├── .github
    └── ISSUE_TEMPLATE
    │   └── new-s3-leak.md
├── .gitignore
├── CONTRIBUTING.md
├── Dockerfile
├── LICENSE
├── Makefile
├── README.md
├── docs
    ├── App.js
    └── index.html
├── main.go
└── yas3bl.json


/.github/ISSUE_TEMPLATE/new-s3-leak.md:
--------------------------------------------------------------------------------
 1 | ---
 2 | name: New S3 Leak
 3 | about: Report a new S3 leak
 4 | 
 5 | ---
 6 | 
 7 | **Organization Affected**: 
 8 | 
 9 | **Count of records exposed**: 
10 | 
11 | **Data Exposed**: 
12 | 
13 | **URL to the article/disclosure**:
14 | 


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
 1 | .c9
 2 | # Binaries for programs and plugins
 3 | *.exe
 4 | *.dll
 5 | *.so
 6 | *.dylib
 7 | 
 8 | # Test binary, build with `go test -c`
 9 | *.test
10 | 
11 | # Output of the go coverage tool, specifically when used with LiteIDE
12 | *.out
13 | 
14 | # Project-local glide cache, RE: https://github.com/Masterminds/glide/issues/736
15 | .glide/
16 | .DS_Store
17 | # Logs
18 | logs
19 | *.log
20 | npm-debug.log*
21 | yarn-debug.log*
22 | yarn-error.log*
23 | 
24 | # Runtime data
25 | pids
26 | *.pid
27 | *.seed
28 | *.pid.lock
29 | 
30 | # Directory for instrumented libs generated by jscoverage/JSCover
31 | lib-cov
32 | 
33 | # Coverage directory used by tools like istanbul
34 | coverage
35 | 
36 | # nyc test coverage
37 | .nyc_output
38 | 
39 | # Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
40 | .grunt
41 | 
42 | # Bower dependency directory (https://bower.io/)
43 | bower_components
44 | 
45 | # node-waf configuration
46 | .lock-wscript
47 | 
48 | # Compiled binary addons (https://nodejs.org/api/addons.html)
49 | build/Release
50 | 
51 | # Dependency directories
52 | node_modules/
53 | jspm_packages/
54 | 
55 | # Typescript v1 declaration files
56 | typings/
57 | 
58 | # Optional npm cache directory
59 | .npm
60 | 
61 | # Optional eslint cache
62 | .eslintcache
63 | 
64 | # Optional REPL history
65 | .node_repl_history
66 | 
67 | # Output of 'npm pack'
68 | *.tgz
69 | 
70 | # Yarn Integrity file
71 | .yarn-integrity
72 | 
73 | # dotenv environment variables file
74 | .env
75 | 
76 | # next.js build output
77 | .next
78 | 


--------------------------------------------------------------------------------
/CONTRIBUTING.md:
--------------------------------------------------------------------------------
 1 | # CONTRIBUTING
 2 | 
 3 | First, thank you for your interest in contributing to this project. I try to stay abreast of news that breaks regarding bucket leaks, but I could easily miss one or two.
 4 | 
 5 | Contributing to this project is relatively simple.
 6 | 
 7 | ## Overview
 8 | 
 9 | 1. Fork and clone the repository.
10 | 1. Add the information in [`yas3bl.json`](yas3bl.json).
11 | 1. Generate the [README.md](README.md).
12 | 
13 | And you're done!
14 | 
15 | ## Details
16 | 
17 | ### Prerequisites
18 | 
19 | You must have **ONE** of the following two options installed locally on your machine:
20 | - Docker
21 | - Go
22 | 
23 | Alternatively, if you have a [c9.io](https://c9.io) account, you can spin up a generic workspace (it is provisioned with Go out-of-the-box 😍 )
24 | 
25 | ### Steps
26 | 
27 | 1. Fork then clone the repo: `git clone https://github.com/<YOUR_GITHUB_USERNAME>/YAS3BL && cd YAS3BL`
28 | 1. Add new entry in `yas3bl.json`. Required JSON properties:
29 |     ```json
30 |     {
31 |       "count": "<NUMBER OF RECORDS EXPOSED BY THIS LEAK>",
32 |       "data": "<TYPE OF DATA EXPOSED BY THIS LEAK>",
33 |       "organization": "<OWNER OF THIS LEAKED DATA>",
34 |       "url": "<URL TO ORIGINAL BLOG ARTICLE BY SECURITY RESEARCHERS>"
35 |     }
36 |     ```
37 |     - Note: The `url` should be that of the original security researchers that disclosed this leak. I'd rather not rely on secondary news sources that report on this leak.
38 | 1. Generate the markup using **ONE** of the two options below:
39 |     - If you have Go installed locally or if you're on c9.io: `make` or `make readme`
40 |     - If you have Docker installed locally: `make docker`
41 | 1. Push & open PR 👍
42 | 


--------------------------------------------------------------------------------
/Dockerfile:
--------------------------------------------------------------------------------
1 | # YAS3BL
2 | # To populate data from yas3bl.json and generate README.md dynamically:
3 | #   docker run --rm -it -v $(pwd):/go/src/github.com/petermbenjamin/yas3bl yas3bl
4 | FROM golang:latest
5 | LABEL maintainer="Peter Benjamin <petermbenjamin@gmail.com>"
6 | ENTRYPOINT [ "go run main.go" ]
7 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | MIT License
 2 | 
 3 | Copyright (c) 2017 Peter Benjamin
 4 | 
 5 | Permission is hereby granted, free of charge, to any person obtaining a copy
 6 | of this software and associated documentation files (the "Software"), to deal
 7 | in the Software without restriction, including without limitation the rights
 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 | 
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 | 
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 | 


--------------------------------------------------------------------------------
/Makefile:
--------------------------------------------------------------------------------
 1 | .PHONY: readme html
 2 | 
 3 | readme:
 4 | 	go run main.go
 5 | 
 6 | html: readme
 7 | 	open docs/index.html
 8 | 
 9 | docker:
10 | 	docker run --rm -it -v $(shell pwd):/go/src/github.com/petermbenjamin/yas3bl -w /go/src/github.com/petermbenjamin/yas3bl golang:latest make
11 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # YAS3BL (Yet Another S3 Bucket Leak)
 2 | 
 3 | > 🔓 Enumerating all the AWS S3 bucket leaks that have been discovered to date.
