A people-search service that invites users to upload a photograph and identify the person in it left more than 9 million image files reachable on the open internet, according to research published this week.
Security researcher Jeremiah Fowler found approximately 9,042,977 image files totalling 450.2GB in a storage bucket that was neither password-protected nor encrypted. The files sat in folders labelled “faces” and “profiles”, reachable through a URL contained in ClarityCheck’s own website code. Fowler said a limited sample he reviewed included facial images of adults, teenagers and children, many appearing to originate from private profiles, social media accounts, dating app accounts or screenshots. Face data has proved a recurring soft target, as a deepfake database breach exposing thousands of explicit images demonstrated.
A second misconfiguration involved the company’s APIs: entering a name into a manipulated website URL returned potential email addresses, physical addresses and phone numbers, using an ordinary browser.
ClarityCheck disputes the characterisation. “We do not accept that data in the temporary storage location was ‘publicly exposed,’ which implies large-scale public access,” a spokesperson said. “Access required knowledge of a specific, unindexed URL that was not discoverable through ordinary use of the ClarityCheck service or a general web search.” The company said the material includes duplicate, cropped and resized copies of the same files along with non-image data rather than 9 million unique images, and that it has improved its security reporting procedures.
Security practitioners use a wider definition. “Exposure is the state in which personal or sensitive data has been left accessible, discoverable, or otherwise put at risk of unauthorized access, whether or not anyone has yet taken or misused it,” said Mark Beare, head of consumer products at Malwarebytes. “A publicly reachable database backup, a misconfigured storage bucket, or credentials sitting in a system that a researcher can reach are all exposures.”
ClarityCheck requires users to attest they have permission to upload a photo, but the service is built to identify strangers. “If you’re trying to find out who a person is, you might not have authorization or permission, so people might not know that their image had been dumped into this database that was public,” Fowler said. “An AI bot could crawl it, extract faces, and use them for training. And there are lots of pictures of kids in there.”
The company secured the bucket and the URLs after being contacted in July, though Fowler said the data appeared exposed for months and his own attempts to reach the company were initially unsuccessful. Accidental exposures carry particular risk for biometric data, because a face, unlike a password, cannot be changed after it leaks, a concern that also followed leaked biometric police records in India.
–
By the ID Tech Editorial Team
