Japanese toy vendor Sanrio, owner of the popular Hello Kitty brand, is admitting to a security vulnerability on its SanrioTown.com community Website. The vulnerability has already been patched, and there is no public evidence that private user information has been publicly posted.
“On Dec. 19, it was revealed through outside sources that personal information such as names, date of birth, gender and other information belonging to SanrioTown.com members was accessible if you knew the address of the vulnerable servers,” Sanrio stated in a release on Dec. 22. “The vulnerable data did not include credit card information or other payment information and passwords were securely encrypted.”
The outside sources include a report that alleged that 3.3 million Hello Kitty fans were exposed by a database leak. In a statement sent by Sanrio to eWEEK Dec. 21, the company noted that it was investigating the report. Sanrio did not respond directly to a question from eWEEK about whether the vulnerability was responsibly reported to them.
Though multiple media reports this week have alleged that details on millions of users were publicly leaked, Sanrio is denying that claim.
“To the Company’s current knowledge, no data was stolen or exposed,” Sanrio stated. “Up to 3.3 million Website members were potentially affected by this security vulnerability; however, there is no indication that any user data was actually exposed or utilized by malicious parties.”
That said, there was a vulnerability on SanrioTown.com that could have enabled an attacker to potentially get access to personal user information, including names, birth dates and user passwords. Sanrio is now recommending that users change their passwords for SanrioTown in order to further limit any potential risk.
While Sanrio’s statement doesn’t identify the vulnerability, it does indicate that it was a server misconfiguration that enabled the vulnerability.
According to Sanrio, it has now placed additional security measures on its vulnerable servers and is conducting a review on how its servers were left vulnerable.
Unfortunately, misconfigured servers, particularly database servers, are not uncommon.
Chris Vickery, the security researcher who first discovered the SanrioTown.com vulnerability, also reported on a similar flaw with software vendor MacKeeper earlier this month. In the MacKeeper incident, up to 13 million user accounts were potentially exposed to risk. Among the risky server misconfigurations are MongoDB databases, which a Shodan security search shows 35,000 publicly available and unauthenticated instances that could be exposing users to risk.
The SanrioTown vulnerability is particularly worrisome in light of the recent disclosure of security vulnerabilities with toy vendor VTech as well as the Hello Barbie toy. In the VTech incident, law enforcement in the UK has already made an arrest.
With the Hello Barbie toy incident, the security vulnerabilities were responsibly reported to the vendor and fixed, limiting the risk.
The truth is that security vulnerabilities exist and it is incumbent upon researchers to responsibly report issues when they find them. Sometimes it’s easy—for example, when server misconfigurations that can be easily found using publicly available Internet tools like Shodan.
When it comes to database security–especially when those databases contain the information of children—vendors really need to take responsible actions now to make sure that simple database misconfigurations are not exposing users to unnecessary risk.
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.