Company That Tracks Location of Cars Left Data Open to the World
25.9.2017 securityweek  Cyber
A misconfigured Amazon Web Services (AWS) S3 bucket containing more than half a million records pertaining to an auto tracking company was left publicly accessible, thus leaking the data stored in it, Kromtech security researchers warn.

The repository appears to be connected to the vehicle recovery device and monitoring company SVR Tracking, where “SVR” stands for “stolen vehicle records.” In addition to exposing information on the tracking device, including details about where on the car the unit is hidden, the bucket included data on the company’s customers and re-seller network.

When accessing the AWS bucket, the security researchers discovered that a backup folder called “accounts” contained a total of 540,642 records with logins and passwords, emails, VIN (vehicle identification number), IMEI numbers of the GPS devices on the device, plate numbers, and other data.

SVR Tracking promises live, real-time tracking, and stop verification, features that supposedly allow owners to determine the potential locations for their vehicles. Through the application dashboard, users can access real-time graphs and detailed data on vehicle activity.

This is possible because the car’s movements are monitored continuously, with location history saved for the past 120 days. Not only can users see everywhere the car has been for said period, they can also pinpoint on the map all the places the driver has visited, along with the top five stop locations. A recovery mode can pinpoint every 2 minutes.

Anyone with the necessary credentials at hand can access the application dashboard from any Internet connected device, including desktops, laptops, mobile phones, or tablets, the security researchers warn. Located by satellite, the tracking device sends information using the GPRS Data Network.

“In the age where crime and technology go hand in hand, imagine the potential danger if cyber criminals could find out where a car is by logging in with the credentials that were publicly available online and steal that car?” Bob Diachenko, Kromtech's Chief Communication Officer, points out.

Kromtech said that it has contacted SVR Tracking to report their findings, but has not received a reply. However, the auto tracking company secured the repository shortly after receiving the report, Diachenko says.