[经验] [WSJ独家]阿里巴巴高管因警方数据泄露事件被中国当局约谈

As the investigation continued, Alibaba Cloud ordered staff to review details such as the database architecture and configurations in contracts with key clients, especially those with dedicated private cloud resources such as ** agencies and financial institutions, according to employees familiar with the matter and a cloud customer.

Neither Alibaba nor the Shanghai police have commented on the discovery by cybersecurity researchers last week that the dashboard for the stolen police database had been left without a password.

According to researchers at LeakIX and SecurityDiscovery, two cybersecurity companies that scan the web for unsecured databases, the dashboard lacked a password, and there wasn’t a way to add one.

Both the database that Alibaba provided for storing the data and the dashboard for accessing and managing it were using versions of the products that were several years outdated, the researchers said. Those versions didn’t include any security features, such as password protection, without a separate add-on that was never installed, they said.

The missing add-on didn’t matter for the database, which was kept on a secure private server, but the dashboard was set up on the public internet, acting like an open door to the data vault and allowing the information inside to be exported unencumbered.

The database was also missing an up-to-date security certificate, a unique digital identifier used to encrypt web traffic that has become standard practice. Alibaba last deployed a new certificate in September 2017, which expired a year later and was never renewed, according to the researchers.

The reliance on an expired certificate didn’t increase the vulnerability of the database but indicates that upkeep had been neglected, said Gregory Boddin, LeakIX’s chief technology officer. “There was no maintenance whatsoever on it,” he said, for at least the past four years.

LeakIX and SecurityDiscovery both said they found 13 other Alibaba-hosted databases that used the same outdated version of the database and dashboard products, and that had been set up identically with the database on a private server and the dashboard on the public internet. All 13 also shared the same certificate that then expired, which bucks best practices for security, Mr. Boddin said.

Nearly all had been left open upward of a year, according to LeakIX’s records. Two contained even more data than the 23 terabytes stolen from the Shanghai police: One had over 60 terabytes, while the other had over 92 terabytes.

“Even one day is enough for a database of such size to be grabbed and collected by malicious actors,” said Bob Diachenko, owner of SecurityDiscovery.

In early July, shortly after the leak began gaining widespread attention on social media, Alibaba cut public access to all 14 databases, Messrs. Boddin and Diachenko said.

Alibaba founder Jack Ma was an early evangelist of the use of data in policing and social control. In 2016, he delivered a speech to 1.5 million political and legal officials in which he said analysis of vast quantities of data would help the public security agencies track down thieves and predict terrorist attacks before they happened.

Alibaba Cloud is the biggest public cloud-service provider in China, but it lags far behind competitors like Huawei Technologies Co. in catering to clients who demand their own private cloud systems, according to **-backed think tank CCW Research. Alibaba’s cloud business turned a profit in the quarter ended March, making it the first Chinese cloud-service provider to make money from the cash-burning sector.

Alibaba previously has faced scrutiny over its data-security practices. In December, the Chinese ministry in charge of technology suspended a cybersecurity partnership with Alibaba’s cloud-computing unit for six months after Beijing alleged the company failed to report a global software vulnerability to it in a timely manner.

Last year, under pressure from a local telecom regulator, the company disclosed a 2019 incident in which an employee had leaked client contact information to a distributor.

Earlier this week, the Shanghai authorities announced a cybersecurity review of key websites and platforms belonging to ** agencies, state-owned companies, big tech firms and other entities, with a particular focus on any that contained personal data on more than one million people.

神秘北极圈 发表于 2022-7-15 10:09
这个不是管理的漏洞吗？怪阿里巴巴吗？

88232128 发表于 2022-7-15 10:16
阿里巴巴：自己把密码贴到csdn，关我屁事！

larry 发表于 2022-7-15 10:15
数据存在你阿里云，泄露了你就要负责，不需要解释。