Pixlr, the popular online photo editing website on the dark web, had suffered significant data exposure. The hacker had leaked the website’s data on a dark Web Forum that accounts for around 1.9 million. They have also leaked the other stolen data acquired from the other websites. 

The massive data breach has been caused by a hacker who calls himself Shinyhunters. The breached data has been released on the dark web forum named “January 17th”. It has yet not been known how exactly the hacker has gained access to such a considerable amount of data from Pixlr. The stolen database comprises the users’ login ids, email addresses, hashed passwords and user locations. But it is believed that he might have accessed the stored data in an unsecured Amazon Web Services S3 bucket.

ShinyHunters had shared Pixlr user records numbering 1,921,141 for free in the deep web forum and that he accessed the data following the 123RF stock photo breach he had made. The latter is a non-royalty-free image provider which like Pixlr is owned by Inmagine. The hacker has also claimed that he had downloaded the database from the AWS bucket of Pixlr in late 2020.

As Bleeping Computer states, ShinyHunters is famous for hacking websites and selling the humongous amounts of stolen data from the dark web data brokers. ShinyHunters have victimized several companies to date, including Tokopedia, Minted, 123RF, Homechef, Dave, Mathway, Chatbooks, Promo and others. 

VP of Product at CloudSphere, Pravin Rasiah mentions that the possibility of the ShinyHunters hacker accessing an unsecured S3 bucket is incredible as unsecured or improperly secured AWS S3 buckets are one of the leading causes of data theft occurring solely due to misconfiguration. 

“The chances of exposing an S3 bucket are all too great, as inexperienced users can simply choose the ‘access to all users’ option, which makes the bucket publicly accessible. Hackers are invited to misuse personal data entrusted to companies by their customers.

Rasiah had further added that for avoiding such misconfigurations, the businesses must invest in a platform for cloud governance offering real-time and holistic observation in the cloud landscape. This ensures that the stored data is secured and the companies stay on the top of anomalies. The businesses can ensure security for themselves and their customers with the help of comprehensive visibility and the capability to fix problems before they are vulnerable to exploitation.

The CTO and the founder of Cortex Insight, Stephen Kapp says that Pixlr must improve its internal processes to mitigate the damage by storing the users’ information in dedicated SSO systems or application databases, like those that AWS offers. This would enable the dedicated password hashing using a Salt Work Factor that would mitigate the brute force attacks.

Source: Teiss

Disclaimer: Read the complete disclaimer here.

The post Pixlr: Two Million User Data Leaked On The Dark Web appeared first on Dark Web Link | Deep web Onion Links | Darknet News.