Canadian e-learning site OneClass left subscriber database open

While security researchers say Toronto-based e-learning website called OneClass failed to properly hold database of customer information Yes, the privacy of thousands of students may be in danger. 

In research shared with our Team,  vpnMentor - a site that evaluates virtual private networks and regularly searches the Internet for poorly-secure databases - says that in the past month it had collected 1 million pieces of data. 

Along with Amazon launched the S3A 27GB Elitix search database. On the server. To the forest class. Some data was masked, but other information did not include full names, email addresses, phone numbers, schools and universities, enrollment details, and OneClass account details. 

The OneClass website states, "OneClass properly implements the physical, technical and administrative measures necessary to protect personal data at the level of sensitivity." 

It also states that "We store your personal data under the highest data security standards on Amazon servers located in the United States." On May 25 of the discovery, OneClass immediately secured the S3 bucket, the researchers say. 

However, the company stated that the exposed database was a test server, and that its data had no connection to actual individuals. vpnMentor researchers disputed that, they used publicly available information to verify a small sample of records in the database. 

"Taking data from multiple records to PII (Personally Identifiable Information), we looked at the social profiles of lecturers and other users on various platforms that matched the records in OneClass's database." 

Become a "gold mine" for phishing and fraud, researchers warn. IT World Canada has tried to reach OneClass Management for comment. 

On Tuesday evening the publication sent an email to an address on the company's "Contact" page. However, this product is being sent for support. 

On Wednesday, IT World Canada emailed the OneClass Venture Capital firm and asked to invest in the company and send our message to OneClass Management. As of Thursday press time, we had no response. 

Launched in 2010, OneClass includes free and paid payments of up to 1.5 million notes, study guides and video tutorials from student contributors at hundreds of institutions, including six countries in Canada and the US, to help students get better grades. An annual account costs $ 119.76. 

There are also monthly and quarterly options. Oneclass also pays students to become elite note takers. 

Users can ask a tutor questions on an annual or monthly plan. Students who share lecture notes earn points that can be redeemed with gift cards from Domino's Pizza, Chipotle, Sepora, Walmart, PayPal, iTunes, Target and Amazon. 

vpnMentor researchers have been searching the Internet for some time to expose organizations for not securing databases. Exactly a year ago, it found an unsecured database on the Internet with personal and credit card information from thousands of Freedom Mobile customers. 

The carrier, a carrier owned by Shaw Communications of Calgary, managed an incorrect server, managed by the company, called Aptium that was hired to streamline Freedom Mobile's retail customer support processes. 

VpnMentor's research team says it discovered breech in OneClass's database, specifically a large web mapping project using port scanning to examine IP blocks and test various systems for vulnerabilities or vulnerabilities. 

Part of. is as. In this case, researchers were able to manipulate criteria search by URL to access the OneClass Elasticsearch database from any index at any time and to uncover the schema.