ClarityCheck exposes 9 million image files containing faces in unsecured Amazon S3 bucket
This digest was compiled by AI from multiple sources — links to the originals are below.
ClarityCheck leaves more than 9 million image files, including photographs of people's faces, publicly exposed in an unsecured Amazon S3 bucket, independent security researcher Jeremiah Fowler finds. A second misconfiguration exposes people's email addresses and phone numbers, and the database holds roughly 450 GB of images of adults, teenagers, and children. ClarityCheck says it restricted access after WIRED contacted the company in July, but Fowler says the data had been exposed for months.
Key Facts
- More than 9 million image files, including photographs of people's faces, were publicly exposed.
- The exposed ClarityCheck database contained roughly 450 GB of images, including profile images, screenshots, and photographs of adults, teenagers, and children.
- A second misconfiguration publicly exposed people's email addresses and phone numbers.
- All images were stored in an unsecured Amazon S3 bucket with files in folders named 'faces' and 'profiles', accessible through a URL in ClarityCheck's publicly available website code.
- ClarityCheck secured the database after WIRED contacted the company in July, but independent researcher Jeremiah Fowler said it had been exposed for months.
The Exposure
More than 9 million image files, including photographs of people's faces, were publicly exposed. The exposed ClarityCheck database contained roughly 450 GB of images, including profile images, screenshots, and photographs of adults, teenagers, and children. All of the images were stored in an unsecured Amazon S3 bucket, with files in folders named 'faces' and 'profiles'. The files could be accessed by anyone online through a URL included in ClarityCheck's publicly available website code. A second misconfiguration publicly exposed people's email addresses and phone numbers.
Company Response
ClarityCheck is one of a number of people-finder tools that have appeared online in recent years, and its website says it can run searches on phone numbers, email addresses, vehicle identification numbers, and names. Independent security researcher Jeremiah Fowler said the database was exposed for months, and his initial efforts to flag the problem to ClarityCheck were unsuccessful. Fowler told WIRED that people whose faces were exposed may have had no idea ClarityCheck held their image, and that an AI bot could crawl the database, extract faces, and use them for training. ClarityCheck secured the image database after WIRED contacted the company in July. A ClarityCheck spokesperson said the company appreciated Fowler's efforts, acted immediately to restrict access, and disputed any characterization that the data was 'exposed,' saying an ordinary member of the public would not have come across it.
2 sources
ClarityCheck exposes 9 million image files containing faces in unsecured Amazon S3 bucket
