{"id":329492,"date":"2021-08-23T19:00:21","date_gmt":"2021-08-23T16:00:21","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/38-million-users-data-exposed-by-microsoft-power-apps\/"},"modified":"2021-08-23T19:00:21","modified_gmt":"2021-08-23T16:00:21","slug":"38-million-users-data-exposed-by-microsoft-power-apps","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/38-million-users-data-exposed-by-microsoft-power-apps\/","title":{"rendered":"#38 Million Users\u2019 Data Exposed by Microsoft Power Apps"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6aeeb7be79d27\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6aeeb7be79d27\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/38-million-users-data-exposed-by-microsoft-power-apps\/#What_Happened_With_Microsoft_Power_Apps\" >What Happened With Microsoft Power Apps?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/38-million-users-data-exposed-by-microsoft-power-apps\/#Is_There_a_Fix\" >Is There a Fix?<\/a><\/li><\/ul><\/nav><\/div>\n<p><strong>&#8220;#38 Million Users\u2019 Data Exposed by Microsoft Power <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">App<\/a>s&#8221;<\/strong><\/p>\n<div>\n<figure style=\"width: 1200px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"type:primaryImage size-full wp-image-750413\" srcset=\"https:\/\/www.howtogeek.com\/wp-content\/uploads\/2021\/08\/microsoft-logo-campus.jpg?width=398&amp;trim=1,1&amp;bg-color=000&amp;pad=1,1 400w, https:\/\/www.howtogeek.com\/wp-content\/uploads\/2021\/08\/microsoft-logo-campus.jpg?width=1198&amp;trim=1,1&amp;bg-color=000&amp;pad=1,1 1200w\" sizes=\"auto, 400w, 1200w\" src=\"https:\/\/www.howtogeek.com\/wp-content\/uploads\/2021\/08\/microsoft-logo-campus.jpg?width=1198&amp;trim=1,1&amp;bg-color=000&amp;pad=1,1\" alt=\"Microsoft logo on campus\" width=\"1200\" height=\"675\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><figcaption class=\"wp-caption-text\"><span class=\"type:primaryImage imagecredit\"><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/www.shutterstock.com\/image-photo\/redmond-washington-usa-march-28-2019-1357496909\">VDB Photos\/Shutterstock.com<\/a><\/span><\/figcaption><\/figure>\n<p><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/click.linksynergy.com\/deeplink?id=2QzUaswX1as&amp;mid=24542&amp;u1=htg\/750401&amp;murl=https%3A%2F%2Fpowerapps.microsoft.com%2Fen-us%2F\">Microsoft\u2019s Power Apps<\/a> portal service is designed to make the development of web or mobile apps easier. Unfortunately, due to an issue with the default security setting, 38 million users\u2019 data was publicly available when it shouldn\u2019t have been.<\/p>\n<h2 role=\"heading\" aria-level=\"2\"><span class=\"ez-toc-section\" id=\"What_Happened_With_Microsoft_Power_Apps\"><\/span>What Happened With Microsoft Power Apps?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Essentially,\u00a0the Microsoft Power Apps platform defaulted to making data publicly accessible instead of keeping the data private by default, as discovered by <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/www.upguard.com\/breaches\/power-apps\">Upguard<\/a> and reported by <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/www.wired.com\/story\/microsoft-power-apps-data-exposed\/\">Wired<\/a>. Unfortunately, this meant that anyone looking to quickly get a web app up and running with these APIs would need to manually enable security, rather than the other way around.<\/p>\n<p>\u201cThe UpGuard Research team can now disclose multiple data leaks resulting from Microsoft Power Apps portals configured to allow public access \u2013 a new vector of data exposure,\u201d Upguard said in a <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/www.upguard.com\/breaches\/power-apps\">blog post<\/a>.<\/p>\n<p>Microsoft Power Apps are used by a wide range of companies and government bodies. Because it\u2019s quick and easy to get a website or app going, it was used quite frequently for COVID-19 tools such as contact tracing, vaccine sign-up forms, and so on. The platform was also popular for storing\u00a0job application portals and employee databases.<\/p>\n<p>These tools could contain sensitive user data, and a shocking number of them didn\u2019t have the security measures turned on. That means data such as\u00a0phone numbers, home addresses, <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/social-mediaa\/\" data-internallinksmanager029f6b8e52c=\"1\" title=\"Social Media\" target=\"_blank\" rel=\"noopener\">social<\/a> security numbers, and Covid-19 vaccination status were exposed to anyone who happened to be looking for them.<\/p>\n<p>Just a few examples of organizations that this affected are\u00a0American Airlines, Ford,\u00a0 J.B. Hunt, the Maryland Department of Health, the New York City Municipal Transportation Authority, and New York City public schools.<\/p>\n<h2 role=\"heading\" aria-level=\"2\"><span class=\"ez-toc-section\" id=\"Is_There_a_Fix\"><\/span>Is There a Fix?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Fortunately, the situation has already been <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/docs.microsoft.com\/en-us\/powerapps\/maker\/portals\/important-changes-deprecations#table-permission-changes-for-forms-and-lists-on-new-portals\">addressed by Microsoft<\/a>. The company has now made it so the default settings do not allow API data and other information to be publicly available. Instead, developers will need to enable this setting manually, which is probably how it should have been from day one.<\/p>\n<p>There\u2019s always going to be data that developers want public, so they\u2019ll have to go through the extra step of making select data available rather than going through the extra effort to make it hidden. This is definitely a better way to go for people using these web apps, as it lets them rest assured that their private data is kept confidential. However, the damage is done in this case. We\u2019ll need to wait for the fallout to see how bad it is.<\/p>\n<\/div>\n<p><script>\n setTimeout(function(){\n  !function(f,b,e,v,n,t,s)\n  {if(f.fbq)return;n=f.fbq=function(){n.callMethod?\n  n.callMethod.apply(n,arguments):n.queue.push(arguments)};\n  if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';\n  n.queue=[];t=b.createElement(e);t.async=!0;\n  t.src=v;s=b.getElementsByTagName(e)[0];\n  s.parentNode.insertBefore(t,s) } (window, document,'script',\n  'https:\/\/connect.facebook.net\/en_US\/fbevents.js');\n   fbq('init', '335401813750447');\n   fbq('track', 'PageView');\n  },3000);\n<\/script><\/p>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMLG0nwswvr63Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\">For forums sites go to <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/forum.buradabiliyorum.com\/\" target=\"_blank\" rel=\"noopener\">Forum.BuradaBiliyorum.Com<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/en.buradabiliyorum.com\/technology\/\" target=\"_blank\" rel=\"noopener\">Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/www.howtogeek.com\/750401\/38-million-users-data-exposed-by-microsoft-power-apps\/\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;#38 Million Users\u2019 Data Exposed by Microsoft Power Apps&#8221; VDB Photos\/Shutterstock.com Microsoft\u2019s Power Apps portal service is designed to make the development of web or mobile apps easier. Unfortunately, due to an issue with the default security setting, 38 million users\u2019 data was publicly available when it shouldn\u2019t have been. What Happened With Microsoft Power&#8230;<\/p>\n","protected":false},"author":1,"featured_media":329493,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.howtogeek.com\/wp-content\/uploads\/2021\/08\/microsoft-logo-campus.jpg?height=200p&trim=2,2,2,2","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-329492","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/329492","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=329492"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/329492\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/329493"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=329492"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=329492"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=329492"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}