Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Data Breaches

Customer Information of Toyota Insurance Company Exposed Due to Misconfigurations

Exposed credentials for an email address at an Indian Toyota insurance broker led to customer information compromise.

A series of misconfigurations and security vulnerabilities allowed a researcher to access customer information stored in an email account at Toyota Tsusho Insurance Broker India (TTIBI).

The unauthorized access, US-based researcher Eaton Zveare explains, was possible because the TTIBI site had a dedicated Eicher Motors subdomain, with a premium calculator.

TTIBI is an insurance broker under the Toyota Tsusho Insurance Management Corporation in Japan, and appears to have a close partnership with Eicher Motors, an Indian automotive company that makes motorcycles and commercial vehicles.

According to Zveare, he gained access to the [email protected] email address after discovering that the Eicher Android application contained a link to a premium calculator on ttibi.co.in, which exposed a client-side email-sending mechanism in the page source.

The researcher created an API request to check whether authentication was required, and was able to successfully send an email, but also received a server error that included the base64 encoded password for the ‘noreply’ email account.

“The noreply account could be the most important account in an organization because it could potentially have a record of everything they have ever sent to customers. In TTIBI’s case, that is exactly what it is and the amount of information revealed is enormous,” Zveare notes.

Within the email account, the researcher found records of all messages sent to customers, which included customer information, password reset links, one-time passwords (OTPs), and insurance policy documents.

Additionally, access to the email account also provided access to TTIBI’s Microsoft cloud account, including to the corporate directory and to SharePoint and Teams services.

Advertisement. Scroll to continue reading.

The extended level of access, Zveare points out, was the result of five security issues and misconfigurations: the client-side email-sending mechanism, the lack of API authentication, the API response leaking information, the lack of two-factor authentication, and the retention of all emails that were sent and received from the account.

According to Zveare, it took TTIBI two months to take the Eicher subdomain offline and require an authentication mechanism for the exposed API. However, the password for the ‘noreply’ email account was still the same when the researcher verified access on January 17.

Related: Vulnerabilities in Honda eCommerce Platform Exposed Customer, Dealer Data

Related: Vulnerability in Toyota Management Platform Provided Access to Customer Data

Related: Vulnerability Provided Access to Toyota Supplier Management Network

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn about active threats targeting common cloud deployments and what security teams can do to mitigate them.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...

CISO Strategy

Okta is blaming the recent hack of its support system on an employee who logged into a personal Google account on a company-managed laptop.

Data Breaches

A group of hackers has leaked Atlassian employee records and floorplans, information that was obtained from third-party workplace platform Envoy.

Data Breaches

Sony shares information on the impact of two recent unrelated hacker attacks carried out by known ransomware groups. 

Data Breaches

KFC and Taco Bell parent company Yum Brands says personal information was compromised in a January 2023 ransomware attack.

Data Breaches

Delta Dental of California says over 6.9 million individuals were impacted by a data breach caused by the MOVEit hack.