Microsoft Power Apps misconfigurations expose 38 million records

Date:

Share post:

- Advertisement -

Dev Kundaliya

Multiple data leaks took place as a result of weak default configurations on Microsoft Power Apps portals, leading to more than a thousand web apps accessible to anyone who found them.

According to researchers at UpGuard, the leaks exposed 38 million records online, including data from a number of job application portals, employee databases, Covid-19 contact tracing platforms and vaccination sign-ups.

It affected a total of 47 organisations, exposing a range of sensitive information – from peoples’ phone numbers and home addresses to US social security numbers and Covid-19 vaccination status.

The exposed data was stored in Microsoft’s Power Apps portal service, which offers customers a variety of low-code tools to design apps, as well as public and private web sites. The platform manages internal databases for apps and websites, as well as providing ready-made APIs to interact with that data.

UpGuard researchers first discovered the issue involving the ODdata API for a Power Apps portal on 24th May and reached out to Microsoft on 24th June. Forty-seven entities were notified about the data exposure.

UpGuard found that when enabling APIs, the platform defaulted all data types to public when some information should have been made private.

Because enabling privacy settings was a manual process, many customers misconfigured their apps by leaving the insecure settings as default.

According to UpGuard, Microsoft listed the implications of those settings, but did not make them very clear.

‘The number of accounts exposing sensitive information, however, indicates that the risk of this feature – the likelihood and impact of its misconfiguration – has not been adequately appreciated. On one hand, the product documentation accurately describes what happens if an app is configured in this way. On the other hand, empirical evidence suggests a warning in the technical documentation is not sufficient to avoid the serious consequences of misconfiguring OData list feeds for Power Apps portals.’

See also  Google plans privacy change similar to Apple’s, which wiped $230 billion off Facebook’s market cap

The incident affected major organisations and private companies, including American Airlines, logistics firm J.B. Hunt, Ford, the New York City Municipal Transportation Authority, the Maryland Department of Health, and New York City public schools.

Microsoft itself exposed some databases in its own Power Apps portals, including a Customer Insights portal, a Global Payroll Services platform, and two Business Tools Support portals.

Microsoft has since changed its default settings for Power Apps and is also providing a tool to help users diagnose their security.

Researchers say they found no evidence to suggest that any of the data being compromised.

The misconfiguration of cloud-based databases, which could hackers to steal huge quantities of sensitive data, has been a serious issue over the years.

Earlier this year, Nissan North America was hit with a data leak after misconfiguring one of its Bitbucket Git servers. The exposed data included source code of Nissan mobile apps and diagnostics tools.

Last year, researchers found an unsecured database stored on an AWS S3 bucket, which was exposing sensitive information on thousands of British consultancy firms and working professionals.

- Advertisement -

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Related articles

How to correct name, date of birth, others on NIN using mobile app

National Identity Management Commission (NIMC) has unveiled a mobile application for Nigerians to modify their data on the...

Viewpoint: Why Artificial Intelligence Must Be Stopped Now

The promise of  Artificial Intelligence, AI is eclipsed by its perils, which include our own annihilation, writes Richard...

5 Ways EV competition in China led to increasingly novel add-ons from beds to drones to boost sluggish sales

BY BLOOMBERG In China, top EV makers are facing a slowdown in demand at home as consumers curb spending,...

India’s first sari-donning AI humanoid robot teacher starts teaching in a school

The first AI humanoid robot developed for teaching in India is grabbing attention across social media platforms. writes...