Wordpress back pan? ICO project leaked 15,000 KYC files

The ICO project "accidentally" made 15,000 KYC files visible to everyone.

According to the recent DecrypreportsHarry Denley, a security analyst at open source cryptography startup MyCrypto, is investigating a us-based cryptography startup (not named). The start-up's website is registered anonymously, for a variety of reasons that make it look suspicious.

The photos the team posted on its website were fake. The company's chief marketing officer, Rizwan Gray, used a photograph of a university professor named Jonathan Schiff.

Most worryingly, the site is built on a WordPress site, rather than a more sophisticated backend. The vulnerability of sites like WordPress makes it possible for any non-professional to see a user's KYC files, because all uploads are in the same place in the directory, and if a careless back-end engineer opens the directory, the user can stumble across the documents by inserting a generic URL.

As a result, a directory of KYC data uploaded by the startup's 15,000 hopeful investors is arguably public.

In these files, security analyst Denley see "uniformed personnel armed with id card and a driver's license, including the user's fingerprint data file, id card, Bangladesh and more called 'the Indian government id, an Italian passport, passport of Russian federation, Ukraine's passport, the Algerian passport, passport of the republic of Korea, socialist republic of Vietnam passport, venezuela's passport......"

KYC documents are a treasure trove for hackers

Security analyst Denley said the release of the documents is important. If the information is in the hands of criminals, along with other data, people can use it to harm you in a variety of ways: they can steal your identity, steal your money, damage your credit rating, damage your reputation, and cause a lot of trouble in your life.

With cryptocurrencies widely recognized and governments trying to constrain cryptocurrency trading,KYC/AML requirements are inevitable. Unless you completely refuse to use an exchange, most places where you can exchange digital tokens for cash comply with these laws.

Security analysts say that most formal exchanges and encryption firms keep their customers' information safe.

Most of these KYC leaks still occur in dubious ICO projects and startups,"Startups" like the ones he investigates give the illusion of compliance as an excuse to obtain valuable KYC data.

Finally, security analysts suggest that users should choose a formal and large exchange for trading, and that token sales should be made on the exchangeA reputable exchange is conducted.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia