It is not unusual to come across stolen identities on the web and this one is no exception. I came across a post in an underground forum listing a bunch of Emirates Skywards accounts. I picked a random account to verify the claims and the rest is pictured below:

Figure1: Skywards/Emirates account main page

Figure 2: Saved credit card information

Figure 3: Skywards member personal information

After going through the list, I reckon the accounts were compromised as a result of brute force attacks given the relative serial order of the listed accounts, and the inadequate authentication controls available on emirates.com.

Skywards members – update your passwords now!

Update (July 31,8:30 AM +4GMT): Emirates Airlines has acted swiftly to this threat and have added additional security measures on Emirates.com and Skywards.com websites:

Figure 4: Updated Skywards.com login page

Figure 5: Updated Emirates.com login page

A date of birth field is now required for authentication on both Emirates.com and Skywards.com websites. Additionally, client-side validation has been implemented (can’t confirm if this was available earlier though) that checks for valid Skywards membership number format.

A job well done – just what you would expect from a world-class airline!

View Tahir's Profile      Subscribe via RSS