How an open storage bucket exposed records on over 500,000 Ghanaian graduates

This is our reading of a public report by the vpnMentor research team. GravexLabs was not involved in finding or fixing this exposure. We are writing about it because the mistake behind it is one we look for in every infrastructure test, and it is cheap to prevent.

What the report says

On 29 September 2021, vpnMentor's researchers found an Amazon S3 storage bucket belonging to Ghana's National Service Secretariat (NSS) that anyone on the internet could open. No password and no account were needed.

According to their report, the bucket held:

• About 55 GB of data in roughly 3.8 million files, dating back to March 2018
• More than 330,000 service certificates
• More than 12,000 scanned ID cards, including health insurance and professional IDs
• About 912,000 passport photos
• Spreadsheets with names, NSS numbers, positions and pay for more than 43,000 people

vpnMentor estimated that 500,000 to 600,000 people were affected, and possibly up to 700,000.

The researchers wrote to the NSS on 6 October 2021 and again on 12 October, and say they received no reply. They contacted Ghana's national computer emergency response team, CERT-GH, on 7 October. CERT-GH replied on 12 October confirming it had verified the problem.

The detail that matters

Some of the files were password-protected. That should have limited the damage, and it did not.

The report says other copies of the same data sat unprotected in another folder of the same bucket. It also notes that about 749,000 QR codes in the bucket each linked to an unencrypted certificate, which may have made the passwords on the certificates pointless.

Protecting individual files is not a substitute for locking the container they are in. If the bucket is open, one forgotten folder undoes everything else.

Why this keeps happening

Nobody decides to publish half a million ID photos. It usually goes like this:

1. A developer needs the app to show an uploaded photo, and making the bucket public is the fastest way to make the image load.
2. It works, the feature ships, and nobody comes back to it.
3. Three years later the bucket holds everything the app has ever stored.

Nothing breaks, so nothing prompts anyone to look. The exposure in the report ran from 2018 until it was found in 2021.

Check your own storage in 5 minutes

If your organisation uses AWS, run these against each bucket. Replace NAME with the bucket name.

Ask AWS whether the bucket is public:

aws s3api get-bucket-policy-status --bucket NAME
aws s3api get-public-access-block --bucket NAME

Then test it the way an outsider would, with no credentials:

curl -I https://NAME.s3.amazonaws.com/

A 403 means the bucket refused you. A 200 means anyone can list its contents.

Then turn on Block Public Access for the whole AWS account, so a single wrong setting on one bucket cannot expose it. If an app needs to show private files to signed-in users, have the server issue short-lived signed links instead of making the bucket public.

Google Cloud Storage and Azure Blob Storage have the same risk and the same kind of account-wide setting.

What a test would have found

Open storage is one of the first things an external infrastructure test looks for, because attackers look for it first too. Finding it takes minutes. In this case it was open for about 3 years.

Under Ghana's Data Protection Act, 2012 (Act 843), organisations that hold personal data are responsible for securing it. Checking what you expose to the internet is the least expensive way to meet that duty.

Source

• Report: Ghana government agency exposes 100,000s of citizens in massive data breach, vpnMentor research team