Thailand’s largest cell structure AIS has drawn a database offline that was spilling billions of real-time internet records on millions of Thai internet users.
Security researcher Justin Paine said in a blog post that he found the database, containing DNS queries and Netflow data, on the internet without a password. With access to this database, Paine said that anyone could” promptly paint a picture” about what an internet user( or their household) does in real-time.
Paine notified AIS to the open database on May 13. But after not sounding back for a few weeks, Paine reported the evident security fault to Thailand’s national computer emergency response unit, known as ThaiCERT, which contacted AIS about the open database.
The database was inaccessible a short time later.
It’s not known who owns the database. Paine told TechCrunch that the various kinds of records found in the database can only come from someone who’s able to monitor internet traffic as it springs across the network. But there is no easy lane distinguished from if the database belongs to the internet provider — or one of its subsidiaries — or a large enterprise customer on AIS’ system. AIS spokespeople did not respond to our emails requesting comment.
DNS inquiries are a regular side-effect of using the internet. Each time you inspected an internet site, the browser proselytizes a web address into an IP address, which tells the browser where the web page lives on the internet. Although DNS inquiries don’t carry private sends, emails, or sensitive data like passwords, they can identify which websites you access and which apps you use.
But that could be a major problem for high-risk individuals, like writers and partisans, whose internet records could be used to identify their sources.
Thailand’s internet surveillance regulations grant sovereignties broom access to internet user data. Thailand also has some of the strictest censorship principles in Asia, forbidding any kind of criticism against the Thai royal family, national certificate, and certain political issues. In 2017, the Thai military junta, which took power in a 2015 takeover, narrowly backed down from boycotting Facebook across the country after the social network giant refused to censor certain users’ posts.
DNS inquiry data can also be used to gain insights into a person’s internet activity.
Using the data, Paine showed how anyone with access to the database could learn a number of things from a single internet-connected house, such as the kind of inventions they owned, which antivirus they operated, and which browsers they used, and which social media apps and websites they frequented. In households or positions, numerous beings share one internet connection, offsetting it far more difficult to trace internet activity back to a particular person.
Advertisers too find DNS data valuable for suffice targeted ads.
Since a 2017 law admitted U.S. internet providers to sell internet records — like DNS inquiries and browsing histories — of their consumers, browser makes have pushed back by rolling out privacy-enhancing technologies that make it harder for internet and system providers to snoop.
One these new technologies, DNS over HTTPS — or DoH — encrypts DNS entreaties, constituting it far more difficult for internet or system providers to know which websites a customer is call or which apps they use.
Read more: feedproxy.google.com