Engineer says Emirates is virtually handing customer data to hackers

A data security engineer has come out with the claim that Emirates is virtually handing customers' sensitive information to hackers and marketers.

Konark Modi says he was booking tickets for his family on the Emirates website when he noticed a few things. Namely, that there were around 300 data points related to his booking and that the information was being shared with "approximately 14 different third-party trackers like Crazy egg, Boxever, Coremetrics, Google, and Facebook among others.

While this kind of behavior on its own isn't unusual, the URL included in Modi's email used the HTTP protocol, which is notoriously insecure compared to HTTPS and can effectively make webpages that are supposed to be private easily accessible to hackers and other adversaries.

Anyone with access to these link can not only read but also edit the user and booking information. That includes stealing your identification details like email address, phone number and passport information, and changing or cancelling the flight.

Following the allegations from Modi, web security company High-Tech Bridge decided to check out the Emirates website with its free SSL/TSL Security Test. The results found that the majority of Emirates.com subdomains (including reservations) have very weak encryption or for some none at all.

"Similar allegations can unfortunately be imputed to the majority of airlines companies. Per se, data sharing with third parties can be perfectly legitimate, lawful and ethical. However, in this case we are likely dealing with some privacy weaknesses when the data is shared without the explicit consent of users with an opaque circle of [authorised] third-parties," says High-Tech Bridge CEO and founder Ilia Kolochenko.

"Many large companies, and even financial institutions, have similar problems: data sharing with partners may be crucial both for business and customers, however maintaining a comprehensive and up-to-date list of data exchange, transfer, storage and processing is time consuming.

Kolochenko says because of this, many third parties have excessive access to personal data or store it longer than what is required. In worse cases, unauthorised third parties will obtain the data by accident or negligence.

"Sending sensitive information over unencrypted HTTP protocol is, however, at least negligent and can put customers at risk. Interception of the HTTP data usually requires additional conditions, such as attacker's access to the wireless networks of a victim, and thus are much less critical than, for example, SQL injection vulnerabilities," says Kolochenko.

"Nonetheless, these risks are material: some cybercrime gangs compromise and backdoor public wi-fi routers to intercept plaintext passwords and other sensitive data, and can steal it, while sitting in another continent altogether.

In a blog post Modi had similar sentiments.

"Even if the user somehow manages to opt-out of all the trackers using the methods listed and not listed, Emirates will still leak the Booking Reference and Last Name which is enough to access all other sensitive information because the implementation of these third-party services on Emirates.com is flawed," says Modi.

"Emirates needs to understand that once the information has been shared with third-parties, there is very little they can do to control how it is being used or might be used in the future, as they have themselves mentioned in their privacy policy.

Modi says that despite there being no evidence that any of this data has been abused, the leaks are unacceptable. He shared his findings with the airline in October 2017, both through a Twitter DM conversation with the company's social media team, and through an email to the app's product manager, but was met, he says, "with a deafening silence.

Since the story gained in popularity Emirates released a public statement that denied Modi's claims and labelled them as 'inaccurate', but with all the evidence it seems that this claim might in fact be 'accurate'.

"Speaking about insecure or weak HTTPS encryption on Emirates subdomains, I can say that a very similar, or even worse, picture could occur like this for many large organisation including even cybersecurity companies," says Kolochenko.

"Businesses still believe that HTTPS hardening is applicable only to their www website and forget about all other services. This is a long-standing problem of incomplete inventory of digital assets.