Do you know how much of your personal and private data exists on the internet for anyone to view? Even when you think this information is kept behind well-maintained security walls, it might not be. This issue was highlighted last week when researchers found a number of websites built with Salesforce Community software were “leaking” private information to anyone who could re-type a URL.
At its heart, the issue concerns who can “own” your private data and who controls access to it. The Internet was originally designed to facilitate data sharing and openness. As it became a communications network for sharing all kinds of information, both public and confidential, security features were developed and added in, as well as controls over who could access certain data and how.
Too often, human error or lack of skills leads to major breaches or quieter data “leaks” of private information. While increasing knowledge and skills is the obvious way to avoid them, this also has vulnerabilities. It would be better to re-think and redesign the internet’s entire security model, using encrypted and blockchain-stored information that allows users to “own” their own personal data and digital access tokens with more granular control over who may access it.
With a token/blockchain-based system, access can be restricted to only certain individuals, only for certain purposes, and even for limited times. Individual permissions can be granted or revoked easily, and the blockchain keeps a record of everything that has happened—who accessed specific data and when, and if any of the records have been altered.
The Salesforce Community issue
Security consultant and 13-year Salesforce employee Doug Merrett described in detail how the problem occurs and published guides on how to avoid it. The issue exists with Salesforce’s cloud-based website-building software Digital Experiences/Experience Cloud, formerly Salesforce Aura Communities. It allows anyone to create online databases with custom layouts, including personal details, for any number of purposes depending on industry and requirements.
Merrett described how Salesforce Community users could gain access to others’ personal records by “hacking” a URL. This involves typing information manually into a browser’s URL field to see other pages rather than navigating to them using a website’s interface. It’s one of the most basic forms of hacking as it involves only the most rudimentary technical skills (plus maybe some clever guesswork), and it’s a technique that many have used since the earliest days of web browsers to see pages the website manager didn’t intend for you to see. For example, a corporate profile for an employee who’s left the company links to their page has been removed from the main site, but the data itself hasn’t been deleted from the server.
Most web designers these days are well familiar with this technique and work around it with page redirects and account access levels, though it’s still possible on a number of sites.
On Salesforce Community-created pages, it may be possible to view someone else’s records, complete with information that should be private, by replacing the record ID string of numbers in the URL. You’d have to know the correct record ID format, but this can be deduced by anyone familiar with the system or with basic pattern recognition skills.
Merrett noted that administrators could avoid the problem by setting guest/user access levels to be more restrictive or altering the settings to redirect any users who attempt to change the URL manually. Since admins do have the ability to do this, Salesforce didn’t consider the issue a security bug.
Security writer Brian Krebs noted last week that there had been several cases where outsiders were able to view private information (dates of birth, home phone numbers) in database records. Some admins even allowed guest users with no login accounts to view the information, making it even more difficult to determine who may have accessed what. Instances included private details of applicants to Vermont’s Unemployment Assistance program, complete with full names and social security numbers, home phone numbers and addresses, email addresses, and even bank account numbers.
Ohio’s Huntington Bank also had a Salesforce Community site with “leaky” data that revealed all the above information, plus payroll details and loan information. Security researchers said they’d contacted admins at several other sites with the same vulnerabilities, often receiving either a denial or no response.
Reducing human error and mitigating a lack of developer skills
The Salesforce issue is arguably due to bad admin policies than technical shortcomings. If a system is misconfigured, or security settings are “left as default,” then the problem lies more with the administrator’s skill level and/or time resources than with what they should be able to do.
Vermont’s Chief Information Security Officer Scott Carbee put the problem down to “tons of applications” for assistance during the COVID-19 pandemic, which led to Salesforce sites being created by less experienced developers.
Similarly, a password left as default (e.g., on your wifi router) or a too-simple/obvious password on a Gmail account allows security problems to occur, and most would blame the user over the system itself, since you have the ability to set more secure passwords if you’re inclined. Salesforce even produces guides on how best to configure access and security.
But what if access wasn’t determined by a password at all? What if your access to an account was dictated by an encrypted access token created automatically and stored in a digital wallet? You could have all the security of a strong password without ever having to set it.
Systems can be designed to minimize the amount of work a user must do to keep them secure. The more security built into that system at the highest levels, without requiring extra configuration from admins and individual users, the better.
You need your bank and insurance provider to know your full contact details and complete history of interaction with the institution, but that doesn’t mean you want every employee at those institutions to be able to see your records. Even today, most online databases function with this in mind, yet data still leaks. Though standards and libraries exist, most sites and their security functions are created individually. They may not be as secure as they look, and their records are usually incompatible with other external systems. Ultimately, most users will enter private details (or have them entered by others) into online databases without knowing how secure they are.
Blockchain is the answer, and only the BSV blockchain
A token/blockchain-based security system would allow databases built on a single standard with information stored on one universal ledger of truth. An encrypted digital ID token with your basic personal information could exist only in one place, with the user granting access only where necessary. Personal data created by institutions (e.g., loan records or insurance claims) could also be tokenized, perhaps using sub-tokens that still gave individuals ultimate ownership and access control of data pertaining to themselves, with logs of how that data has been used.
This is only possible on a blockchain network that processes data with proof-of-work (shown to be more secure than other protocols like proof-of-stake) and has enough data-processing and storage capacity to handle as much information as exists on the internet today. As of today, the BSV blockchain is the only network with these capabilities.
Changing the internet’s data security model requires a fundamental, if not radical, change in approach to building robust data access methods and a cultural shift where individuals see their private data as something they should own and safeguard rather than hand it out to anyone asking for it. However, radical changes are coming, whether BSV or blockchain is used or not, as more and more of our lives become data-based. Far better to have those conversations as soon as possible, before it’s too late or before more mediocre solutions become widely-used.
Watch Gregory Ward: BSV blockchain is an absolute fit for cybersecurity
New to blockchain? Check out CoinGeek’s Blockchain for Beginners section, the ultimate resource guide to learn more about blockchain technology.