 4 | 
 5 | | Company | Link | Records Exposed | Data |
 6 | | ------- | ---- | --------------- | ---- |
 7 | | <h4>211 LA County</h4> | [🔗](https://www.upguard.com/breaches/la-county-211-hotline) | 3.2 million | Files include access credentials for 211 system operators, email addresses for contacts and registered resources of LA County 211, and detailed call notes, including full names, phone numbers, addresses, and even 33,000 instances of full Social Security numbers. |
 8 | | <h4>Accenture</h4> | [🔗](https://www.upguard.com/breaches/cloud-leak-accenture) | 137&#43; GB | 4 S3 buckets exposing secret API data, authentication credentials, 40,000 plaintext passwords, credentials for GCP and Azure accounts, SSL certificates, private decryption keys, production VPN keys for internal/private networks, database dumps, user IP addresses, JSESSION IDs. |
 9 | | <h4>AgentRun</h4> | [🔗](https://www.zdnet.com/article/insurance-startup-leaks-sensitive-customer-health-data/) |  | Names, addresses, dates of birth, phone numbers, income ranges, social security numbers (SSNs), driver licenses, armed forces and voter identification cards, bank checks, insurance policy documents, health and medical information (e.g. prescriptions and dosages), and some financial data. Insurance companies found in the data included Cigna, TransAmerica, SafeCo, Schneider Insurance, Manhattan Life, Everest - to name a few. |
10 | | <h4>Alliance Direct Lending Corporation</h4> | [🔗](https://threatpost.com/auto-lender-exposes-loan-data-for-up-to-1-million-applicants/125216/) | 1 million | Names, addresses, credit scores and partial Social Security numbers |
11 | | <h4>Alteryx</h4> | [🔗](https://www.upguard.com/breaches/cloud-leak-alteryx) | 123 million | Data sets belonging to Experian and US Census Bureau, containing personal details of 198 million American voters and 123 million American household PII data such as home addresses, contact information, morgage ownership, financial histories, and purchasing behaviors. |
12 | | <h4>Australian Broadcasting Company</h4> | [🔗](https://mackeepersecurity.com/post/australian-broadcasting-corporation-exposed-sensitive-data-online) | 50,000 | Personal data of Australian employees of several government agencies, banks, and a utility company, including full names, passwords, IDs, phone numbers, email addresses, credit card numbers, salaries and expenses. |
13 | | <h4>Booz Allen Hamilton</h4> | [🔗](https://www.upguard.com/breaches/spy-games) | Undisclosed | Top Secret data from DoD, Pentagon, and National Geospatial Intelligence Agency (NGA), SSH keys, credentials granting access to data center Operating System |
14 | | <h4>DeepRoot Analytics</h4> | [🔗](https://www.upguard.com/breaches/the-rnc-files) | 200 million | 1.1 Terabytes worth of data on registered voters |
15 | | <h4>Department of Defense</h4> | [🔗](https://www.upguard.com/breaches/cloud-leak-centcom) | 1.8 billion | Three (3) S3 buckets containing 1.8 billion posts of scraped internet content over the last 8 years. |
16 | | <h4>Dow Jones</h4> | [🔗](https://www.upguard.com/breaches/cloud-leak-dow-jones) | 2.2 - 4 million | Names, addresses, account information, email addresses, and last four digits of credit card numbers of millions of subscribers to Dow Jones publications |
17 | | <h4>ES&amp;S</h4> | [🔗](https://www.upguard.com/breaches/cloud-leak-chicago-voters) | 1.8 million | Chicago voter names, addresses, date-of-births, partial SSNs, Driver Licenses, and state ID numbers |
18 | | <h4>Fedex</h4> | [🔗](https://mackeepersecurity.com/post/fedex-customer-records-exposed) | 119,000 | Scanned documents of US and international citizens, such as passports, driver licenses, security IDs, home addresses, phone numbers, zip codes |
19 | | <h4>Groupize</h4> | [🔗](https://mackeepersecurity.com/post/online-hotel-booking-service-allegedly-exposed-sensitive-data) | 38,000 | Credit Card numbers, expiration dates, CVV codes |
20 | | <h4>Honda</h4> | [🔗](https://mackeepersecurity.com/post/honda-leaked-personal-information-from-its-honda-connect-app/) | 50,000 | Names, phone numbers and email addresses for users and their trusted contacts, passwords, gender, information about their cars including VIN, Connect IDs. |
21 | | <h4>MBM Company Inc.</h4> | [🔗](https://mackeepersecurity.com/post/walmart-jewelry-partner-exposed-millions-customer-details) | 1.3 million | Names, addresses, zip codes, phone numbers, email addresses, ip addresses, plaintext passwords |
22 | | <h4>Mexico&#39;s Electoral Authority (INE)</h4> | [🔗](http://splinternews.com/a-massive-data-breach-exposed-personal-info-for-93-4-mi-1793856429) | 93.4 million | Mexican voter registration data |
23 | | <h4>National Credit Federation</h4> | [🔗](https://www.upguard.com/breaches/credit-crunch-national-credit-federation) | 111 GB | Internal personal and financial data of tens of thousands of customers. |
24 | | <h4>NSA</h4> | [🔗](https://www.upguard.com/breaches/cloud-leak-inscom) | 47 files | Highly sensitive INSCOM data. Some data was &#39;NOFORN&#39; classified, indicating high sensitivity that cannot be shared with foreign allies |
25 | | <h4>Octoly</h4> | [🔗](https://www.upguard.com/breaches/cloud-leak-octoly) | 12,000 | A database backup, called `octoly_production.sql`, exposed real names, addresses, phone numbers, email addresses, birth dates of thousands of influential online personalities (Instagram, Twitter, and YouTube personalities), like Dior, Lancome, and Blizzard Entertainment |
