- Security researchers found an unprotected Amazon S3 bucket
- It belongs to WorkComposer, an employee tracking app
- The bucket contained 21 million screenshots
A major time-tracking company has been leaking sensitive screenshots on the open internet, putting countless people and organizations at risk of identity theft, data breaches, wire fraud, scams, and more.
Cybersecurity researchers at Cybernews found an archive of “millions of real-time screenshots” generated by WorkComposer, which calls itself an “employee productivity monitoring tool”.
These screenshots show what the employee is working on at any given time, which could include sensitive communications and emails, login portals, passwords, intellectual property, proprietary data, and more.
Millions of screenshots
Leaking these screenshots is a major privacy violation, and could spell trouble for the company, if data watchdogs and privacy organizations get involved.
Cybernews said that WorkComposer exposed more than 21 million images in an unsecured Amazon S3 bucket. The company claims to have more than 200,000 active users.
It could also spell trouble if it turns out that cybercriminals found the bucket in the past. At press time, there was no evidence that it did happen, and the company apparently locked the archive down in the meantime.
WorkComposer is basically a surveillance tool built primarily for remote workers, allowing bosses and managers to keep track of what their employees are doing. It logs hours, app use, but most importantly – it grabs screenshots every 20 seconds.
Undefended, or poorly protected databases are one of the most common causes of data leaks. Just this year, more than 2.8 billion records were leaked across the web, as businesses of different sizes and in different industries were found holding sensitive data in an unlocked cloud instance.
Security researchers are warning that many companies don’t truly understand the concept of “shared responsibility” when it comes to securing the cloud, and have urged organizations to secure their databases and monitor the logs for unauthorized entry.
Leave a comment