Photo search service ClarityCheck exposed 9 million pictures of faces online

ClarityCheck, a service that promises users their “reverse image search is private and secure,” left more than 9 million image files publicly accessible. That was reported by independent security researcher Jeremiah Fowler.

According to his findings, an unsecured Amazon S3 bucket held about 450 GB of images — profile pictures, screenshots and other photos of adults, teenagers and children. The files sat in folders with telling names like “faces” and “profiles,” and they could be reached through a URL that appeared right in the open source code of the company's website. A second misconfiguration exposed email addresses and phone numbers: by plugging a name into a particular address, any user with an ordinary browser could pull up a list of possible emails, physical addresses and phone numbers.

Biometrics you can't change

The danger is that this is biometric data which, unlike a password, cannot be changed. Fowler highlights the paradox of services like this: they are built to identify strangers. That means whoever's face ended up in the database most likely had no idea about it — after all, no one goes searching for themselves or their loved ones by photo. Technically the site requires users to confirm that whoever uploads an image has permission to publish it, but in practice that checkbox guarantees nothing. The researcher warns that such a database could be scraped by an AI bot that would extract faces and use them to train models — and there are plenty of children's photos in there.

An argument over the word “breach”

After WIRED contacted the company in July, access was closed off; even so, by Fowler's estimate the database had been open for months, and the first attempts to warn its owners went unanswered. ClarityCheck, for its part, refuses to acknowledge the data as “exposed”: according to a representative, an ordinary visitor would never have stumbled onto it, since you had to know a specific, non-indexable address. The company also stated that the 9 million files are not unique images but include duplicates, cropped and downsized copies and non-image data.

Security experts read the situation differently. As Mark Beare of Malwarebytes notes, data is considered exposed if it can be accessed by those it wasn't meant for — especially when it sits on the open internet without a password, regardless of whether anyone actually took advantage of it. The U.S. federal government takes the same approach.

Rebecca Williams of the ACLU points out that services which rely on harvesting sensitive data to identify people will always carry such risks — their very model is built on amassing information like this. And Fowler sketches a vivid scenario for abuse: a scammer need only scroll through the photos, pick a couple dozen of the most attractive faces and use AI to assemble them into fake identities for fraud.

Source: Ars Technica