26 | | <h4>Patient Home Monitoring</h4> | [🔗](https://mackeepersecurity.com/post/patient-home-monitoring-service-leaks-private-medical-data-online) | 316,363 | 47.5 GB PDF medical records containing weekly blood test results, patient names, addresses, and phone numbers. Development server backups. Doctor&#39;s names, case management notes, and additional client information. |
27 | | <h4>SVR Tracking</h4> | [🔗](https://mackeepersecurity.com/post/auto-tracking-company-leaks-hundreds-of-thousands-of-records-online) | 540,642 | Tracking unit information including usernames, passwords, emails, Vehicle Identification Numbers, license plate numbers, IMEI numbers of GPS devices, specific location where the tracking units were hidden, information on customers and 427 dealerships, 116 GB of hourly backups, 8.5 GB of daily backups from 2017, and 339 log documents |
28 | | <h4>TigerSwan</h4> | [🔗](https://www.upguard.com/breaches/cloud-leak-tigerswan) | 9,402 | Resumes of Top Secret US military veterans names, addresses, phones, emails, Driver License numbers, passport numbers, partial SSNs |
29 | | <h4>Time Warner/BroadSoft</h4> | [🔗](https://mackeepersecurity.com/post/global-communication-software-left-massive-amount-of-data-online) | 4 million | 600 GB worth of data including usernames, emails addresses, MAC addresses, device serial numbers, and financial transaction information |
30 | | <h4>Verizon</h4> | [🔗](https://www.upguard.com/breaches/verizon-cloud-leak) | 14 million | Verizon customer names, addresses, account details, and Personal Identification Numbers (PIN) |
31 | | <h4>Verizon</h4> | [🔗](https://mackeepersecurity.com/post/verizon-wireless-employee-exposed-confidential-data-online) | 100 MB | Data from internal Verizon Wireless system (DVS), 129 Outlook messages, logs, server names &amp; info, admin usernames &amp; passwords |
32 | | <h4>Viacom</h4> | [🔗](https://www.theregister.co.uk/2017/09/19/viacom_exposure_in_aws3_bucket_blunder/) | 72 files | Encrypted compressed archives containing backup of company&#39;s IT infrastructure and private GPG keys used to encrypt the compressed archives |
33 | | <h4>WWE</h4> | [🔗](https://threatpost.com/leaky-wwe-database-exposes-personal-data-of-3m-wrestling-fans/126710/) | 3,065,805 | Fans names, physical addresses, email addresses, earnings, ethnicity, children’s age ranges, birthdates and additional personally identifiable information |
34 | 
35 | 


--------------------------------------------------------------------------------
/docs/App.js:
--------------------------------------------------------------------------------
 1 | /* global fetch, semanticUIReact, ReactDOM, React */
 2 | const { Header, Container, Segment, Table, Dropdown } = semanticUIReact
 3 | 
 4 | const YAS3BL =
 5 |   'https://raw.githubusercontent.com/petermbenjamin/YAS3BL/master/yas3bl.json'
 6 | class App extends React.Component {
 7 |   state = { leaks: [] }
 8 | 
 9 |   componentDidMount() {
10 |     fetch(YAS3BL)
11 |       .then(response => response.json())
12 |       .then(data => {
13 |         data.sort((a, b) => a.organization.localeCompare(b.organization))
14 |         this.setState({ leaks: data })
15 |       })
16 |       .catch(err => console.error(err))
17 |   }
18 | 
19 |   render() {
20 |     const { leaks } = this.state
21 |     return (
22 |       <Container>
23 |         <Segment.Group horizontal>
24 |           <Segment>
25 |             <Header as="h1">Yet Another S3 Bucket Leak</Header>
26 |           </Segment>
27 |         </Segment.Group>
28 |         <Table celled>
29 |           <Table.Header>
30 |             <Table.Row>
31 |               <Table.HeaderCell>Organization</Table.HeaderCell>
32 |               <Table.HeaderCell>Count (Records Exposed)</Table.HeaderCell>
33 |               <Table.HeaderCell>Data Exposed</Table.HeaderCell>
34 |             </Table.Row>
35 |           </Table.Header>
36 |           <Table.Body>
37 |             {leaks.map((l, i) => (
38 |               <Table.Row key={i}>
39 |                 <Table.Cell>
40 |                   <a href={l.url}>{l.organization}</a>
41 |                 </Table.Cell>
42 |                 <Table.Cell>{l.count}</Table.Cell>
43 |                 <Table.Cell>{l.data}</Table.Cell>
44 |               </Table.Row>
45 |             ))}
46 |           </Table.Body>
47 |         </Table>
48 |       </Container>
49 |     )
50 |   }
51 | }
52 | 
53 | const root = document.getElementById('root')
54 | const elem = <App />
55 | ReactDOM.render(elem, root)
56 | 


--------------------------------------------------------------------------------
/docs/index.html:
--------------------------------------------------------------------------------
  1 | 
  2 | <html lang="en">
  3 | <head>
  4 | 	<meta charset="UTF-8">
  5 | 	<meta name="viewport" content="width=device-width, initial-scale=1.0">
  6 | 	<meta http-equiv="X-UA-Compatible" content="ie=edge">
  7 | 	<title>YAS3BL</title>
  8 | 	<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-beta/css/bootstrap.min.css" integrity="sha384-/Y6pD6FV/Vv2HJnA6t+vslU6fwYXjCFtcEpHbNJ0lyAFsXTsjBbfaDjzALeQsN6M" crossorigin="anonymous">
  9 | </head>
 10 | <style>
 11 | td {
 12 | 	font-family: monospace;
 13 | }
 14 | 
 15 | a {
 16 | 	text-decoration: none;
 17 | }
 18 | </style>
 19 | <body>
 20 | 	<div class="container">
 21 | 		<div class="header clearfix">
 22 | 			<h1 class="text-muted text-center"><a href="https://github.com/petermbenjamin/yas3bl/">Yet Another S3 Bucket Leak</a></h1>
 23 | 		</div>
 24 | 		<table class="table table-striped">
 25 | 			<thead>
 26 | 				<tr>
 27 | 					<th>Organization</th>
 28 | 					<th>Count</th>
 29 | 					<th>Data</th>
 30 | 				</tr>
 31 | 			</thead>
 32 | 			<tbody>
 33 | 			<tr>
 34 | 				<td><a href="https://www.upguard.com/breaches/la-county-211-hotline">211 LA County</a></td>
