Unsecured Microsoft Bing Server Exposed Users’ Search Queries and Location

A back-end server associated with Microsoft Bing exposed
sensitive data of the search engine’s mobile application users,
including search queries, device details, and GPS coordinates,
among others.

The logging database, however, doesn’t include any personal
details such as names or addresses.

The data leak, discovered by Ata Hakcil of WizCase^[1] on September 12, is
a massive 6.5TB cache of log files that was left for anyone to
access without any password, potentially allowing cybercriminals to
leverage the information for carrying out extortion and phishing
scams.

According to WizCase, the Elastic server is believed to have
been password protected until September 10, after which the
authentication seems to have been inadvertently removed.

After the findings were privately disclosed to Microsoft
Security Response Center, the Windows maker addressed the
misconfiguration on September 16.

Misconfigured servers have been a constant source
of data leaks^[2] in recent years,
resulting in exposure of email addresses, passwords, phone numbers,
and private messages.

“Based on the sheer amount of data, it is safe to speculate that
anyone who has made a Bing search with the mobile app while the
server has been exposed is at risk,” said WizCase’s Chase Williams
in a Monday post. “We saw records of people searching from more
than 70 countries.”

Some of the search terms comprised of predators looking for
child porn and the websites they visited following the search as
well as “queries related to guns and interest in shootings, with
search histories that included shopping for guns, and search terms
like ‘kill commies.'”

Aside from device and location details, the data also consisted
of the exact time the search was performed using the mobile app, a
partial list of the URLs the users visited from the search results,
and three unique identifiers, such as ADID (a numeric ID assigned
by Microsoft Advertising to an ad), “deviceID”, and
“devicehash.”

In addition, the server also came under what’s called a “meow
attack^[3]” at least twice,
an automated
cyberattack^[4] that has wiped data
from over 14,000 unsecured database instances since July with no
explanation.

Although the leaky server didn’t reveal names and other personal
information, WizCase cautioned that the data could be exploited for
other nefarious purposes, in addition to exposing users to physical
attacks by letting criminals triangulate their whereabouts.

“Whether it’s searching for adult content, cheating on a
significant other, extreme political views, or hundreds of
embarrassing things people search for on Bing,” the company said.
“Once the hacker has the search query, it could be possible to find
out the person’s identity thanks to all the details available on
the server, making them an easy blackmail target.”