Pocket iNet, an internet service provider in Washington, left an AWS S3 server exposed without a password, according to UpGuard. The UpGuard team announced that the information exposed on the server included more than 73GB of data, which held passwords and other sensitive information ranging from spreadsheets to images and charts.
UpGuard discovered and reported the AWS bucket named pinapp2 on October 11, 2018, although Pocket iNet initially did not confirm that any files were exposed. A week later, the server was secured. “During the 7 days that the data was exposed, UpGuard made extensive efforts to contact the department managing the server, even using data located inside the exposed server. “It is known that internet providers are often targeted by hacker groups. Fortunately, on October 19, the server was secured, preventing the exploitation of the available data once and for all.”
While the server itself was exposed, not all files were available for download. However, one of the folders available for download named “tech” contained critical information about usernames and passwords from employee devices such as personal devices, routers, switches, servers, wifi access points, and more. The data was stored in plain text format without any encryption.
The problem with unprotected AWS servers is a common occurrence and is the fault of each server administrator. According to Upguard, Pocket iNet is one of many internet providers that, due to their small size, do not emphasize the IT part. Organizations should adopt techniques and policies that will prevent such misconfigurations in the future.