 35 | 				<td>3.2 million</td>
 36 | 				<td>Files include access credentials for 211 system operators, email addresses for contacts and registered resources of LA County 211, and detailed call notes, including full names, phone numbers, addresses, and even 33,000 instances of full Social Security numbers.</td>
 37 | 			</tr>
 38 | 			<tr>
 39 | 				<td><a href="https://www.upguard.com/breaches/cloud-leak-accenture">Accenture</a></td>
 40 | 				<td>137&#43; GB</td>
 41 | 				<td>4 S3 buckets exposing secret API data, authentication credentials, 40,000 plaintext passwords, credentials for GCP and Azure accounts, SSL certificates, private decryption keys, production VPN keys for internal/private networks, database dumps, user IP addresses, JSESSION IDs.</td>
 42 | 			</tr>
 43 | 			<tr>
 44 | 				<td><a href="https://www.zdnet.com/article/insurance-startup-leaks-sensitive-customer-health-data/">AgentRun</a></td>
 45 | 				<td></td>
 46 | 				<td>Names, addresses, dates of birth, phone numbers, income ranges, social security numbers (SSNs), driver licenses, armed forces and voter identification cards, bank checks, insurance policy documents, health and medical information (e.g. prescriptions and dosages), and some financial data. Insurance companies found in the data included Cigna, TransAmerica, SafeCo, Schneider Insurance, Manhattan Life, Everest - to name a few.</td>
 47 | 			</tr>
 48 | 			<tr>
 49 | 				<td><a href="https://threatpost.com/auto-lender-exposes-loan-data-for-up-to-1-million-applicants/125216/">Alliance Direct Lending Corporation</a></td>
 50 | 				<td>1 million</td>
 51 | 				<td>Names, addresses, credit scores and partial Social Security numbers</td>
 52 | 			</tr>
 53 | 			<tr>
 54 | 				<td><a href="https://www.upguard.com/breaches/cloud-leak-alteryx">Alteryx</a></td>
 55 | 				<td>123 million</td>
 56 | 				<td>Data sets belonging to Experian and US Census Bureau, containing personal details of 198 million American voters and 123 million American household PII data such as home addresses, contact information, morgage ownership, financial histories, and purchasing behaviors.</td>
 57 | 			</tr>
 58 | 			<tr>
 59 | 				<td><a href="https://mackeepersecurity.com/post/australian-broadcasting-corporation-exposed-sensitive-data-online">Australian Broadcasting Company</a></td>
 60 | 				<td>50,000</td>
 61 | 				<td>Personal data of Australian employees of several government agencies, banks, and a utility company, including full names, passwords, IDs, phone numbers, email addresses, credit card numbers, salaries and expenses.</td>
 62 | 			</tr>
 63 | 			<tr>
 64 | 				<td><a href="https://www.upguard.com/breaches/spy-games">Booz Allen Hamilton</a></td>
 65 | 				<td>Undisclosed</td>
 66 | 				<td>Top Secret data from DoD, Pentagon, and National Geospatial Intelligence Agency (NGA), SSH keys, credentials granting access to data center Operating System</td>
 67 | 			</tr>
 68 | 			<tr>
 69 | 				<td><a href="https://www.upguard.com/breaches/the-rnc-files">DeepRoot Analytics</a></td>
 70 | 				<td>200 million</td>
 71 | 				<td>1.1 Terabytes worth of data on registered voters</td>
 72 | 			</tr>
 73 | 			<tr>
 74 | 				<td><a href="https://www.upguard.com/breaches/cloud-leak-centcom">Department of Defense</a></td>
 75 | 				<td>1.8 billion</td>
 76 | 				<td>Three (3) S3 buckets containing 1.8 billion posts of scraped internet content over the last 8 years.</td>
 77 | 			</tr>
 78 | 			<tr>
 79 | 				<td><a href="https://www.upguard.com/breaches/cloud-leak-dow-jones">Dow Jones</a></td>
 80 | 				<td>2.2 - 4 million</td>
 81 | 				<td>Names, addresses, account information, email addresses, and last four digits of credit card numbers of millions of subscribers to Dow Jones publications</td>
 82 | 			</tr>
 83 | 			<tr>
 84 | 				<td><a href="https://www.upguard.com/breaches/cloud-leak-chicago-voters">ES&amp;S</a></td>
 85 | 				<td>1.8 million</td>
 86 | 				<td>Chicago voter names, addresses, date-of-births, partial SSNs, Driver Licenses, and state ID numbers</td>
 87 | 			</tr>
 88 | 			<tr>
 89 | 				<td><a href="https://mackeepersecurity.com/post/fedex-customer-records-exposed">Fedex</a></td>
 90 | 				<td>119,000</td>
 91 | 				<td>Scanned documents of US and international citizens, such as passports, driver licenses, security IDs, home addresses, phone numbers, zip codes</td>
 92 | 			</tr>
 93 | 			<tr>
 94 | 				<td><a href="https://mackeepersecurity.com/post/online-hotel-booking-service-allegedly-exposed-sensitive-data">Groupize</a></td>
 95 | 				<td>38,000</td>
 96 | 				<td>Credit Card numbers, expiration dates, CVV codes</td>
 97 | 			</tr>
 98 | 			<tr>
 99 | 				<td><a href="https://mackeepersecurity.com/post/honda-leaked-personal-information-from-its-honda-connect-app/">Honda</a></td>
100 | 				<td>50,000</td>
101 | 				<td>Names, phone numbers and email addresses for users and their trusted contacts, passwords, gender, information about their cars including VIN, Connect IDs.</td>
102 | 			</tr>
103 | 			<tr>
104 | 				<td><a href="https://mackeepersecurity.com/post/walmart-jewelry-partner-exposed-millions-customer-details">MBM Company Inc.</a></td>
105 | 				<td>1.3 million</td>
106 | 				<td>Names, addresses, zip codes, phone numbers, email addresses, ip addresses, plaintext passwords</td>
107 | 			</tr>
108 | 			<tr>
109 | 				<td><a href="http://splinternews.com/a-massive-data-breach-exposed-personal-info-for-93-4-mi-1793856429">Mexico&#39;s Electoral Authority (INE)</a></td>
110 | 				<td>93.4 million</td>
111 | 				<td>Mexican voter registration data</td>
112 | 			</tr>
113 | 			<tr>
