Type
Research
Actors
Pub. date
October 27, 2024
Initial access
Cloud native misconfig
Impact
Resp. disclosure
References
https://techcrunch.com/2022/10/27/amazon-prime-video-server-exposed/
Status
Finalized
Last edited
Nov 4, 2024 1:56 PM
Security researcher Anurag Sen discovered an unprotected Amazon Prime database containing pseudonymized viewing data, accessible from the internet without a password. Named "Sauron," the Elasticsearch database held approximately 215 million records, including information on streamed content, device type, network quality, and subscription status. Detected by Shodan on September 30, the database remained exposed for weeks. Amazon quickly secured the data after being alerted and clarified that the issue was due to a deployment error unrelated to AWS security.