INSCOM is a joint US army and NSA division that task with conducting intelligence, security and information operations. As like earlier this time also UpGaurd team have found this misconfigured S3 server.
There are three S3 bucket which host small number of files and folders and all files are freely available for download. Among these three server, one was having an Oracle Virtual Application (.ova) file that was an image of a virtual machine running a Linux-based operating system and an attached virtual hard drive.
Unforyunately researcher was not able to boot the OS file, because the OS boot-up process was conditioned to accessing services that were only accessible from the Department of Defense's (DOD) internal network, a classic method of securing sensitive systems.
But somehow they managed to extract some information from its Metadata files which are stored on the virtual hard drive, that are classified as TOP SECRET.
On the same S3 server, researchers also found another folder related to Red Disk, which are a cloud computing platform that was part of the Distributed Common Ground System-Army (DCGS-A), a "battlefield intelligence platform" developed by the DOD.
Red Disk was supposed to aggregate data from the main DCGS-A network, index it, and allow US Army operatives to access and search the data in real-time, based on their access level.
Red Disk was supposed to aggregate data from the main DCGS-A network, index it, and allow US Army operatives to access and search the data in real-time, based on their access level.
UpGuard who have found all the US government information exposed online said this was the treasury type data, that were left freely available for download.