An unsecured database exposed the personal details of 202M job seekers in China

The personal details belonging to more than 202 million job seekers in China, including information like phone numbers, email addresses, driver licenses and salary expectations, were freely available to anyone who knew where to look for as long as three years due to an insecure database.

That’s according to findings published by security researcher Bob Diachenko who located an open and unprotected MongoDB instance in late December which contained 202,730,434 “very detailed” records. The database was indexed in data search engines Binary Edge and Shodan, and was freely visible without a password or login. It was only made private after Diachenko released information about its existence on Twitter.

Diachenko, who is director of cyber risk research at Hacken, wasn’t able to match the database with a specific service, but he did locate a three-year-old GitHub repository for an app that included “identical structural patterns as those used in the exposed resumes.” Again, ownership is not clear at this point although the records do seem to contain data that was scraped from Chinese classifieds, including the Craigslist-like 58.com.

A 58.com spokesperson denied that the records were its creation. They instead claimed that their service had been the victim of scraping from a third-party.

“We have searched all over the database of us and investigated all the other storage, turned out that the sample data is not leaked from us. It seems that the data is leaked from a third party who scrape[d] data from many CV websites,” a spokesperson told Diachenko.

TechCrunch contacted 58.com but we have not yet received a response.

While the database has now been secured, it was potentially vulnerable for up to three years and there’s already evidence that it had been regularly accessed. Although, again, it isn’t clear who by.

“It’s worth noting that MongoDB log showed at least a dozen IPs who might have accessed the data before it was taken offline,” Diachenko wrote.

There’s plenty of mystery here — it isn’t clear whether 58.com was behind the hole, or if it is a rival service or a scraper — but what is more certain is that the vulnerability is one of the largest of its kind to be found in China.

Toymaker VTech Leaks Millions Of Parent Emails And Child Photos In Latest Massive Breach

Screen Shot 2015-11-30 at 5.17.07 PM In the first breach that seems to have hit both adults and children at the same time interactive toy maker VTech has confirmed hackers have accessed private data including names, email addresses, and passwords as well as some mailing addresses and download history. The company claims that no credit card data was stolen but it seems that multiple headshots of parents and children are now in… Read More

Six Lessons From Cybersecurity Superhero Training

heroes One of my distinct grade-school memories is filing out of fourth grade class, nervous, but excited to miss a portion of math class. We were having our quarterly disaster-survival drill; instructing students on what to do in case disaster strikes. While working through yet another attempted malicious cybersecurity attack it dawned on me, why can’t we apply this diligence and training… Read More

Kill The Password

Silly password rules like "start with a letter to younger self." There are a myriad of problems with the password in the modern computing context. We are no longer signing onto a single mainframe. We have multiple applications in use across various platforms. That means we are forced to remember far too many passwords. This causes people to use silly ones like 1234 or the same password across multiple sites, not even attempting to be secure. Think… Read More