100GB of secret NSA data found on unsecured AWS S3 bucket

Share

Earlier this month, researchers at UpGuard reported that USA military intelligence gathering data had been stored on a misconfigured Amazon Web Services S3 server that wasn't password protected and was publicly viewable.

Chris Vickery of UpGuard located the data and informed the government in October, and the server was secured soon after.

Red Disk is the Pentagon's "distressed" cloud-based intelligence sharing system.

The unlisted yet public AWS storage server contained more than 100 GB of data from "Red Disk" and anyone on the internet could access and download it as it was not protected by a password, as reported by ZDNet. What is surprising about this "breach" is the fact that the information about the owner of the server is unknown at the time of writing.

Over the past several years, the NSA has come under fire following leaks starting in 2013 when Edward Snowden revealed agency information showing widespread surveillance of phone call data and emails. The US Army and INSCOM didn't immediately respond for a request for comment. The exposed S3 bucket contained 47 "viewable" files, three of which were downloadable.

According to reports, the disk image contains a snapshot of a hard drive dating back to May 2013, from a Linux-based server that is an element of Red Disk, a cloud-based intelligence sharing platform.

The military unit, which reports directly to the Army Deputy Chief of Staff for Intelligence, provides an array of intelligence-gathering capabilities, including the interception and analysis of communications and electronic signals, and conducts information and electronic warfare worldwide. Some of the exposed files were marked as Top Secret, and appeared to belong to US Army Intelligence and Security Command (INSCOM), UpGuard said in a Tuesday blog post. This platform was apparently meant to complement the United States military's existing plans for examining and sharing intelligence, surveillance and other classified information. The system that the Army uses is stated to be the largest and that it struggles to scale with the demand.

Red Disk was reportedly slated to be an effective way for the Pentagon to communicate with deployed soldiers in Afghanistan, share intelligence data such as providing satellite photos, videos from drones, and more. Previous UpGuard finds include sensitive data exposed by a defense contractor, a Verizon partner, a political ad strategizing firm hired by the GOP, a voting machine supplier and a major consulting and management company.

Data theft from the NSA can lead to serious collateral damage. The breach also included private keys belonging to Invertix, a defense contractor that works with INSCOM. Last but not the least, Vickery reiterated that this exposure of data was "entirely avoidable" in the long list of government leaks reported past year.

Share