Breach Disclosure: Indian Rail

On January 8 2020, a Medium post made by security company dvuln outlined a disclosure for a data breach that was made to them. The breach involved the app Indian Rail. Indian Rail is a top app on the Apple App Store, and the data breach was due to an exposed Firebase database. The breach contained 2,357,684 rows of emails, usernames and plain-text passwords.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

The main security issue was due to lax access security controls to the Firebase application ran by Indian Rail. Anyone could connect and access the database if they knew the URL, or if they scraped the URL. Luckily, the researcher found the URL and lack of keys or authentication by reverse engineering the application. The other major issue here is that the passwords were stored in clear-text and without cryptographic hashing in place, exposing the passwords for pivoting and credential stuffing by attackers.