[BreachExchange] Travel Site Exposed 37 Million Records Before Meow Attack

[Destry Winant]

https://www.infosecurity-magazine.com/news/travel-site-exposed-37m-records/

The company behind one of India’s most popular travel booking sites
exposed 43GB of customer and corporate data before it was deleted by
the infamous “Meow” attacker, according to researchers.

A team at SafetyDetectives led by Anurag Sen discovered an
Elasticsearch server without password protection or encryption on
August 10.

It failed to get a response from the company in question,
government-backed travel marketplace RailYatri, but the database was
eventually secured after contact was made with India’s national CERT
(CERT-In).

However, that was too late to save most of the information stored
there: the Meow bot struck on August 12 and apparently deleted all but
1GB of the data.

The trove itself contained an estimated 37 million records linked to
around 700,000 unique users of the popular site, a mobile app version
of which has been downloaded over 10 million times on Google Play.

Exposed in the misconfiguration were users’ full names, age, gender,
physical and email addresses, mobile phone numbers, booking details,
GPS location and names/first and last four digits of payment cards.

“Exposed user information could potentially be used to conduct
identity fraud across different platforms and other sites,” argued
SafetyDetectives.

“Users’ contact details could be harnessed to conduct a wide variety
of scams while personal information from the breach could be used to
encourage click-throughs and malware downloads. Personal information
is also used by hackers to build up rapport and trust, with a view of
carrying out a larger magnitude intrusion in the future.”

The firm also warned that exposed data could have put customers in
physical danger.

“RailYatri’s server recorded and stored users’ location information
when booking their tickets, and also allowed users to track their
journey progress with integrated GPS functionality. This information
could be used by hackers to locate the nearest cell tower to the user,
and potentially, the user’s actual location including current
address,” it explained.

“Regular train users generate clear and distinguishable travel
patterns which malicious actors could use to commit violent crime
directly upon the individual.”

The bot-driven Meow attack campaign has so far destroyed data from
thousands of victims, providing an even greater urgency for IT
managers to ensure any cloud databases are properly configured.