- Security researchers discovered a major database with 3M+ records
- It belongs to Builder.ai, a low code/no code platform
- It contains sensitive information, NDAs, and more
Builder.ai may have unwillingly exposed sensitive information on millions of its users, researchers have claimed.
Jeremiah Fowler, a security researcher known for hunting down non-password protected databases containing sensitive intel, said he discovered an archive with more than 3 million records.
The database belongs to Builder.ai, a British no-code/low-code platform that enables businesses to quickly and affordably create custom software applications without requiring deep technical expertise.
Complexities with dependent systems
Fowler said the database contained 3,077,542 records, totaling 1.29TB in size, including cost proposals, NDA agreements, invoices, tax documents, email correspondence screenshots, internal image files, and much more.
“Among the most concerning files were two documents that indicated access and configuration details of two separate cloud storage databases that also included secret access keys,” Fowler said on Website Planet.
“It is hypothetically possible that those access keys could have revealed additional potentially sensitive data if they were to fall into the wrong hands.”
In total, there were 337,434 invoices and 32,810 files labeled Master service agreements. The latter also contained NDA agreements with names, emails, IP addresses, project cost summaries, and other project details.
Fowler disclosed his findings to Builder.ai, however it couldn’t lock the database down even a month later, citing “complexities with dependent systems” – and it isn’t known if the database is still open and accessible.
Misconfigured databases remain one of the number one reasons for data leaks on the internet. Many researchers are warning that organizations don’t understand the shared security model present in most cloud service providers, and that they end up generating enormous databases, filled with valuable information, which are open and accessible to all.
Should cybercriminals find these archives, they could use the information there in convincing phishing attacks, identity theft, and possibly even wire fraud.
