Thailand’s largest cell network AIS has pulled a database offline that was spilling billions of real-time internet records on millions of Thai internet users.
Security researcher Justin Paine said in a blog post that he found the database, containing DNS queries and Netflow data, on the internet without a password. With access to this database, Paine said that anyone could “quickly paint a picture” about what an internet user (or their household) does in real-time.
Paine alerted AIS to the open database on May 13. But after not hearing back for a week, Paine reported the apparent security lapse to Thailand’s national computer emergency response team, known as ThaiCERT, which contacted AIS about the open database.
The database was inaccessible a short time later.
AIS spokesperson Sudaporn Watcharanisakorn confirmed AIS owned the data, and apologized for the security lapse.
“We can confirm that a small amount of non-personal, non-critical information was exposed for a limited period in May during a scheduled test,” said the spokesperson. (TechCrunch reached out several times prior to publication but did not hear back until after we published.)
“All of the data related to Internet usage patterns and did not contain personal information that could be used to identify any customer,” said the spokesperson. “On this occasion we acknowledge that our procedures fell short, for which we sincerely apologise.”
But that isn’t true.
DNS queries are a normal side-effect of using the internet. Every time you visit a website, the browser converts a web address into an IP address, which tells the browser where the web page lives on the internet. Although DNS queries don’t carry private messages, emails, or sensitive data like passwords, they can identify which websites you access and which apps you use.
But that could be a major problem for high-risk individuals, like journalists and activists, whose internet records could be used to identify their sources.
Thailand’s internet surveillance laws grant authorities sweeping access to internet user data. Thailand also has some of the strictest censorship laws in Asia, forbidding any kind of criticism against the Thai royal family, national security, and certain political issues. In 2017, the Thai military junta, which took power in a 2015 coup, narrowly backed down from banning Facebook across the country after the social network giant refused to censor certain users’ posts.