JCrush Joins the Database Leak Club

Last week, TechCrunch reported security researchers at vpnMentor discovered that JCrush, a dating app designed for the Jewish community, left a MongoDB database containing 18.454 GB of unencrypted records unprotected and publicly accessible. The breach exposed up to 200,000 user records, which included first and last names, religious denominations, gender, sexual orientation, email addresses, geolocations, and in some instances, Facebook tokens, meaning their Facebook account could be taken over without the use of a password. The leak also exposed private correspondence between users — many of them explicit and graphic.

DivvyCloud’s CTO, Chris DeRamus, spoke on the same type of misconfiguration when it happened to Verification.io earlier this year:

If a bad actor were to discover this massive trove of data, they could easily validate the contact information for the users included launching a more focused phishing or brute force campaign.

We live in a world where data is king—collecting, storing and leveraging data is essential to running just about any business. All the more reason organizations must be diligent in protecting data with proper security controls. Automated cloud security solutions would have been able to detect the misconfiguration in the MongoDB database containing this information and could either alert the appropriate personnel to correct the issue or trigger automated remediation in real-time. These solutions are essential to enforce policy, reduce risk, provide governance, impose compliance and increase security across large-scale hybrid cloud infrastructure.

What prevents companies from solving these cloud security problems?

Security and lack of visibility in governance and compliance are just symptoms of the problems organizations are facing. It’s a signal and noise problem. Over the last couple of years, the number of resources that enterprises are dealing with has grown exponentially. That’s relatively obvious regarding the new technologies, but what is often not realized is that two other things that have changed — the amount and types of people who are touching the infrastructure. Now you have a large number of resources and every engineer touching infrastructure to apply  real-time changes. Admins can’t see all of the problems, and they are losing control. Even if they CAN see all of the issues, they will suffer from alert fatigue as there is no way to keep up. Just knowing where your problem areas are doesn’t help. Simple truth – the rate of change and the dynamic nature of software-defined infrastructure has outstripped human capacity. We need to move towards a trust but verify approach.

Interested in learning more? Speak with a DivvyCloud expert today!

Watch DivvyCloud’s 60 second video to learn how we help customers like GE, 3M, Autodesk, Discovery, and Fannie Mae stay secure and compliant.

DivvyCloud minimizes security and compliance risk by providing virtual guardrails for security, compliance, and governance to customers embracing the dynamic, self-service nature of public cloud, and container infrastructure. Customers like General Electric, Discovery Communications, and Fannie Mae run DivvyCloud’s software to achieve continuous security governance in cloud and container environments (AWS, Azure, GCP, Alibaba, and Kubernetes). First, our software performs real-time, continuous discovery of infrastructure resources allowing customers to identify risks and threats. Second, customers can implement out-of-the-box or custom cloud-native policy guardrails that identify and alert on violations. Third, we automate the enforcement and remediation of these policies.