Bing Mobile App Database Left Exposed, Over 100 Million Records Possibly Stolen

Tech Security

Security experts say Microsoft's Bing mobile app users on all iOS and iPadOS maybe at risk after terabytes of user information may have been stolen from an open server. The experts with Wizcase, an online security research group, explained that it was a "meow" attack, where hackers scrapped the database with location coordinates and search queries that can be used in blackmail attacks and phishing scams. They said 'it is safe to speculate that anyone who has made a Bing search with the mobile app while the server has been exposed is at risk.' 'We saw records of people searching from more than 70 countries.'

'According to our scanner, the server was password protected until the first week of September. Our team discovered the leak on September 12th, approximately two days after the authentication was removed.'

Wizcase said they alerted Microsoft of the unprotected database on September 13, which then added a password September 16.

Bing is the search engine owned by Microsoft and data related to the mobile app for iOS and Android has been found in an open server. The server had over 6.5TB of data and was growing by 200GB per day upon discovery.

The open server was secured by the Microsoft Security Response Center on September 16.

A Meow attack is an automated attack to an open server which tries to delete a large portion or all of the data in the server. This Meow attack deleted nearly the entire database.

Nearly 100 million records had been collected by bad-actors by the time a second Meow attack hit the server on September 14. Many types of hackers had access to the data while the server was open, so much or all of the data could have been collected.