A new set of problematic databases was discovered to have been accessible and unprotected. The database includes private information of more than 33 million employment profiles, history, and data. Experts are worried since these sensitive data are open for scammers, phishers, and identity thieves to target.
The said database was discovered by Sanyam Jain, a security researcher from GDI.Foundation, using the Shodan search engine. GDI.Foundation is a non-profit organization that has disclosed thousands of unprotected database and data leaks since its foundation. The same organization disclosed the existence of the ‘BreedReady’ database last week.
It appears that the database included more than 57GB of information and profiles in China who uploaded their resume and employment history to job recruitment websites. It contains data such as the job seeker’s username, gender, age, current city, home address, email address, phone number, marriage status, job history, education history, and salary history. Below is an example of what the database looks like.
The database was discovered last March 10th, 2019 and Jain said that he tried to determine and identify the owner of the database to warn them that the data was leaked and to help them secure it. According to Jain, he was not able to determine the owners of the said database, but he was able to see references to multiple Chinese job recruitment companies such as 51Jobs, Lagou, and Zhilian.
“During the initial investigation, what I have found is that the customer profiles for the companies 51Jobs, Lagou, and Zhilian recruitment are being stored in the database. I believe that a third party is aggregating the information from these companies and using them in some way,” Jian said.
With the massive amount of information being stored in the said job profile database, cybercriminals, or anyone for that matter, can use the data to launch cyber attacks, phishing attacks, and identity theft. Furthermore, companies can also use the said data to pirate employees from other companies by leveraging their knowledge of their salary and employment history.
Ultimately, Jian was able to trace the database to an owner in China and have reached out to CNCERT, the China Cyber emergency response team, on March 11 to help him close down the problematic database. On March 13, 2019, he was notified that the database had been closed down.
Until now, it is still unclear how the data was being used amidst the identification of who owns it. In a tweet that Jain posted, he said that people should be cautious about uploading their profiles online.
“Now, uploading profiles online is also not secure. It’s very well said: don’t trust anybody. As when a person gives his profile, he tries to give every small possible detail about him which is now accessed by anyone and can be modified,” Jian wrote.
“I don’t understand how the companies can put up all these online. My advice: please do hire cybersecurity experts, you really needed it.”
CHINA’S CYBERSECURITY PROBLEM
Late last week, Z6 Mag reported about the discovery of a Chinese database that included the data of more than 1.8 million Chinese women including their names, addresses, phone numbers, and interestingly, their “BreedReady” status.
According to Victor Gevers, the cybersecurity expert who discovered the said database, it contains information that is similar to other vulnerable databases that he and his team has uncovered in the past. The discovery of the said database is suggesting that there are other databases from Chinese companies that are vulnerable and unprotected.
While organizations like GDI.Foundation is uncovering these databases and reporting them as they discover them, it is still unsafe for Chinese people when these data go out in public. It’s very indicative of the poor cyber security protocol that exists in the country as someone from the United States can retrieve those data; anyone with adept knowledge in database search can do so too.
Yesterday, Gevers also discovered two more databases that appear to have similar code scheme as the ‘BreedReady’ database. He postulates that the three databases he recently uncovered were all related to each other and that he was able to trace the two new databases to a university in China. He said that these databases could be a student project that was left unprotected. /apr