Sansec reveals how online stores expose private data, backups

According to Sansec, approximately 12 per cent of online stores fail to backup their public folders due to human error or negligence. As a result, online stores have exposed private backups in public folders, including internal account passwords, which can be used to take over e-commerce sites and extort owners.

Sansec said it examined 2,037 different stores and discovered 250 (12.3 per cent) exposed ZIP, SQL, and TAR archives on public web folders that can be accessed without authentication. According to Sansec, these archives appear to be backups that contain database passwords, secret administrator URLs, internal API keys, and customer PII (personally identifiable information).

According to Sansec, its analysts see constant activity from attackers who launch automated scans in an attempt to locate these backups and perform breaches. Furthermore, the presence of multiple source IPs for these attacks indicates that threat actors are well aware of the existence of exposed backups and are attempting to exploit them.

If the exposed backups contain administrator credentials, master database passwords, or staff accounts, attackers can use them to gain access to the site and steal data or launch destructive attacks.

“Online criminals are actively scanning for these backups, as they contain passwords and other sensitive information,” reads the Sansec report “Exposed secrets have been used to gain control of stores, extort merchants and intercept customer payments.”

The sources for this piece include an article in BleepingComputer.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web