Cloud companies allow clients to store data. But it's up to the clients themselves to secure the data they have.
Azure Blob storage is a feature of Microsoft Azure that allows users to store large amounts of unstructured data on Microsoft's cloud data storage platform.
And here, a UK-based company in Surrey failed to secure its data, and inadvertently exposed more than half a million sensitive documents of its customers to the internet. The documents that were stored in an unprotected Microsoft Azure Blob storage could be viewed by anyone with the direct address of the files, without any kind of authentication.
The database owned by the company called Probase, as reported by The Register, had at least 587,000 files, ranging from backed-up emails to letters, spreadsheets, screenshots, and more.
It was security researcher Oliver Hough who first discovered the unsecured database, and reported it dur to the lack of security controls on it.
"Finding a storage bucket like this where a provider has lumped all of their clients' files in a single bucket rather than creating separate storage for each client demonstrates how, in 2020, the basics of secure design are still not being followed,” Hough told The Register.
The blob contained occupational health assessments, insurance claim documents from several U.S. firms underwritten by Lloyds of London, internal complaints from food company Huel, senior barristers' private opinions about junior colleagues applying for promotion at QC Appointments, FedEx shipment security documentation, along with some other highly sensitive medical data.
Other customers also include both the Halal and Kosher certification bodies, which issue certificates to food suppliers confirming that their goods meet the Islamic and Jewish faiths' respective religious requirements, and at least one passport scan among others.
The files could be dated back to 2013.
The unsecured database appeared to be in the public cloud underpinning one of its CRM products
When approached, Probase director Paul Brown, did not comment on how long the blob had been left unsecured, but said that his company is working with the Information Commissioner's Office to resolve the issue.
Microsoft offers several options for customers to store data on the cloud. Each option it offers has its unique purpose for serving different business needs.
From the various options available in the Azure Storage Account for storing user data, include File Storage, Table Storage, and among others, also includes Blob Storage.
According to Microsoft's website, Azure Blob storage is "Microsoft's object storage solution for the cloud."
The store is optimized for users to store massive amounts of unstructured data, meaning that the data doesn't adhere to a particular data model or definition. The objects which are being stored in Blob does not necessarily have an extension. For example, this blog data can include text or binary data.
Azure's Blob storage is designed for:
- Serving images or documents directly to a browser.
- Storing files for distributed access.
- Streaming video and audio.
- Writing to log files.
- Storing data for backup and restore, disaster recovery, and archiving.
- Storing data for analysis by an on-premises or Azure-hosted service.
