February 2020

Virgin Media 2020: 900,000 People in an Unsecured Marketing Database

Post author:Prabhu Kalyan Samal
Post published:February 28, 2020
Post category:Identity & Phishing Security

On 28 February 2020, Virgin Media confirmed that a marketing database containing the personal details of around 900,000 people had been left insecure and accessible online, discovered not by criminals but by a researcher during unrelated work. The dataset, stored on an unsecured cloud instance, included names, home and email addresses, and phone numbers, and had been reachable for at least ten months. This post explains exactly what was exposed, how the misconfiguration happened, how Virgin Media responded, and what happened next: a textbook non-hack data breach that still required full disclosure, notification, and regulatory scrutiny.

Clearview AI in 2020: Three Billion Scraped Faces, One Leaked Client List

Post author:Prabhu Kalyan Samal
Post published:February 28, 2020
Post category:Identity & Phishing Security

In late February 2020, facial recognition startup Clearview AI confirmed that a misconfigured server had exposed its entire client list, days after a major newspaper investigation revealed the company had scraped more than three billion facial images from social networks and the open web to sell face search to police. The leaked list showed U.S. retailers, banks, and investors among users of a tool built on photos most people never knowingly gave. Cease-and-desist letters from Facebook and other platforms followed, along with GDPR complaints across Europe. This is how facial recognition's most aggressive company lost control of its own story in a matter of weeks.

Ransomware at a Gas Compression Facility: The CISA Alert That Mapped OT Risk

Post author:Prabhu Kalyan Samal
Post published:February 20, 2020
Post category:Cloud & Infrastructure Ransomware & Malware Security

On 20 February 2020, CISA published AA20-030A, a joint advisory describing how ransomware had disrupted a natural gas compression facility: a phishing link let commodity ransomware spread from IT into the OT network, encrypting data historians and polling servers, severing HMI visibility, and leaving operators blind to real-time pressure and flow data for two days. The advisory became a reference model for oil and gas asset owners because it mapped, step by step, how a single email chained into loss of operational visibility without directly controlling pipeline equipment. This retrospective walks through the kill chain, the defensive gaps, and the guidance that followed.

Exchange CVE-2020-0688: A Default Key Made Every Server Alike

Post author:Prabhu Kalyan Samal
Post published:February 11, 2020
Post category:Cloud & Infrastructure Security Web & API Security

On 11 February 2020, Microsoft disclosed CVE-2020-0688, a remote code execution vulnerability in Microsoft Exchange Server's Unified Messaging service that scored 9.8 on CVSS because every installation shipped with the same cryptographic validation key by default. Any authenticated user could send a specially crafted viewstate to the Exchange Control Panel and achieve RCE as SYSTEM, and because service accounts and weak credentials were everywhere, authenticated was a low bar. This analysis walks the vulnerable request path, the viewstate forgery mechanics, the patch, and the long tail of scanning and exploitation that followed for months.