FlashFeed

Full text

Cybernews found Carla’s exposed AWS bucket with 48,000 PDFs containing customer rental data

Files included names, emails, phone numbers, rental details, and travel patterns useful for phishing

Carla secured the database after disclosure; no evidence of malicious access, but risk remains

Car rental comparison and booking platform Carla kept a database with sensitive customer information unlocked on the open internet, freely available to anyone who knew where to look.

Cybersecurity researchers from Cybernews reported finding an exposed Amazon Web Services (AWS) bucket with approximately 48,000 PDF files. These files, which was later determined belonged to Carla, contained car rental details and drivers’ personal information.

Among other things, these files held vouchers and confirmation numbers, drivers’ names, email addresses, and phone numbers, rent periods, costs, pick-up and drop-off locations, as well as general vehicle information.

Carla reacts

Cybernews says the data could have been used in convincing phishing attacks. Not only would malicious actors get contact information, but they could also deduce individuals’ travel patterns, which could be used to establish trust with the victims - a crucial step in social engineering attacks.

After disclosing the findings with Carla, the company locked the database down. Currently, there is no evidence that it was accessed by malicious actors in the past, but Cybernews says “if our team uncovered it, so too may have threat actors that have automated tools searching specifically for unprotected corporate data.”

The service does not own a feel of its own. Instead, it works like a travel booking site, aggregating offers from hundreds of rental providers and offering users to compare prices and reserve cars online.

Misconfigured databases continue to be one of the key causes of major data spills. Businesses often misunderstand the shared responsibility model of cloud providers, leaving systems with default settings, or setting up weak and easily guessed credentials.

Cybernews recently also reported discovering an exposed ElasticSearch cluster belonging to Nextcloud and containing 367,000 records of employee data, client company data, contracts, and various scripts.