HackDig : Dig high-quality web security articles for hackers

Staples' order tracking system led to exposing customer info

2020-09-16 06:11

The reason for the recent notification from Staples to some of its customers about exposed order details was caused by insufficient protections for retrieving shopper information from current and past orders.

Staples said that they found no evidence of unauthorized purchases on behalf of impacted customers and that they fixed the issue.

Matching order ID and ZIP code

The alert lacks any technical details that would explain the nature of the problem, leading to some speculation that it was prompted by a hacker incident.

This theory was plausible, especially since threat intelligence company Bad Packets revealed that Staples kept several Pulse Secure VPN servers unpatched for CVE-2019-11510 a long time.

source: Bad Packets

BleepingComputer learned that Staples had two endpoints that allowed customers to track their purchases using the order number and the postal code (ZIP) and one of them could reveal info on someone else’s order.

Two factors contributed to this, one being that the order numbers were sequential, so adding or subtracting a number from them would give a valid order ID for a purchase from a different customer.

Another factor was that requesting tracking info of a package did not require a ZIP code, although the field was present.

Starting from a valid order number, a hacker could learn the route of a package (city, state) and, eventually, the delivery address. This significantly reduces the effort of finding out the ZIP code for the final destination.

By combining an order number with the correct delivery ZIP code, a hacker could call another endpoint to get the full order details of a customer.

Exposed data

Letting clients track their purchases using just these two details is common and sufficiently secure, as long as order IDs are not sequential, because the probability to hit a valid combination is very low.

In the case of Staples, a correct pairing exposed the following details:

  • full name
  • credit card’s last four digits and its type
  • phone number
  • full postal address
  • email address
  • history of ordered items
  • other personally identifiable information that could be used to get more data

The same endpoint provided details about current orders, too, which means that someone could cause some trouble by canceling them or initiating a return. With the destination address was exposed, the risk of stealing the goods upon delivery also existed. Furthermore, this information could enable phishing attacks over both email and phone.

From information received by BleepingComputer, not all customers that ordered from Staples recently received the email about their info being exposed.

Staples confirmed to BleepingComputer that the issue no longer exists. We learned that it took the company close to two weeks to solve the problem from the time they were alerted of the risk.

Source: emotsuc-gnisopxe-ot-del-metsys-gnikcart-redro-selpats/ytiruces/swen/moc.retupmocgnipeelb.www

Read:155 | Comments:0 | Tags:Security

“Staples' order tracking system led to exposing customer info”0 Comments

Submit A Comment



Blog :

Verification Code:


Tag Cloud