Nigerian Airline Arik Air May Have Leaked Customer Data
An exposed Amazon S3 bucket was reportedly the source of leaked customer data belonging to carrier Arik Air.
According to research published by Justin Paine, Head of Trust & Safety at Cloudflare, the security expert’s regular scanning for open and vulnerable Amazon S3 buckets resulted in the discovery of one containing a large number of CSV files.
As in the recent cases of Alteryx, GoDaddy, and Pocket iNet, leaky buckets are not uncommon, and a simple misconfiguration error in such systems can result in the public exposure of caches of valuable, sensitive data online.
This is reportedly the case with Arik Air, which Paine says either leaked their own data, or the vulnerable bucket was the fault of one of the carrier’s payment processors.
Based in Lagos, Arik Air describes itself as “West-Africa’s leading airline offering domestic, regional and international flights.”
The leaky bucket was discovered on September 6. In total, the researcher found 994 CSV files, some of which contained “in excess of 80,000+ rows of data while other files contain 46,000+ rows of data, and in some cases, files only contain 3 rows of data,” according to the researcher.
See also: Emotet malware gang is mass-harvesting millions of emails in mysterious campaign
After a thorough review, it was found that some of the data points leaked included customer names, email addresses, IPs registered at the time of purchases, and the hashes of credit cards used.
In addition, the researcher says data was stored in the bucket which “appears to be last four digits of the credit card used” and what may be “the first six digits of the credit card used.”
Dates of sale, payment values, types of currency used, device fingerprints — which may relate to the use of mobile devices or desktop systems — and in some cases, the departing and arriving airports all appear to be in the data dump.
TechRepublic: Cybersecurity no. 1 challenge for CXOs, but only 39% have a defense strategy
A point of note is the inclusion of business names related to purchases made to Arik Air.
“It’s not entirely clear who the owner of this data is as Arik Air didn’t reply with any further clarification or details,” the researcher says. “That being said, it certainly seems likely to be a bucket controlled by Arik Air, or one of their immediate partners/processors. The fact that all of these purchases have an “acctparentbusinessname” value leads me to believe this could be a payment processor specific to businesses and/or travel agents.”
It appears that the data spans between 2017-12-31 and 2018-03-16, which is roughly three and a half months’ worth of information.
CNET: MacBook Air 2018 adds Touch ID and gets a new security chip
The researcher attempted to contact the airline, meeting with failure over social media, LinkedIn, and email. After multiple attempts, Paine eventually received a reply over Facebook, in which Arik Air’s security team said they would review the report.
It was over a month after the initial disclosure before the bucket was secured, on October 10. It is not known if any data was fraudulently accessed before the problem was resolved.
Update 11.01 GMT: An Arik Air spokesperson told ZDNet:
“Our attention has been drawn to a reported exposure/vulnerability of customer data on Amazon S3 bucket. We can confirm that we do not use Amazon S3 for our hosting services.
Our online platforms are up and running and not under attack. Arik Air takes IT security and protection of customer data seriously.
We are reviewing all our systems including interface[s] with third-party processors to eliminate vulnerabilities.We would like to assure our customers of the safety of our online sales platforms.”
Previous and related coverage
READ MORE HERE
