Story image

Engineer says Emirates is virtually handing customer data to hackers

09 Mar 18

A data security engineer has come out with the claim that Emirates is virtually handing customers’ sensitive information to hackers and marketers.

Konark Modi says he was booking tickets for his family on the Emirates website when he noticed a few things. Namely, that there were around 300 data points related to his booking and that the information was being shared with “approximately 14 different third-party trackers like Crazy egg, Boxever, Coremetrics, Google, and Facebook among others.”

While this kind of behavior on its own isn’t unusual, the URL included in Modi’s email used the HTTP protocol, which is notoriously insecure compared to HTTPS and can effectively make webpages that are supposed to be private easily accessible to hackers and other adversaries.

Anyone with access to these link can not only read but also edit the user and booking information. That includes stealing your identification details like email address, phone number and passport information, and changing or cancelling the flight.

Following the allegations from Modi, web security company High-Tech Bridge decided to check out the Emirates website with its free SSL/TSL Security Test. The results found that the majority of Emirates.com subdomains (including reservations) have very weak encryption or for some none at all.

“Similar allegations can unfortunately be imputed to the majority of airlines companies. Per se, data sharing with third parties can be perfectly legitimate, lawful and ethical. However, in this case we are likely dealing with some privacy weaknesses when the data is shared without the explicit consent of users with an opaque circle of [authorised] third-parties,” says High-Tech Bridge CEO and founder Ilia Kolochenko.

“Many large companies, and even financial institutions, have similar problems: data sharing with partners may be crucial both for business and customers, however maintaining a comprehensive and up-to-date list of data exchange, transfer, storage and processing is time consuming.”

Kolochenko says because of this, many third parties have excessive access to personal data or store it longer than what is required. In worse cases, unauthorised third parties will obtain the data by accident or negligence.

“Sending sensitive information over unencrypted HTTP protocol is, however, at least negligent and can put customers at risk. Interception of the HTTP data usually requires additional conditions, such as attacker’s access to the wireless networks of a victim, and thus are much less critical than, for example, SQL injection vulnerabilities,” says Kolochenko.

“Nonetheless, these risks are material: some cybercrime gangs compromise and backdoor public wi-fi routers to intercept plaintext passwords and other sensitive data, and can steal it, while sitting in another continent altogether.”

In a blog post Modi had similar sentiments.

“Even if the user somehow manages to opt-out of all the trackers using the methods listed and not listed, Emirates will still leak the Booking Reference and Last Name which is enough to access all other sensitive information because the implementation of these third-party services on Emirates.com is flawed,” says Modi.

“Emirates needs to understand that once the information has been shared with third-parties, there is very little they can do to control how it is being used or might be used in the future, as they have themselves mentioned in their privacy policy.”

Modi says that despite there being no evidence that any of this data has been abused, the leaks are unacceptable. He shared his findings with the airline in October 2017, both through a Twitter DM conversation with the company’s social media team, and through an email to the app’s product manager, but was met, he says, “with a deafening silence.”

Since the story gained in popularity Emirates released a public statement that denied Modi’s claims and labelled them as ‘inaccurate’, but with all the evidence it seems that this claim might in fact be ‘accurate’.

“Speaking about insecure or weak HTTPS encryption on Emirates subdomains, I can say that a very similar, or even worse, picture could occur like this for many large organisation including even cybersecurity companies,” says Kolochenko.

“Businesses still believe that HTTPS hardening is applicable only to their www website and forget about all other services. This is a long-standing problem of incomplete inventory of digital assets.”

A10 aims to secure Kubernetes container environments
The solution aims to provide teams deploying microservices applications with an automated way to integrate enterprise-grade security with comprehensive application visibility and analytics.
DigiCert conquers Google's distrust of Symantec certs
“This could have been an extremely disruptive event to online commerce," comments DigiCert CEO John Merrill. 
One Identity a Visionary in Magic Quad for PAM
One Identity was recognised in the Gartner Magic Quadrant for Privileged Access Management for completeness of vision and ability to execute.
Gartner names newcomer Exabeam a leader in SIEM
The vendor landscape for SIEM is evolving, with recent entrants bringing technologies optimised for analytics use cases.
52mil users affected by Google+’s second data breach
Google+ APIs will be shut down within the next 90 days, and the consumer platform will be disabled in April 2019 instead of August 2019 as originally planned.
Symantec releases neural network-integrated USB scanning station
Symantec Industrial Control System Protection Neural helps defend against USB-borne cyber attacks on operational technology.
Ramping up security with next-gen firewalls
The classic firewall lacked the ability to distinguish between different kinds of web traffic.
Gartner names LogRhythm leader in SIEM solutions
Security teams increasingly need end-to-end SIEM solutions with native options for host- and network-level monitoring.