114 | 				<td><a href="https://www.upguard.com/breaches/credit-crunch-national-credit-federation">National Credit Federation</a></td>
115 | 				<td>111 GB</td>
116 | 				<td>Internal personal and financial data of tens of thousands of customers.</td>
117 | 			</tr>
118 | 			<tr>
119 | 				<td><a href="https://www.upguard.com/breaches/cloud-leak-inscom">NSA</a></td>
120 | 				<td>47 files</td>
121 | 				<td>Highly sensitive INSCOM data. Some data was &#39;NOFORN&#39; classified, indicating high sensitivity that cannot be shared with foreign allies</td>
122 | 			</tr>
123 | 			<tr>
124 | 				<td><a href="https://www.upguard.com/breaches/cloud-leak-octoly">Octoly</a></td>
125 | 				<td>12,000</td>
126 | 				<td>A database backup, called `octoly_production.sql`, exposed real names, addresses, phone numbers, email addresses, birth dates of thousands of influential online personalities (Instagram, Twitter, and YouTube personalities), like Dior, Lancome, and Blizzard Entertainment</td>
127 | 			</tr>
128 | 			<tr>
129 | 				<td><a href="https://mackeepersecurity.com/post/patient-home-monitoring-service-leaks-private-medical-data-online">Patient Home Monitoring</a></td>
130 | 				<td>316,363</td>
131 | 				<td>47.5 GB PDF medical records containing weekly blood test results, patient names, addresses, and phone numbers. Development server backups. Doctor&#39;s names, case management notes, and additional client information.</td>
132 | 			</tr>
133 | 			<tr>
134 | 				<td><a href="https://mackeepersecurity.com/post/auto-tracking-company-leaks-hundreds-of-thousands-of-records-online">SVR Tracking</a></td>
135 | 				<td>540,642</td>
136 | 				<td>Tracking unit information including usernames, passwords, emails, Vehicle Identification Numbers, license plate numbers, IMEI numbers of GPS devices, specific location where the tracking units were hidden, information on customers and 427 dealerships, 116 GB of hourly backups, 8.5 GB of daily backups from 2017, and 339 log documents</td>
137 | 			</tr>
138 | 			<tr>
139 | 				<td><a href="https://www.upguard.com/breaches/cloud-leak-tigerswan">TigerSwan</a></td>
140 | 				<td>9,402</td>
141 | 				<td>Resumes of Top Secret US military veterans names, addresses, phones, emails, Driver License numbers, passport numbers, partial SSNs</td>
142 | 			</tr>
143 | 			<tr>
144 | 				<td><a href="https://mackeepersecurity.com/post/global-communication-software-left-massive-amount-of-data-online">Time Warner/BroadSoft</a></td>
145 | 				<td>4 million</td>
146 | 				<td>600 GB worth of data including usernames, emails addresses, MAC addresses, device serial numbers, and financial transaction information</td>
147 | 			</tr>
148 | 			<tr>
149 | 				<td><a href="https://www.upguard.com/breaches/verizon-cloud-leak">Verizon</a></td>
150 | 				<td>14 million</td>
151 | 				<td>Verizon customer names, addresses, account details, and Personal Identification Numbers (PIN)</td>
152 | 			</tr>
153 | 			<tr>
154 | 				<td><a href="https://mackeepersecurity.com/post/verizon-wireless-employee-exposed-confidential-data-online">Verizon</a></td>
155 | 				<td>100 MB</td>
156 | 				<td>Data from internal Verizon Wireless system (DVS), 129 Outlook messages, logs, server names &amp; info, admin usernames &amp; passwords</td>
157 | 			</tr>
158 | 			<tr>
159 | 				<td><a href="https://www.theregister.co.uk/2017/09/19/viacom_exposure_in_aws3_bucket_blunder/">Viacom</a></td>
160 | 				<td>72 files</td>
161 | 				<td>Encrypted compressed archives containing backup of company&#39;s IT infrastructure and private GPG keys used to encrypt the compressed archives</td>
162 | 			</tr>
163 | 			<tr>
164 | 				<td><a href="https://threatpost.com/leaky-wwe-database-exposes-personal-data-of-3m-wrestling-fans/126710/">WWE</a></td>
165 | 				<td>3,065,805</td>
166 | 				<td>Fans names, physical addresses, email addresses, earnings, ethnicity, children’s age ranges, birthdates and additional personally identifiable information</td>
167 | 			</tr>
168 | 			
169 | 			</tbody>
170 | 		</table>
171 | 	</div>
172 | 	<footer class="footer fixed-bottom">
173 | 		<div class="container-fluid"><span class="text-muted">MIT &copy; 2017 <a href="https://github.com/petermbenjamin/YAS3BL">Peter Benjamin</a></span></div>
174 | 	</footer>
175 | 	<script src="https://code.jquery.com/jquery-3.2.1.slim.min.js" integrity="sha384-KJ3o2DKtIkvYIK3UENzmM7KCkRr/rE9/Qpg6aAZGJwFDMVNA/GpGFF93hXpG5KkN" crossorigin="anonymous"></script>
176 | 	<script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.11.0/umd/popper.min.js" integrity="sha384-b/U6ypiBEHpOf/4+1nzFpr53nxSS+GLCkfwBdFNTxtclqqenISfwAzpKaMNFNmj4" crossorigin="anonymous"></script>
177 | 	<script src="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-beta/js/bootstrap.min.js" integrity="sha384-h0AbiXch4ZDo7tp9hKZ4TsHbi047NrKGLO3SEJAg45jXxnGIfYzk4Si90RDIqNm1" crossorigin="anonymous"></script>
178 | </body>
179 | </html>
180 | 


--------------------------------------------------------------------------------
/main.go:
--------------------------------------------------------------------------------
  1 | package main
  2 | 
  3 | import (
  4 | 	"bufio"
  5 | 	"encoding/json"
  6 | 	"html/template"
  7 | 	"io/ioutil"
  8 | 	"log"
  9 | 	"os"
 10 | 	"sort"
 11 | 	"strings"
 12 | )
 13 | 
 14 | // Leak sturct represents a slice of bucket leaks in yas3bl.json file
 15 | type Leak struct {
 16 | 	Count        string `json:"count"`
 17 | 	Data         string `json:"data"`
 18 | 	Organization string `json:"organization"`
 19 | 	URL          string `json:"url"`
 20 | }
 21 | 
 22 | const tmpl = `# YAS3BL (Yet Another S3 Bucket Leak)
 23 | 
 24 | > 🔓 Enumerating all the AWS S3 bucket leaks that have been discovered to date.
