Story image

Engineer says Emirates is virtually handing customer data to hackers

09 Mar 2018

A data security engineer has come out with the claim that Emirates is virtually handing customers’ sensitive information to hackers and marketers.

Konark Modi says he was booking tickets for his family on the Emirates website when he noticed a few things. Namely, that there were around 300 data points related to his booking and that the information was being shared with “approximately 14 different third-party trackers like Crazy egg, Boxever, Coremetrics, Google, and Facebook among others.”

While this kind of behavior on its own isn’t unusual, the URL included in Modi’s email used the HTTP protocol, which is notoriously insecure compared to HTTPS and can effectively make webpages that are supposed to be private easily accessible to hackers and other adversaries.

Anyone with access to these link can not only read but also edit the user and booking information. That includes stealing your identification details like email address, phone number and passport information, and changing or cancelling the flight.

Following the allegations from Modi, web security company High-Tech Bridge decided to check out the Emirates website with its free SSL/TSL Security Test. The results found that the majority of Emirates.com subdomains (including reservations) have very weak encryption or for some none at all.

“Similar allegations can unfortunately be imputed to the majority of airlines companies. Per se, data sharing with third parties can be perfectly legitimate, lawful and ethical. However, in this case we are likely dealing with some privacy weaknesses when the data is shared without the explicit consent of users with an opaque circle of [authorised] third-parties,” says High-Tech Bridge CEO and founder Ilia Kolochenko.

“Many large companies, and even financial institutions, have similar problems: data sharing with partners may be crucial both for business and customers, however maintaining a comprehensive and up-to-date list of data exchange, transfer, storage and processing is time consuming.”

Kolochenko says because of this, many third parties have excessive access to personal data or store it longer than what is required. In worse cases, unauthorised third parties will obtain the data by accident or negligence.

“Sending sensitive information over unencrypted HTTP protocol is, however, at least negligent and can put customers at risk. Interception of the HTTP data usually requires additional conditions, such as attacker’s access to the wireless networks of a victim, and thus are much less critical than, for example, SQL injection vulnerabilities,” says Kolochenko.

“Nonetheless, these risks are material: some cybercrime gangs compromise and backdoor public wi-fi routers to intercept plaintext passwords and other sensitive data, and can steal it, while sitting in another continent altogether.”

In a blog post Modi had similar sentiments.

“Even if the user somehow manages to opt-out of all the trackers using the methods listed and not listed, Emirates will still leak the Booking Reference and Last Name which is enough to access all other sensitive information because the implementation of these third-party services on Emirates.com is flawed,” says Modi.

“Emirates needs to understand that once the information has been shared with third-parties, there is very little they can do to control how it is being used or might be used in the future, as they have themselves mentioned in their privacy policy.”

Modi says that despite there being no evidence that any of this data has been abused, the leaks are unacceptable. He shared his findings with the airline in October 2017, both through a Twitter DM conversation with the company’s social media team, and through an email to the app’s product manager, but was met, he says, “with a deafening silence.”

Since the story gained in popularity Emirates released a public statement that denied Modi’s claims and labelled them as ‘inaccurate’, but with all the evidence it seems that this claim might in fact be ‘accurate’.

“Speaking about insecure or weak HTTPS encryption on Emirates subdomains, I can say that a very similar, or even worse, picture could occur like this for many large organisation including even cybersecurity companies,” says Kolochenko.

“Businesses still believe that HTTPS hardening is applicable only to their www website and forget about all other services. This is a long-standing problem of incomplete inventory of digital assets.”

Salesforce continues to stumble after critical outage
“To all of our Salesforce customers, please be aware that we are experiencing a major issue with our service and apologise for the impact it is having on you."
D-Link hooks up with Alexa and Assistant with new smart camera
The new camera is designed for outdoor use within a wireless smart home network.
Slack users urged to update to prevent security vulnerability
Businesses that use popular messaging platform Slack are being urged to update their Slack for Windows to version 3.4.0 immediately.
Secureworks Magic Quadrant Leader for Security Services
This is the 11th time Secureworks has been positioned as a Leader in the Gartner Magic Quadrant for Managed Security Services, Worldwide.
Google puts Huawei on the Android naughty list
Google has apparently suspended Huawei’s licence to use the full Android platform, according to media reports.
Using data science to improve threat prevention
With a large amount of good quality data and strong algorithms, companies can develop highly effective protective measures.
General staff don’t get tech jargon - expert says time to ditch it
There's a serious gap between IT pros and general staff, and this expert says it's on the people in IT to bridge it.
ZombieLoad: Another batch of flaws affect Intel chips
“This flaw can be weaponised in highly targeted attacks that would normally require system-wide privileges or a complete subversion of the operating system."