Public Knowledge Calls for FCC, FTC Action to Protect VoIP CPNI

摘要

Public Knowledge has called for the FCC and Federal Trade Commission to take action in response to reports that California-based VoIP (voice-over-Internet-protocol) service provider Voipo exposed consumer call logs and text messages by storing them on an improperly secured ElasticSearch database. In a Jan. 15 blog post, security research Justin Paine reported that Voipo "promptly secured" the database after he discovered it and notified Voipo on Jan. 8. He said that Voipo "indicated this was a development server that had accidentally been left publicly accessible. However, they also confirmed in their reply to me that the database also contained 'valid data' - i.e. real production data. They did not specify which data was allegedly development data and which was production data though. I would speculate that the leaked credentials ... were likely production credentials. It also appeared that the SMS/MMS and VOIP phone logs appeared likely to be production data."