 25 | 
 26 | | Company | Link | Records Exposed | Data |
 27 | | ------- | ---- | --------------- | ---- |
 28 | {{range .}}| <h4>{{.Organization}}</h4> | [🔗]({{.URL}}) | {{.Count}} | {{.Data}} |
 29 | {{end}}
 30 | `
 31 | 
 32 | const htmlTmpl = `
 33 | <html lang="en">
 34 | <head>
 35 | 	<meta charset="UTF-8">
 36 | 	<meta name="viewport" content="width=device-width, initial-scale=1.0">
 37 | 	<meta http-equiv="X-UA-Compatible" content="ie=edge">
 38 | 	<title>YAS3BL</title>
 39 | 	<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-beta/css/bootstrap.min.css" integrity="sha384-/Y6pD6FV/Vv2HJnA6t+vslU6fwYXjCFtcEpHbNJ0lyAFsXTsjBbfaDjzALeQsN6M" crossorigin="anonymous">
 40 | </head>
 41 | <style>
 42 | td {
 43 | 	font-family: monospace;
 44 | }
 45 | 
 46 | a {
 47 | 	text-decoration: none;
 48 | }
 49 | </style>
 50 | <body>
 51 | 	<div class="container">
 52 | 		<div class="header clearfix">
 53 | 			<h1 class="text-muted text-center"><a href="https://github.com/petermbenjamin/yas3bl/">Yet Another S3 Bucket Leak</a></h1>
 54 | 		</div>
 55 | 		<table class="table table-striped">
 56 | 			<thead>
 57 | 				<tr>
 58 | 					<th>Organization</th>
 59 | 					<th>Count</th>
 60 | 					<th>Data</th>
 61 | 				</tr>
 62 | 			</thead>
 63 | 			<tbody>
 64 | 			{{range .}}<tr>
 65 | 				<td><a href="{{.URL}}">{{.Organization}}</a></td>
 66 | 				<td>{{.Count}}</td>
 67 | 				<td>{{.Data}}</td>
 68 | 			</tr>
 69 | 			{{end}}
 70 | 			</tbody>
 71 | 		</table>
 72 | 	</div>
 73 | 	<footer class="footer fixed-bottom">
 74 | 		<div class="container-fluid"><span class="text-muted">MIT &copy; 2017 <a href="https://github.com/petermbenjamin/YAS3BL">Peter Benjamin</a></span></div>
 75 | 	</footer>
 76 | 	<script src="https://code.jquery.com/jquery-3.2.1.slim.min.js" integrity="sha384-KJ3o2DKtIkvYIK3UENzmM7KCkRr/rE9/Qpg6aAZGJwFDMVNA/GpGFF93hXpG5KkN" crossorigin="anonymous"></script>
 77 | 	<script src="https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.11.0/umd/popper.min.js" integrity="sha384-b/U6ypiBEHpOf/4+1nzFpr53nxSS+GLCkfwBdFNTxtclqqenISfwAzpKaMNFNmj4" crossorigin="anonymous"></script>
 78 | 	<script src="https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-beta/js/bootstrap.min.js" integrity="sha384-h0AbiXch4ZDo7tp9hKZ4TsHbi047NrKGLO3SEJAg45jXxnGIfYzk4Si90RDIqNm1" crossorigin="anonymous"></script>
 79 | </body>
 80 | </html>
 81 | `
 82 | 
 83 | func main() {
 84 | 	jsonBytes, err := ioutil.ReadFile("yas3bl.json")
 85 | 	if err != nil {
 86 | 		log.Fatalf("could not read file: %+v\n", err)
 87 | 	}
 88 | 
 89 | 	var bucketsLeaked []Leak
 90 | 	err = json.Unmarshal(jsonBytes, &bucketsLeaked)
 91 | 	if err != nil {
 92 | 		log.Fatalf("could not unmarshal JSON: %+v\n", err)
 93 | 	}
 94 | 
 95 | 	sort.Slice(bucketsLeaked, func(i, j int) bool {
 96 | 		return strings.ToUpper(bucketsLeaked[i].Organization) < strings.ToUpper(bucketsLeaked[j].Organization)
 97 | 	})
 98 | 
 99 | 	f, err := os.Create("README.md")
100 | 	if err != nil {
101 | 		log.Fatalf("could not create README.md file: %+v\n", err)
102 | 	}
103 | 	defer f.Close()
104 | 
105 | 	w := bufio.NewWriter(f)
106 | 	t := template.Must(template.New("tmpl").Parse(tmpl))
107 | 	err = t.Execute(w, bucketsLeaked)
108 | 	if err != nil {
109 | 		log.Fatalf("could not merge data from JSON into README.md: %+v\n", err)
110 | 	}
111 | 	w.Flush()
112 | 
113 | 	hf, err := os.Create("docs/index.html")
114 | 	if err != nil {
115 | 		log.Fatalf("could not create index.html file: %+v\n", err)
116 | 	}
117 | 	defer hf.Close()
118 | 
119 | 	hw := bufio.NewWriter(hf)
120 | 	ht := template.Must(template.New("tmpl").Parse(htmlTmpl))
121 | 	err = ht.Execute(hw, bucketsLeaked)
122 | 	if err != nil {
123 | 		log.Fatalf("could not merge data from JSON into index.html: %+v\n", err)
124 | 	}
125 | 	hw.Flush()
126 | }
127 | 


--------------------------------------------------------------------------------
/yas3bl.json:
--------------------------------------------------------------------------------
  1 | [
  2 |   {
  3 |     "count": "24,000+",
  4 |     "data": "A 17MB Excel file containing Data Legend, GDDY Machine Raw Data, Summary, Compute, Storage, Instance Mapping, Spot, Price List sheets",
  5 |     "organization": "GoDaddy",
  6 |     "url": "https://www.upguard.com/breaches/public-domain-how-configuration-information-for-the-worlds-largest-domain-name-registrar-was-exposed-online"
  7 |   },
  8 |   {
  9 |     "count": "2,594",
 10 |     "data": "Full name, suffix, prefix, phone numbers (cell and landlines), address with house, street, city, state, zip, precinct, political affiliation provided by state, or inferred based on voting trends/history, age and birth year, gender, jurisdiction breakdown based on district, zip code, precinct, county, state, demographics based on ethnicity, language, education",
 11 |     "organization": "RoboCent",
 12 |     "url": "https://www.linkedin.com/pulse/hundreds-thousands-us-voter-data-appeared-online-again-bob-diachenko/?published=t"
 13 |   },
 14 |   {
 15 |     "count": "1.3 million",
