Great idea
The failure of organizations to properly manage the servers they hire from cloud service providers can allow attackers to access confidential data, research conducted with my colleagues and I have demonstrated.
Cloud computing allows businesses to rent servers in the same way they rent an office space. It is also convenient for his companies to maintain mobile applications and websites where they do not have to worry about owning and managing servers. But this approach to service delivery raises security concerns.
Each cloud server has a unique IP address that allows users to connect and send data. After the organization no longer needs this address, it is given to another customer service provider, perhaps with malicious intent. IP addresses change hands every 30 minutes as organizations change the resources they use.
If organizations stop using a cloud server but fail to remove the IP address references from their systems, users may continue to send data to this address, assuming they are talking to a real service. Because they trust the service that used the address previously, users' devices automatically send sensitive information such as GPS location, financial data and browsing history.
An attacker can use this by "stabbing" in the clouds: by searching for IP addresses to try to get traffic targeted by other organizations. The rapid change of IP addresses leaves little time for identification and troubleshooting before attackers begin to receive data. Once the attacker controls the address, he can continue to receive the data until the organization detects and fixes the problem.
Misused cloud services are another opportunity for data attackers to steal. Penn State video.
Our study of a small portion of cloud IP addresses found thousands of businesses that may have the potential to leak user data, including mobile application data and ad trackers. These applications were originally intended to share personal data with businesses and advertisers, but instead leaked data to anyone who controlled the Internet address. Anyone with a cloud account can collect the same data from vulnerable organizations.
Why it is important
Smartphone users share personal data with businesses using the apps they install. In a recent study, researchers found that half of all smartphone users were free to share their location with smartphone apps. But personal information that users share with these apps can be used to steal their identity or damage their reputation.
Personal data has seen increasing control in recent years, and users may be content to trust their business associates to follow those rules and respect their privacy. But these rules may not adequately protect users. Our research shows that even if companies intend to use the data responsibly, poor security procedures can leave that data untouched.
Users should be aware that when sharing their personal or private data with companies, they are also exposed to the security practices of those companies. They can take steps to reduce this exposure by limiting how much data they share and how many organizations they share.
Other research is being done in this field
Studies and industries focus on responsible consumer data collection. Google's latest campaign aims to reduce the collection of personal data by users through mobile ads, ensuring that their security and privacy are protected.
At the same time, researchers are working to better explain what applications do with the data they collect. This function aims to ensure that users' data shared with apps is used in the way they expect it by comparing permissions and behavior to applications.
What's next
We are conducting research into new technologies on smartphones and devices to ensure that they protect user data. For example, a partner-led study describes how to protect personal information collected by smart cameras. Our point of traffic in the public cloud also empowers new online courses across. We continue to work with cloud providers to ensure that user data stored in the cloud is secure, and we introduce strategies to prevent businesses and their customers from being harassed in the cloud.
You must be logged in to post a comment.