InfoSecBulletin Cybersecurity for mankind
Cybersecurity researcher Jeremiah Fowler has uncovered a major data breach at ChoiceDNA, an Indiana-based firm offering DNA testing and facial recognition services involving biometric images and personal information.
Fowler reported to Infosecbulletin that around 8,000 sensitive documents, including biometric images and metadata, were publicly accessible without password protection.
WhatsApp banned on all US House of Representatives devices
Kaspersky found “SparkKitty” Malware on Google Play, Apple App Store
OWASP AI Testing Guide Launched to Uncover Vulns in AI Systems
Axentec Launches Bangladesh’s First Locally Hosted Tier-4 Cloud Platform
Hackers Bypass Gmail MFA With App-Specific Password Reuse
Russia detects first SuperCard malware attacks via NFC
Income Property Investments exposes 170,000+ Individuals record
ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs
CISA Flags Active Exploits in Apple iOS and TP-Link Routers
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online
The unsecured WordPress folder exposed data that included facial recognition images and personally identifiable information (PII) like names, phone numbers, email addresses, and sensitive notes on DNA face matching tests.
Fowler’s findings indicate that the data was accessible for an unknown time, with the security flaw fixed only a week after it was reported. The full extent of the compromised data access is still unclear, pending a forensic audit.
Fowler explained hackread that Biometric data, such as facial recognition information, is highly sensitive and can be used to identify individuals, track their movements, and even manipulate their identities through deepfakes. Collecting, storing, and analyzing such data without explicit consent is a serious violation of individual privacy.
ChoiceDNA, an Indiana company that provides DNA testing and facial recognition services, may encounter ethical and legal issues due to these practices. Several U.S. states have strict biometric privacy laws, and the Federal Trade Commission (FTC) has warned about the risks of biometric data misuse, such as fraud and impersonation.
Fowler issued a responsible disclosure notice to the company, leading to the quick securing of the database. This incident emphasizes the importance of secure data storage. While WordPress is widely used, it can be vulnerable if not set up properly. In this case, sensitive data was stored in an unsecured WordPress folder, underscoring the need for strong security measures.
The incident highlights serious security issues with companies storing sensitive biometric data, especially those using WordPress. Experts suggest using more secure options like cloud solutions and implementing additional safeguards such as two-factor authentication (2FA) and Web Application Firewalls (WAF).
NIST unveils new password guidelines 2024: 11 rules to follow
