{"id":26025,"date":"2019-03-11T19:54:51","date_gmt":"2019-03-11T19:54:51","guid":{"rendered":"http:\/\/50566f88-1684-45c0-9d06-0ae855647c2b"},"modified":"2019-03-11T19:54:51","modified_gmt":"2019-03-11T19:54:51","slug":"companies-are-leaking-sensitive-files-via-box-accounts","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/companies-are-leaking-sensitive-files-via-box-accounts\/","title":{"rendered":"Companies are leaking sensitive files via Box accounts"},"content":{"rendered":"

\"Box<\/span>Image: Box<\/span><\/p>\n

Companies that use Box.com as a cloud-based file hosting and sharing system might be accidentally exposing internal files, sensitive documents, or proprietary technology.<\/p>\n

\n

More security news<\/span><\/h3>\n<\/div>\n

The exposure occurs due to human error, said Adversis, the cyber-security firm which investigated this issue and worked with Box and affected companies to correct it.<\/p>\n

The problem lies with Box.com account owners who don’t set a default access level of “People in your company” for file\/folder sharing links, leaving all newly created links accessible to the public.<\/p>\n

If the organization also allows users to customize the link with vanity URLs instead of using random characters, then the links of these files can be guessed using dictionary attacks.<\/p>\n

This is what Adversis did last year. The company says it scanned Box.com for accounts belonging to large companies and attempted to guess vanity URLs of files or folders that employees shared in the past.<\/p>\n

Its efforts weren’t in vain. In a report<\/a> published today, Adversis said it found a trove of highly sensitive data such as:<\/p>\n