Recently I discovered an open and non-password protected database that contained 12,976,279 records. The total size of the dataset was 58 GB and contained content management data, including employees PIIs. Upon further research nearly all records contained information indicating FOX content, storage information, internal FOX emails, usernames, employee ID numbers, affiliate station information and more. The records also captured a wide range of data points including event logging, host names, host account numbers, IP addresses, interface, device data, and much more.
The environment was listed as “CMS” and we did not see any references to test or demo inside the records. The digital asset management database shows a detailed look at the internal collaborative environment divided by users, administrators, and content.
What the database contained:
The FOX Security Team acted fast and professionally to close access to the unsecured and publicly exposed database. It is unclear how long these records were exposed or who else may have had access to the dataset. As security researchers we never extract or download the data we find and only take a limited number of screenshots for validation purposes. We are not implying any wrongdoing by FOX, Comcast Technology Solutions or their partners. Nor, are we implying that any customer or user data was at risk.
You can view my full report here.
Stay ahead of cyber threats with Security Discovery. We offer expert consulting, comprehensive services, and a powerful vulnerability monitoring SaaS platform. Protect your business proactively - get in touch today for personalized digital security solutions.