A misconfigured Amazon Web Services (AWS) S3 bucket containing more than half a million records pertaining to an auto tracking company was left publicly accessible, thus leaking the data stored in it, Kromtech security researchers warn.
The repository appears to be connected to the vehicle recovery device and monitoring company SVR Tracking, where “SVR” stands for “stolen vehicle records.” In addition to exposing information on the tracking device, including details about where on the car the unit is hidden, the bucket included data on the company’s customers and re-seller network.
When accessing the AWS bucket, the security researchers discovered that a backup folder called “accounts” contained a total of 540,642 records with logins and passwords, emails, VIN (vehicle identification number), IMEI numbers of the GPS devices on the device, plate numbers, and other data.
SVR Tracking promises live, real-time tracking, and stop verification, features that supposedly allow owners to determine the potential locations for their vehicles. Through the application dashboard, users can access real-time graphs and detailed data on vehicle activity.
This is possible because the car’s movements are monitored continuously, with location history saved for the past 120 days. Not only can users see everywhere the car has been for said period, they can also pinpoint on the map all the places the driver has visited, along with the top five stop locations. A recovery mode can pinpoint every 2 minutes.
Anyone with the necessary credentials at hand can access the application dashboard from any Internet connected device, including desktops, laptops, mobile phones, or tablets, the security researchers warn. Located by satellite, the tracking device sends information using the GPRS Data Network.
“In the age where crime and technology go hand in hand, imagine the potential danger if cyber criminals could find out where a car is by logging in with the credentials that were publicly available online and steal that car?” Bob Diachenko, Kromtech’s Chief Communication Officer, points out.
Kromtech said that it has contacted SVR Tracking to report their findings, but has not received a reply. However, the auto tracking company secured the repository shortly after receiving the report, Diachenko says.
Related: AWS Bucket Leaks Viacom Critical Data
Related: WWE Exposes Details of 3 Million Customers on AWS
More from Ionut Arghire
- Apple Unveils Upcoming Privacy and Security Features
- Dozens of Malicious Extensions Found in Chrome Web Store
- Microsoft Makes SMB Signing Default Requirement in Windows 11 to Boost Security
- Zyxel Urges Customers to Patch Firewalls Against Exploited Vulnerabilities
- Gigabyte Rolls Out BIOS Updates to Remove Backdoor From Motherboards
- Information of 2.5M People Stolen in Ransomware Attack at Massachusetts Health Insurer
- US, South Korea Detail North Korea’s Social Engineering Techniques
- High-Severity Vulnerabilities Patched in Splunk Enterprise
Latest News
- Zoom Expands Privacy Options for European Customers
- Several Major Organizations Confirm Being Impacted by MOVEit Attack
- Apple Unveils Upcoming Privacy and Security Features
- Verizon 2023 DBIR: Human Error Involved in Many Breaches, Ransomware Cost Surges
- Google Patches Third Chrome Zero-Day of 2023
- Dozens of Malicious Extensions Found in Chrome Web Store
- What if the Current AI Hype Is a Dead End?
- Microsoft Makes SMB Signing Default Requirement in Windows 11 to Boost Security
