💨 Abstract

An Amazon-hosted storage server for the Duc App, a money-transfer service by Duales, was publicly accessible without a password, exposing potentially hundreds of thousands of users' personal data, including driver's licenses, passports, and transaction details. The data was also unencrypted. Security researcher Anurag Sen discovered the issue and alerted TechCrunch, which then notified Duales. The company resolved the exposure but did not clarify why the data was publicly accessible.

Courtesy: Zack Whittaker