Story image

Engineer says Emirates is virtually handing customer data to hackers

09 Mar 2018

A data security engineer has come out with the claim that Emirates is virtually handing customers’ sensitive information to hackers and marketers.

Konark Modi says he was booking tickets for his family on the Emirates website when he noticed a few things. Namely, that there were around 300 data points related to his booking and that the information was being shared with “approximately 14 different third-party trackers like Crazy egg, Boxever, Coremetrics, Google, and Facebook among others.”

While this kind of behavior on its own isn’t unusual, the URL included in Modi’s email used the HTTP protocol, which is notoriously insecure compared to HTTPS and can effectively make webpages that are supposed to be private easily accessible to hackers and other adversaries.

Anyone with access to these link can not only read but also edit the user and booking information. That includes stealing your identification details like email address, phone number and passport information, and changing or cancelling the flight.

Following the allegations from Modi, web security company High-Tech Bridge decided to check out the Emirates website with its free SSL/TSL Security Test. The results found that the majority of Emirates.com subdomains (including reservations) have very weak encryption or for some none at all.

“Similar allegations can unfortunately be imputed to the majority of airlines companies. Per se, data sharing with third parties can be perfectly legitimate, lawful and ethical. However, in this case we are likely dealing with some privacy weaknesses when the data is shared without the explicit consent of users with an opaque circle of [authorised] third-parties,” says High-Tech Bridge CEO and founder Ilia Kolochenko.

“Many large companies, and even financial institutions, have similar problems: data sharing with partners may be crucial both for business and customers, however maintaining a comprehensive and up-to-date list of data exchange, transfer, storage and processing is time consuming.”

Kolochenko says because of this, many third parties have excessive access to personal data or store it longer than what is required. In worse cases, unauthorised third parties will obtain the data by accident or negligence.

“Sending sensitive information over unencrypted HTTP protocol is, however, at least negligent and can put customers at risk. Interception of the HTTP data usually requires additional conditions, such as attacker’s access to the wireless networks of a victim, and thus are much less critical than, for example, SQL injection vulnerabilities,” says Kolochenko.

“Nonetheless, these risks are material: some cybercrime gangs compromise and backdoor public wi-fi routers to intercept plaintext passwords and other sensitive data, and can steal it, while sitting in another continent altogether.”

In a blog post Modi had similar sentiments.

“Even if the user somehow manages to opt-out of all the trackers using the methods listed and not listed, Emirates will still leak the Booking Reference and Last Name which is enough to access all other sensitive information because the implementation of these third-party services on Emirates.com is flawed,” says Modi.

“Emirates needs to understand that once the information has been shared with third-parties, there is very little they can do to control how it is being used or might be used in the future, as they have themselves mentioned in their privacy policy.”

Modi says that despite there being no evidence that any of this data has been abused, the leaks are unacceptable. He shared his findings with the airline in October 2017, both through a Twitter DM conversation with the company’s social media team, and through an email to the app’s product manager, but was met, he says, “with a deafening silence.”

Since the story gained in popularity Emirates released a public statement that denied Modi’s claims and labelled them as ‘inaccurate’, but with all the evidence it seems that this claim might in fact be ‘accurate’.

“Speaking about insecure or weak HTTPS encryption on Emirates subdomains, I can say that a very similar, or even worse, picture could occur like this for many large organisation including even cybersecurity companies,” says Kolochenko.

“Businesses still believe that HTTPS hardening is applicable only to their www website and forget about all other services. This is a long-standing problem of incomplete inventory of digital assets.”

Enterprise cloud deployments being exploited by cybercriminals
A new report has revealed a concerning number of enterprises still believe security is the responsibility of the cloud service provider.
Ping Identity Platform updated with new CX and IT automation
The new versions improve the user and administrative experience, while also aiming to meet enterprise needs to operate quickly and purposefully.
Venafi and nCipher Security partner on machine identity protection
Cryptographic keys serve as machine identities and are the foundation of enterprise information technology systems.
Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.
How blockchain could help stop video piracy in its tracks
An Australian video tech firm has successfully tested a blockchain trial that could end up being a welcome relief for video creators and the fight against video piracy.
IBM X-Force Red & Qualys introduce automated patching
IBM X-Force Red and Qualys are declaring a war on unpatched systems, and they believe automation is the answer.
Micro Focus acquires Interset to improve predictive analytics
Interset utilises user and entity behavioural analytics (UEBA) and machine learning to give security professionals what they need to execute threat detection analysis.