Bing User Data Exposed – Includes Location, Search Terms, Sites Visited
upstart writes in with an IRC submission for nutherguy:
Bing user data exposed - includes location, search terms, sites visited
A team of security researchers has found Bing user data exposed on a server owned by Microsoft. The data comes from both iOS and Android versions of the Bing app. The data exposed includes unique user IDs, search queries, location, and even webpages visited as a result of searches[.]
Security site WizCase made the discovery. It says the database was originally password-protected, but was left unprotected between September 10 and September 16.
From WizCase:
[...] Hakcil and his team discovered a 6.5TB server and saw it was growing by as much as 200GB per day. Based on the sheer amount of data, it is safe to speculate that anyone who has made a Bing search with the mobile app while the server has been exposed is at risk. We saw records of people searching from more than 70 countries.
[...] After Hakcil confirmed the database belonged to the Bing app, the team alerted Microsoft on September 13th. They quickly responded to our message. We then reported the data leak to the MSRC - Microsoft Security Response Center and they secured it a few days later, on September 16th.
From what we saw, between September 10th - 12th, the server was targeted by a Meow attack[0] that deleted nearly the entire database. When we discovered the server on the 12th, 100 million records had been collected since the attack. There was a second Meow attack on the server on September 14.
The new cyber attack appears to be a bot that seeks and destroys unsecured databases that run the Elasticsearch, Redis or MongoDB software. The name comes from it overwriting the word "meow" repeatedly in each database index that it finds. The bot overwrites all of the data, effectively destroying the contents of the database.
Read more of this story at SoylentNews.