Turkish Airline Exposes Flight and Crew Info in 6.5TB Leak

A low-charge Turkish airline unintentionally leaked personal details of flight crew alongside supply code and flight data after misconfiguring an AWS bucket, it has emerged.

A investigation workforce from security comparison web-site SafetyDetectives discovered the cloud knowledge retail store still left vast open on February 28. It traced some of the leaked data to Digital Flight Bag (EFB) program made by Pegasus Airways.

EFBs are information and facts management resources intended to enhance the efficiency of airline crew by delivering necessary reference supplies for their flight.

Practically 23 million files had been identified on the bucket, totalling about 6.5TB of leaked knowledge. This integrated about a few million files made up of sensitive flight data these kinds of as: flight charts and revisions insurance policy paperwork details of issues discovered in the course of pre-flight checks and details on crew shifts.

Over 1.6 million documents contained personally identifiable details (PII) on airline crew, including shots and signatures. Source code from Pegasus’s EFB computer software was also observed in the trove, such as plain text passwords and top secret keys.

Apart from the probable privacy implications for crew members, SafetyDetectives speculated that the leak might have supplied destructive actors accessibility to remarkably sensitive data.

“Bad actors could tamper with sensitive flight information and additional-sensitive files employing passwords and secret keys identified on PegasusEFB’s bucket. Even though we can’t be specific that pilots will use the bucket’s documents for approaching flights, altering the contents of data files could possibly block crucial EFB facts from reaching airline personnel and spot passengers and crew members at risk,” it argued.

“With hundreds of thousands of documents made up of new and potentially related flight knowledge, regrettably, an attacker could have various options to trigger hurt if they located PegasusEFB’s bucket.”

Crew customers could also be the subject of coercion by structured criminal offense groups, when the data contained in the details retail outlet could assistance lousy actors detect weaknesses in airport and airline security, the report claimed.

Even so, there is no indication that any malicious actors uncovered the trove prior to the investigation team did. After notifying Pegasus Airlines on March 1, SafetyDetectives famous that the leak was remediated all over a few weeks afterwards.

Some pieces of this write-up are sourced from:
www.infosecurity-journal.com