A middle school’s facial recognition database exposes student data
The database contains records for 1.3 million people, including students, teachers, cleaners and security personnel
China's internet is known for its lax security, so it's surprisingly easy to find all kinds of things there if you know where to look. And one security researcher recently unearthed a disturbing trove of photos, ID and student numbers, GPS locations, and even school grades belonging to teenagers.
GDI Foundation security researcher Victor Gevers uncovered an unsecured facial recognition database in China belonging to Ruoergai Middle School in Sichuan province. It was left open to the internet, with no firewall or authentication methods protecting it, according to Gevers.
The database contained high-resolution pictures used to train the facial recognition system alongside much more private information of students.
“The database had information like ID numbers of the document, student number, nationality, gender, telephone numbers, grades, class, when they passed a certain checkpoint,” Gevers said.
The system, maintained by a platform called Xiaoan Yundun, covered 1.3 million people, including teachers, cleaners and security personnel.
China is the biggest place for data leaks, according to Gevers. The country has seen several scandals over the past few years involving people’s IDs, phone numbers, addresses, contacts and other data being sold on the internet.
This is why Ruoergai might not be the only Chinese school that’s unintentionally giving up their students’ sensitive data. Gevers said his organization detected about 200,000 open databases in China that have problems with security or missing patches.
The researcher said that the middle school’s database, which has been online since June, was secured 24 hours after his team sent a request to the company’s internet service provider, Alibaba Cloud. But it’s not clear if the school has taken any additional measures to protect the sensitive data of its students. Calls to the schools went unanswered while Xiaoan Yundun couldn’t be reached.
(Abacus is a unit of the South China Morning Post, which is owned by Alibaba.)