Pierluigi Paganini
March 17, 2019
Security expert Sanyam Jain at GDI Foundation has discovered an unprotected database exposed online that was containing approximately 33 million profiles for people in China who provided their resume to job recruitment sites.
The expert discovered the Elasticsearch database using the Shodan search engine, the 57GB archive included a username, gender, age, current city, home address, email address, phone number, marriage status, job history, education history, and salary history.
Jain discovering the ElasticSearch database on March 10th, 2019, but he was able to discover who was the owner of the
The analysis of the archive allowed the expert to discover references to multiple Chinese job recruitment sites such as 51Jobs,
“During the initial investigation what I have found is that the customer profiles for the companies 51Jobs,
The availability of this data potentially exposed people to several malicious activities such as scams and identity theft. The knowledge of the salary for so many people could be used by businesses to hire employees from their original companies.
Jain reported his findings to CNCERT, the China Cyber emergency response team, on March 11, 2019. The CNCERT told the expert it had identified the owner of the IP address as “北京机到网络科技有限公司” and that he contacted him to take the database offline.
The Elasticsearch database was
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – China data leak)
[adrotate banner=”5″]
[adrotate banner=”13″]
