Bad Box configurations lead to leaks of sensitive corporate data

Box allows users to easily share files that are vulnerable to brute-force attacks, cybersecurity company Adversis said.

Dozens of organizations left terabytes of data exposed online through web links to files hosted on data-sharing platform Box, according to research published Monday.

The exposed data, which spanned hundreds of thousands of documents, included Social Security and bank account numbers; hundreds of passport photos; files of technology prototypes; VPN configurations; and financial data and invoices, according to Adversis, a vulnerability assessment company.

Box allows users to easily share files that, if not properly secured, are vulnerable to brute-force attacks, the research shows. After locating the sub-domains of various corporate Box accounts, Adversis researchers began brute-forcing files and folders, “returning results faster than we could review them.”

TechCrunch was first to report on the data leak.

As the researchers pointed out, their findings have parallels with security problems in another popular data storage service – Amazon Web Services S3 “buckets” – which are routinely exposed online. The Box issue is worse in that it is pretty easy to find a company’s Box account, but not as bad in the sense that an organization’s employees are less likely to load full databases into Box, Adversis said.

“If your company uses Box, there is a good chance you are leaking sensitive data already and you may want to finish reading this after you disable public file sharing,” Adversis wrote in a blog post.

The company said it had planned to contact all the affected organizations, but “quickly realized that was impossible at this scale.” Aside from Box, the researchers ultimately only communicated with a “small minority” of the affected vendors and companies, including those with the most sensitive data exposed. Most organizations that were contacted swiftly mitigated the issue, Adversis said.

Box has updated its file-sharing guidance, advising people to set default access to share files only with internal company users.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure