lionsgate

The video-streaming service Lionsgate Play was found to have exposed user information via an exposed ElasticSearch instance, the researchers found during their examination.

The Cybernews research team found 20GB of server logs that were not password-protected and comprised about 30 million entries. These records revealed subscribers' IP addresses as well as user information about device, operating system, and web browser.

The platform's usage information, which is generally used for analytics and performance monitoring, was also exposed by logs. The names and IDs of the content that users watched on the site were located in URLs that were discovered in logs, coupled with the search terms that users used.

Researchers also discovered unidentified hashes with HTTP GET request records, which are records of requests made by clients and typically used to obtain data from servers and are maintained in log files on the server.

Source: https://securityaffairs.com/143886/security/lionsgate-data-leak.html

TPRM report: https://scoringcyber.rankiteo.com/company/lionsgate

"id": "lio4221023",
"linkid": "lionsgate",
"type": "Data Leak",
"date": "03/2023",
"severity": "85",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'industry': 'Video Streaming',
                        'name': 'Lionsgate Play',
                        'type': 'Company'}],
 'attack_vector': 'Unsecured ElasticSearch Instance',
 'data_breach': {'number_of_records_exposed': '30 million entries',
                 'type_of_data_compromised': ["Subscribers' IP addresses",
                                              'Device information',
                                              'Operating system',
                                              'Web browser',
                                              'Usage information',
                                              'Content names and IDs',
                                              'Search terms',
                                              'Unidentified hashes']},
 'description': 'Lionsgate Play exposed user information via an unprotected '
                "ElasticSearch instance, revealing subscribers' IP addresses, "
                'device information, and usage data.',
 'impact': {'data_compromised': ["Subscribers' IP addresses",
                                 'Device information',
                                 'Operating system',
                                 'Web browser',
                                 'Usage information',
                                 'Content names and IDs',
                                 'Search terms',
                                 'Unidentified hashes'],
            'systems_affected': 'ElasticSearch Instance'},
 'title': 'Lionsgate Play Data Exposure',
 'type': 'Data Exposure',
 'vulnerability_exploited': 'Lack of Password Protection'}