100GB of secret NSA data found on unsecured AWS S3 bucket

The data related to a failed NSA cloud collaboration project

Leaky bucket

The NSA has been hit by yet another data leak, as over 100GB of sensitive, classified data was exposed through shoddy security practises.

The leak came from a virtual copy of a hard drive belonging to US Intelligence and Security Command (INSCOM), an intelligence organisation operating within both the US Army and the NSA.

The virtual disk image was discovered by UpGuard cyber risk research director Chris Vickery on an unprotected public Amazon S3 server, meaning that anyone who knew the web address where the data was stored could freely access it.

Unsecured S3 buckets are a frequent cause of embarrassing data breaches for many companies and government organisations. The personal details of two million Dow Jones customers were exposed in a similar fashion earlier this year, as were customers of Accenture and the WWE.

"Regrettably, this cloud leak was entirely avoidable," UpGuard said in a blog post announcing the discovery, "the likely result of process errors within an IT environment that lacked the procedures needed to ensure something as impactful as a data repository containing classified information not be left publicly accessible."

"Plainly put, the digital tools needed to potentially access the networks relied upon by multiple Pentagon intelligence agencies to disseminate information should not be something available to anybody entering a URL into a web browser," the post said. "Although the UpGuard Cyber Risk Team has found and helped to secure multiple data exposures involving sensitive defense intelligence data, this is the first time that clearly classified information has been among the exposed data."

The drive in question contained a trove of data related to a US military project codenamed 'Red Disk', a failed cloud collaboration and content sharing platform designed to let field troops access real-time intelligence data from the Pentagon, including satellite and drone imagery.

The drive also included hashed passwords for internal systems, as well as private keys belonging to third-party INSCOM defence contractors for accessing "distributed intelligence systems". Multiple areas of the drive were marked 'Top Secret', with some sections even bearing the 'NOFORN' designation, indicating that they were to be kept secret even from the US government's foreign intelligence allies.

IT Pro has reached out to the NSA to ask why the appropriate protections were not taken, and will update this piece when we hear back.

Featured Resources

The complete guide to changing your phone system provider

Optimise your phone system for better business results

Download now

Simplify cluster security at scale

Centralised secrets management across hybrid, multi-cloud environments

Download now

The endpoint as a key element of your security infrastructure

Threats to endpoints in a world of remote working

Download now

2021 state of IT asset management report

The role of IT asset management for maximising technology investments

Download now

Recommended

What is DevSecOps and why is it important?
Security

What is DevSecOps and why is it important?

30 Oct 2020
Weekly threat roundup: NHS COVID-19 app, Nvidia, and Oracle
Security

Weekly threat roundup: NHS COVID-19 app, Nvidia, and Oracle

30 Oct 2020
Ryuk behind a third of all ransomware attacks in 2020
Security

Ryuk behind a third of all ransomware attacks in 2020

29 Oct 2020
REvil hacking group says it has made more than $100m in a year
Security

REvil hacking group says it has made more than $100m in a year

29 Oct 2020

Most Popular

Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

21 Oct 2020
What is Neuralink?
Technology

What is Neuralink?

24 Oct 2020
Hackers demand ransom from therapy patients after clinic data breach
Security

Hackers demand ransom from therapy patients after clinic data breach

27 Oct 2020