Clearview AI code repository misconfiguration exposes production credentials and video samples

# Clearview AI code repository misconfiguration exposes production credentials and video samples

https://gcdradar.vercel.app/incidents/clearview-ai-code-repository-misconfiguration-exposes-produc · AIR-2023-0009 · closed 2023-04-14

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation)
- Fix status: No fix needed
- First reported: 2023-03-31 (happened 2020)
- AI role: Attack on AI
- Products: Clearview AI Facial Recognition Tool

## Summary

A misconfigured code repository allowed unauthorized user registration, giving external researchers access to production credentials, cloud storage keys, and video samples. The exposed assets included sensitive data linked to the AI system.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2023-03-31: New York Times Article, "The Secretive Company That Might End Privacy as We Know It" (https://nytimes.com/2020/01/18/technology/clearview-privacy-facial-recognition.html)
- 2023-03-31: Gizmodo Article, "We Found Clearview AI's Shady Face Recognition App" (https://gizmodo.com/we-found-clearview-ais-shady-face-recognition-app-1841961772)
- 2023-03-31: TechCrunch Article, "Security lapse exposed Clearview AI source code" (https://techcrunch.com/2020/04/16/clearview-source-code-lapse)
- 2023-03-31: ClearviewAI Misconfiguration (https://atlas.mitre.org/studies/AML.CS0006)
- 2023-03-31: AVID-2023-V007: Clearview AI makes a facial recognition tool that searches publicly available photos for matches. (https://github.com/avidml/avid-db/blob/main/vulnerabilities/2023/AVID-2023-V007.json)

## Sources

- 2023-03-31 AVID: AVID-2023-V007: Clearview AI makes a facial recognition tool that searches publicly available photos for matches. https://github.com/avidml/avid-db/blob/main/vulnerabilities/2023/AVID-2023-V007.json
- 2023-03-31 MITRE ATLAS: ClearviewAI Misconfiguration https://atlas.mitre.org/studies/AML.CS0006
- 2023-03-31 TechCrunch: TechCrunch Article, "Security lapse exposed Clearview AI source code" https://techcrunch.com/2020/04/16/clearview-source-code-lapse
- 2023-03-31 gizmodo.com: Gizmodo Article, "We Found Clearview AI's Shady Face Recognition App" https://gizmodo.com/we-found-clearview-ais-shady-face-recognition-app-1841961772
- 2023-03-31 The New York Times: New York Times Article, "The Secretive Company That Might End Privacy as We Know It" https://nytimes.com/2020/01/18/technology/clearview-privacy-facial-recognition.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.