Introduction

In 2018, a major telecom and cloud communications platform was found to have unintentionally exposed sensitive customer data through archived versions of its website.

Using the Wayback Machine, historical URLs associated with audio recordings were identified. These recordings could be accessed without authentication and contained conversations between businesses and their customers, potentially exposing personal and confidential information.

In this blog, we’ll explain how the exposure was discovered, what information was accessible, why archived content can become a security risk, and how organizations can prevent similar incidents.

Disclosure Note: To protect the identity of the affected organization, the company name and original infrastructure details have been intentionally omitted. The domain api.telecompany.com is used as an anonymized reference throughout this article.

Target Overview

The affected platform was a leading global cloud communications platform that enables businesses to communicate with customers through voice, messaging, video, and email.

The platform provides APIs and developer tools for building customer engagement solutions and serves organizations across multiple industries.

The organization and its infrastructure are intentionally not disclosed in this article.

What is the Wayback Machine?

The Wayback Machine is an internet archive that periodically crawls and stores snapshots of publicly accessible websites, allowing users to view how pages appeared in the past.

However, when sensitive files, URLs, or endpoints are publicly accessible during the crawling process, those resources may also be archived.

This can unintentionally preserve sensitive information long after it has been removed from the live application.

What Was Discovered

During security testing of api.telecompany.com, historical URLs associated with the domain were analyzed through the Wayback Machine.

The review uncovered a large number of audio-recording URLs. Further examination showed that the recordings could be accessed without authentication and contained conversations between businesses and their customers, including personal and confidential information.

Almost 9,000 recording links were identified and collected into a JSON file for validation and documentation.

The Vulnerability

The vulnerability involved unauthenticated access to audio recordings.

The identified recording URLs could be accessed directly without authentication, allowing the recordings to be downloaded and played.

This resulted in unauthorized access to sensitive recordings containing information belonging to businesses and their customers.

Discovery

The issue was identified during security testing of the affected platform and analysis of historical URLs available through the Wayback Machine.

Historical URLs associated with audio recordings were discovered during the review. Further examination revealed that a large number of these recordings remained accessible without authentication.

The recordings contained conversations between businesses and their customers, including personal and confidential information.

Almost 9,000 recording links were identified and collected into a JSON file for validation and documentation.

Impact

The vulnerability resulted in unauthorized access to audio recordings and the sensitive information contained within those conversations.

An unauthenticated party could access, download, and listen to the recordings. The exposed information could include:

  • Personal information belonging to customers.
  • Confidential business information.
  • Personal information shared during customer conversations.
  • Confidential information exchanged between businesses and their customers.

The exposure was also significant in scale, with almost 9,000 recording links identified during the assessment.

The combination of unauthenticated access and the volume of exposed recordings created a substantial risk of unauthorized disclosure of customer and business information.

Proof of Concept

Supporting proof-of-concept files were included to document the identified exposure.

The files included:

  • proof of Concept.mkv
  • api.telecompany.com-waybackurls.json

The JSON file contained the identified audio-recording URLs, while the video demonstrated the ability to access the recordings without authentication.

Reported Attack Flow

The attack flow can be summarized as follows:

Testing api.telecompany.com
        ↓
Wayback Machine
        ↓
Discovery of Audio Recording Links
        ↓
Almost 9,000 Recording Links Identified
        ↓
No Authentication Required
        ↓
Download and Listen to Recordings
        ↓
Potential Exposure of Personal and
Confidential Information

The identified recording URLs could be accessed directly without authentication, allowing the recordings to be downloaded and played.

Why This Matters

Access control is especially important when applications handle sensitive resources such as customer communications and recorded conversations.

In this case, the exposed resources consisted of audio recordings containing conversations between businesses and their customers. These conversations could contain personal, confidential, and business-sensitive information.

Because the recordings were accessible without authentication, an unauthorized party could potentially obtain information belonging to both businesses and their customers.

The case also highlights the importance of securing historical URLs and archived resources, as previously exposed content may remain accessible even after changes are made to the live application.

Severity

The vulnerability was assigned a P1 priority due to the combination of unauthorized access, the sensitive nature of the exposed recordings, and the scale of the exposure.

Almost 9,000 recording links were identified, significantly increasing the potential impact of the access-control weakness.

Key Takeaway

This case demonstrates the potential impact of Broken Access Control when sensitive resources are accessible without authentication.

Almost 9,000 audio-recording links were identified, and the recordings could be accessed, downloaded, and played without authentication.

The recordings contained conversations between businesses and their customers, creating a potential exposure of personal and confidential information.

The key takeaway is that sensitive resources must be protected by appropriate authentication and authorization controls—not only in the live application, but also across historical URLs, archived content, and other publicly accessible resources.

Source

This article is based on the vulnerability finding “Broken Access Control Leads to Huge Data Breach”, submitted on 21 April 2018 and assigned P1 priority.

Disclosure Note: The affected organization’s name, original domain, tenant information, infrastructure details, and other identifying information have been intentionally removed or anonymized. This article focuses on the security implications of the vulnerability without disclosing information that could identify the organization.