 16 |     "data": "Names, addresses, zip codes, phone numbers, email addresses, ip addresses, plaintext passwords",
 17 |     "organization": "MBM Company Inc.",
 18 |     "url": "https://mackeepersecurity.com/post/walmart-jewelry-partner-exposed-millions-customer-details"
 19 |   },
 20 |   {
 21 |     "count": "3.2 million",
 22 |     "data": "Files include access credentials for 211 system operators, email addresses for contacts and registered resources of LA County 211, and detailed call notes, including full names, phone numbers, addresses, and even 33,000 instances of full Social Security numbers.",
 23 |     "organization": "211 LA County",
 24 |     "url": "https://www.upguard.com/breaches/la-county-211-hotline"
 25 |   },
 26 |   {
 27 |     "count": "",
 28 |     "data": "Names, addresses, dates of birth, phone numbers, income ranges, social security numbers (SSNs), driver licenses, armed forces and voter identification cards, bank checks, insurance policy documents, health and medical information (e.g. prescriptions and dosages), and some financial data. Insurance companies found in the data included Cigna, TransAmerica, SafeCo, Schneider Insurance, Manhattan Life, Everest - to name a few.",
 29 |     "organization": "AgentRun",
 30 |     "url": "https://www.zdnet.com/article/insurance-startup-leaks-sensitive-customer-health-data/"
 31 |   },
 32 |   {
 33 |     "count": "50,000",
 34 |     "data": "Names, phone numbers and email addresses for users and their trusted contacts, passwords, gender, information about their cars including VIN, Connect IDs.",
 35 |     "organization": "Honda",
 36 |     "url": "https://mackeepersecurity.com/post/honda-leaked-personal-information-from-its-honda-connect-app/"
 37 |   },
 38 |   {
 39 |     "count": "119,000",
 40 |     "data": "Scanned documents of US and international citizens, such as passports, driver licenses, security IDs, home addresses, phone numbers, zip codes",
 41 |     "organization": "Fedex",
 42 |     "url": "https://mackeepersecurity.com/post/fedex-customer-records-exposed"
 43 |   },
 44 |   {
 45 |     "count": "12,000",
 46 |     "data": "A database backup, called `octoly_production.sql`, exposed real names, addresses, phone numbers, email addresses, birth dates of thousands of influential online personalities (Instagram, Twitter, and YouTube personalities), like Dior, Lancome, and Blizzard Entertainment",
 47 |     "organization": "Octoly",
 48 |     "url": "https://www.upguard.com/breaches/cloud-leak-octoly"
 49 |   },
 50 |   {
 51 |     "count": "123 million",
 52 |     "data": "Data sets belonging to Experian and US Census Bureau, containing personal details of 198 million American voters and 123 million American household PII data such as home addresses, contact information, morgage ownership, financial histories, and purchasing behaviors.",
 53 |     "organization": "Alteryx",
 54 |     "url": "https://www.upguard.com/breaches/cloud-leak-alteryx"
 55 |   },
 56 |   {
 57 |     "count": "111 GB",
 58 |     "data": "Internal personal and financial data of tens of thousands of customers.",
 59 |     "organization": "National Credit Federation",
 60 |     "url": "https://www.upguard.com/breaches/credit-crunch-national-credit-federation"
 61 |   },
 62 |   {
 63 |     "count": "47 files",
 64 |     "data": "Highly sensitive INSCOM data. Some data was 'NOFORN' classified, indicating high sensitivity that cannot be shared with foreign allies",
 65 |     "organization": "NSA",
 66 |     "url": "https://www.upguard.com/breaches/cloud-leak-inscom"
 67 |   },
 68 |   {
 69 |     "count": "1.8 billion",
 70 |     "data": "Three (3) S3 buckets containing 1.8 billion posts of scraped internet content over the last 8 years.",
 71 |     "organization": "Department of Defense",
 72 |     "url": "https://www.upguard.com/breaches/cloud-leak-centcom"
 73 |   },
 74 |   {
 75 |     "count": "1 million",
 76 |     "data": "Names, addresses, credit scores and partial Social Security numbers",
 77 |     "organization": "Alliance Direct Lending Corporation",
 78 |     "url": "https://threatpost.com/auto-lender-exposes-loan-data-for-up-to-1-million-applicants/125216/"
 79 |   },
 80 |   {
 81 |     "count": "200 million",
 82 |     "data": "1.1 Terabytes worth of data on registered voters",
 83 |     "organization": "DeepRoot Analytics",
 84 |     "url": "https://www.upguard.com/breaches/the-rnc-files"
 85 |   },
 86 |   {
 87 |     "count": "2.2 - 4 million",
 88 |     "data": "Names, addresses, account information, email addresses, and last four digits of credit card numbers of millions of subscribers to Dow Jones publications",
 89 |     "organization": "Dow Jones",
 90 |     "url": "https://www.upguard.com/breaches/cloud-leak-dow-jones"
 91 |   },
 92 |   {
 93 |     "count": "1.8 million",
 94 |     "data": "Chicago voter names, addresses, date-of-births, partial SSNs, Driver Licenses, and state ID numbers",
 95 |     "organization": "ES&S",
 96 |     "url": "https://www.upguard.com/breaches/cloud-leak-chicago-voters"
