After ASRock, MSI Also Found Exposing Customer After-Sales Data: Over 600,000 Users' Information Freely Downloadable
Brook.X
Previously, motherboard manufacturer ASRock was discovered to have leaked a vast amount of detailed after-sales customer information. The leakage occurred because ASRock failed to set the necessary permissions for their servers, allowing search engine crawlers to directly index the after-sales request forms submitted by users. These forms contained users' real names, phone numbers, detailed addresses, and more.
Now, MSI has been found to have the exact same security incident. By using specific keywords, one can find MSI's after-sales service website linked through search engines, which contains various detailed user-submitted information.
Through the after-sales service website, anyone can directly download and export user data submitted through MSI's official website since 2017, also including real names, phone numbers, and detailed addresses, among other information.
Tests showed that it was even possible to resubmit after-sales requests, track detailed information of after-sales requests, access responses and reasons for malfunctions provided by MSI, and expose the information of well-known game streamers.
This issue was discovered by the YouTube channel Gamers Nexus, which immediately notified MSI for resolution. MSI's approach to dealing with the problem was rather blunt, as they directly blocked access to the relevant servers and even stopped resolving the subdomain.
However, this method does not completely solve the problem because some search engines still provide cached pages, allowing access to related after-sales request information and thus users' detailed information.
Since the problem can be traced back to 2017, it means that the information of over 600,000 users has been exposed on the internet for 7 years. What's worse is that MSI's situation is more severe than ASRock's, as MSI's after-sales system even allows exporting all data as an Excel file.
The same basic security issue occurred with both MSI and ASrock, stemming from their failure to configure the necessary permissions for their servers, allowing search engines and anyone to access them. It seems likely that the security teams of these companies have not thoroughly checked the permissions of their internal infrastructure.
