Reverse-lookup service exposed millions of photos of people's faces
ClarityCheck, a people-search tool, left over 9 million image files (including faces of adults and children) publicly exposed via an unsecured Amazon S3 bucket containing roughly 450 GB of data A second misconfiguration allowed anyone to retrieve email addresses, phone numbers, and physical addresses by manipulating website URLs with simple name searches The exposed data was accessible through a URL embedded in the company's publicly available website code, with folders explicitly named "faces"
Analysis
TL;DR
- ClarityCheck, a people-search tool, left over 9 million image files (including faces of adults and children) publicly exposed via an unsecured Amazon S3 bucket containing roughly 450 GB of data
- A second misconfiguration allowed anyone to retrieve email addresses, phone numbers, and physical addresses by manipulating website URLs with simple name searches
- The exposed data was accessible through a URL embedded in the company's publicly available website code, with folders explicitly named "faces" and "profiles"
- ClarityCheck disputed the characterization of the data as "publicly exposed," arguing access required knowledge of a specific unindexed URL, while security experts and the US federal government define exposure broadly as any data accessible without authentication
- The incident raises concerns about AI training data ethics, as bots could crawl the exposed images to extract faces for model training, particularly given the presence of children's photos
Why It Matters
This incident highlights the growing tension between AI-powered people-search services and personal data privacy, demonstrating how misconfigured cloud infrastructure can lead to mass exposure of sensitive biometric data. For AI practitioners and security professionals, it underscores the critical importance of securing storage buckets and API endpoints that handle biometric and personally identifiable information, especially as these tools become more prevalent and automated.
Technical Details
- The exposed data resided in an unsecured Amazon S3 bucket accessible via a URL hardcoded in ClarityCheck's publicly available website source code, with subdirectories explicitly labeled "faces" and "profiles"
- A separate API misconfiguration allowed URL manipulation: entering a person's name into specific endpoint URLs returned email addresses, physical addresses, and phone numbers without any authentication
- The image database contained approximately 450 GB of files, including profile images, screenshots, and photographs of adults, teenagers, and children, stored as duplicate, cropped, and resized copies alongside non-image data
- ClarityCheck's face-search feature operates by scanning facial landmarks and mapping unique face geometry to match uploaded images against online sources, generating reports that include names, addresses, location history, and social media profiles
- The company claimed the data was sourced from publicly available information and licensed third-party data providers, and stated it has since improved its security reporting procedures
Industry Insight
- AI companies and people-search platforms must treat biometric data with heightened security standards, as facial images are unchangeable sensitive identifiers that pose irreversible harm if exposed
- Cloud storage misconfigurations remain a leading cause of data breaches; organizations should implement automated bucket policy auditing and enforce least-privilege access by default
- The incident reinforces the need for responsible disclosure frameworks, as ClarityCheck initially failed to respond to the researcher's attempts to flag the vulnerability before media involvement prompted action
Disclaimer: The above content is generated by AI and is for reference only.