ClearviewAI Misconfiguration

Summary

Clearview AI makes a facial recognition tool that searches publicly available photos for matches. This tool has been used for investigative purposes by law enforcement agencies and other parties. Clearview AI's source code repository, though password protected, was misconfigured to allow an arbitrary user to register an account. This allowed an external researcher to gain access to a private code repository that contained Clearview AI production credentials, keys to cloud storage buckets containing 70K video samples, and copies of its applications and Slack tokens. With access to training data, a bad actor has the ability to cause an arbitrary misclassification in the deployed model. These kinds of attacks illustrate that any attempt to secure ML system should be on top of "traditional" good cybersecurity hygiene such as locking down the system with least privileges, multi-factor authentication and monitoring and auditing. Target: Clearview AI facial recognition tool Actor: Researchers at spiderSilk Procedure: 1. A security researcher gained initial access to Clearview AI's private code repository via a misconfigured server setting that allowed an arbitrary user to register a valid account. 2. The private code repository contained credentials which were used to access AWS S3 cloud storage buckets, leading to the discovery of assets for the facial recognition tool, including: - Released desktop and mobile applications - Pre-release applications featuring new capabilities - Slack access tokens - Raw videos and other data 3. Adversaries could have downloaded training data and gleaned details about software, models, and capabilities from the source code and decompiled application binaries. 4. As a result, future application releases could have been compromised, causing degraded or malicious facial recognition capabilities.

Deployers

• Clearview AI facial recognition tool

Tags

• MITRE ATLAS
• AML.CS0006