, and it urged customers to change their passwords across this and any other site that share the same credentials. In any case, they are hashed, which will reduce risk exposure.

It also encouraged users to remain on the lookout for suspicious follow-on emails.

“Email addresses and other identifying info could be used to craft convincing phishing messages for which victims should be on alert,” agreed Comparitech consumer privacy advocate, Paul Bischoff.

“Scammers might pose as Gyazo or a related company to trick victims into clicking on malicious links that lead to malware and scams.”

There are also bigger lessons to learn from the incident for cybersecurity leaders, according to CyberSmart CEO, Jamie Akhtar.

“Organizations must rigorously patch and test internet-facing services, restrict what upload systems can access, and use continuous monitoring to identify suspicious behaviour quickly,” he said.

“Following a breach, they should invalidate sessions and access tokens, force password resets and communicate clearly with users.”