 97 |   },
 98 |   {
 99 |     "count": "38,000",
100 |     "data": "Credit Card numbers, expiration dates, CVV codes",
101 |     "organization": "Groupize",
102 |     "url": "https://mackeepersecurity.com/post/online-hotel-booking-service-allegedly-exposed-sensitive-data"
103 |   },
104 |   {
105 |     "count": "Undisclosed",
106 |     "data": "Top Secret data from DoD, Pentagon, and National Geospatial Intelligence Agency (NGA), SSH keys, credentials granting access to data center Operating System",
107 |     "organization": "Booz Allen Hamilton",
108 |     "url": "https://www.upguard.com/breaches/spy-games"
109 |   },
110 |   {
111 |     "count": "93.4 million",
112 |     "data": "Mexican voter registration data",
113 |     "organization": "Mexico's Electoral Authority (INE)",
114 |     "url": "http://splinternews.com/a-massive-data-breach-exposed-personal-info-for-93-4-mi-1793856429"
115 |   },
116 |   {
117 |     "count": "540,642",
118 |     "data": "Tracking unit information including usernames, passwords, emails, Vehicle Identification Numbers, license plate numbers, IMEI numbers of GPS devices, specific location where the tracking units were hidden, information on customers and 427 dealerships, 116 GB of hourly backups, 8.5 GB of daily backups from 2017, and 339 log documents",
119 |     "organization": "SVR Tracking",
120 |     "url": "https://mackeepersecurity.com/post/auto-tracking-company-leaks-hundreds-of-thousands-of-records-online"
121 |   },
122 |   {
123 |     "count": "9,402",
124 |     "data": "Resumes of Top Secret US military veterans names, addresses, phones, emails, Driver License numbers, passport numbers, partial SSNs",
125 |     "organization": "TigerSwan",
126 |     "url": "https://www.upguard.com/breaches/cloud-leak-tigerswan"
127 |   },
128 |   {
129 |     "count": "4 million",
130 |     "data": "600 GB worth of data including usernames, emails addresses, MAC addresses, device serial numbers, and financial transaction information",
131 |     "organization": "Time Warner/BroadSoft",
132 |     "url": "https://mackeepersecurity.com/post/global-communication-software-left-massive-amount-of-data-online"
133 |   },
134 |   {
135 |     "count": "100 MB",
136 |     "data": "Data from internal Verizon Wireless system (DVS), 129 Outlook messages, logs, server names & info, admin usernames & passwords",
137 |     "organization": "Verizon",
138 |     "url": "https://mackeepersecurity.com/post/verizon-wireless-employee-exposed-confidential-data-online"
139 |   },
140 |   {
141 |     "count": "14 million",
142 |     "data": "Verizon customer names, addresses, account details, and Personal Identification Numbers (PIN)",
143 |     "organization": "Verizon",
144 |     "url": "https://www.upguard.com/breaches/verizon-cloud-leak"
145 |   },
146 |   {
147 |     "count": "72 files",
148 |     "data": "Encrypted compressed archives containing backup of company's IT infrastructure and private GPG keys used to encrypt the compressed archives",
149 |     "organization": "Viacom",
150 |     "url": "https://www.theregister.co.uk/2017/09/19/viacom_exposure_in_aws3_bucket_blunder/"
151 |   },
152 |   {
153 |     "count": "3,065,805",
154 |     "data": "Fans names, physical addresses, email addresses, earnings, ethnicity, children\u2019s age ranges, birthdates and additional personally identifiable information",
155 |     "organization": "WWE",
156 |     "url": "https://threatpost.com/leaky-wwe-database-exposes-personal-data-of-3m-wrestling-fans/126710/"
157 |   },
158 |   {
159 |     "count": "137+ GB",
160 |     "data": "4 S3 buckets exposing secret API data, authentication credentials, 40,000 plaintext passwords, credentials for GCP and Azure accounts, SSL certificates, private decryption keys, production VPN keys for internal/private networks, database dumps, user IP addresses, JSESSION IDs.",
161 |     "organization": "Accenture",
162 |     "url": "https://www.upguard.com/breaches/cloud-leak-accenture"
163 |   },
164 |   {
165 |     "count": "316,363",
166 |     "data": "47.5 GB PDF medical records containing weekly blood test results, patient names, addresses, and phone numbers. Development server backups. Doctor's names, case management notes, and additional client information.",
167 |     "organization": "Patient Home Monitoring",
168 |     "url": "https://mackeepersecurity.com/post/patient-home-monitoring-service-leaks-private-medical-data-online"
169 |   },
170 |   {
171 |     "count": "50,000",
172 |     "data": "Personal data of Australian employees of several government agencies, banks, and a utility company, including full names, passwords, IDs, phone numbers, email addresses, credit card numbers, salaries and expenses.",
173 |     "organization": "Australian Broadcasting Company",
174 |     "url": "https://mackeepersecurity.com/post/australian-broadcasting-corporation-exposed-sensitive-data-online"
175 |   }
176 | ]
177 | 


--------------------------------------------------------------------------------