InfoSecBulletin Cybersecurity for mankind
Cybersecurity researcher Jeremiah Fowler has uncovered a major data breach at ChoiceDNA, an Indiana-based firm offering DNA testing and facial recognition services involving biometric images and personal information.
Fowler reported to Infosecbulletin that around 8,000 sensitive documents, including biometric images and metadata, were publicly accessible without password protection.
Authority Denies
Hacker claim ransomware attack on Indonesia’s state bank BRI
London-based company “Builder.ai” reportedly exposed 1.2 TB data
(CVE-2024-12727, CVE-2024-12728, CVE-2024-12729)
Sophos resolved 3 critical vulnerabilities in Firewall
“Workshop on Cybersecurity Awareness and Needs Analysis” held at BBTA
CVE-2023-48788
Kaspersky reveals active exploitation of Fortinet Vulnerability
U.S. Weighs Ban on Chinese-Made Router TP-Link: WSJ reports
Daily Security Update Dated: 18.12.2024
CISA released best practices to secure Microsoft 365 Cloud environments
Data breach! Ireland fines Meta $264 million, Australia $50m
Over 25K SonicWall VPN Firewalls exposed to critical flaws
The unsecured WordPress folder exposed data that included facial recognition images and personally identifiable information (PII) like names, phone numbers, email addresses, and sensitive notes on DNA face matching tests.
Fowler’s findings indicate that the data was accessible for an unknown time, with the security flaw fixed only a week after it was reported. The full extent of the compromised data access is still unclear, pending a forensic audit.
Fowler explained hackread that Biometric data, such as facial recognition information, is highly sensitive and can be used to identify individuals, track their movements, and even manipulate their identities through deepfakes. Collecting, storing, and analyzing such data without explicit consent is a serious violation of individual privacy.
ChoiceDNA, an Indiana company that provides DNA testing and facial recognition services, may encounter ethical and legal issues due to these practices. Several U.S. states have strict biometric privacy laws, and the Federal Trade Commission (FTC) has warned about the risks of biometric data misuse, such as fraud and impersonation.
Fowler issued a responsible disclosure notice to the company, leading to the quick securing of the database. This incident emphasizes the importance of secure data storage. While WordPress is widely used, it can be vulnerable if not set up properly. In this case, sensitive data was stored in an unsecured WordPress folder, underscoring the need for strong security measures.
The incident highlights serious security issues with companies storing sensitive biometric data, especially those using WordPress. Experts suggest using more secure options like cloud solutions and implementing additional safeguards such as two-factor authentication (2FA) and Web Application Firewalls (WAF).
NIST unveils new password guidelines 2024: 11 rules to follow
