Paul Mutton's personal thoughts and observations on internet security, penetration testing and online threats (and maybe some other stuff)
Wednesday, 22 January 2014
Net Price Direct exposing my personal data
Most web application security testers will agree that after several years of experience you start to develop an incredible "sixth sense" which allows you to estimate how secure (or insecure!) a website is likely to be, merely by looking at the way the site behaves during normal use. I'm talking about entirely passive observation of the way the site reacts, without even looking at any of the raw requests and responses that are sent to and from the application server, let alone attempting to manipulate them.
This sixth sense unavoidably gets tingled outside of the work place. We all buy things on the internet as private consumers, and that is certainly one such place where I've noticed quite a few suspicious things lately. However, nothing has been quite so glaringly obvious as the problem I stumbled upon tonight!
A few weeks ago, I bought some Lego from an Amazon.co.uk marketplace seller called Net Price Direct (a trade name of Hyde's Toys & Gift Ltd). My order arrived promptly and in excellent condition. I was very happy. Coincidentally, I also happened to buy the same item from their eBay store. This also arrived promptly and in good condition.
Tonight, I visited the seller's own website at www.netpricedirect.co.uk, and I was pleasantly surprised to see that the delivery costs were slightly better if you bought directly from them. So I added a few items to my basket and went to the checkout (did I mention I like Lego quite a bit?).
As I had never used the site before - but had made previous purchases via Amazon and eBay - I entered my email address into this part of the login page:
All I submitted was my email address. To my disbelief, I was then taken to the following form, which was automatically populated with the personal details I had provided when placing previous orders via Amazon and eBay:
Crazy! All I did was enter my email address, and the website went ahead and gave out my name, address and telephone number.
I tried this from a different browser which had never visited the site before, and the same thing happened. Presumably, if someone has bought anything from their eBay or Amazon stores, but not yet registered an account on www.netpricedirect.co.uk, then their personal details might also be up for grabs by anyone who knows their email address. After an account has been registered, this vulnerability can no longer be exploited.
This seems like a rather daft flaw in the application logic. This amount of personal data should never be handed out to an unauthenticated party who knows nothing more than an affected user's email address.
But wait, what's that thing hovering in the bottom-right corner of every page on www.netpricedirect.co.uk? That's right, it's a Trusted Shops seal, which verifies the site as a "secure online shop"...
Subscribe to:
Post Comments (Atom)
I stumbled upon this topic via Google. Very interesting view on subject. Thanks for sharing.
ReplyDeletethanks for this information. I thought that I will find more info about data room due diligence in this article. But nevertheless, I like your blog. ps. followed.
ReplyDelete
ReplyDeleteTo effectively get the Palo Alto Networks Certified Network Security Engineer 6 affirmation, the applicant ought to pass the PCNSE6 Exam Questions, which is one of the prerequisites to have the qualification, the possibility for Networks Certified Network Security Engineer 6 ought to get the best and reasonable exam material like practice exams, PCNSE6 Brain Dumps and pdf. "http://www.gurufocus.com/news/455893/is-palo-altos-recent-drop-an-opportunity-to-buy
"
Công ty vận chuyển hàng hóa chúng tôi chuyên cung cấp các dịch vụ liên quan đến vận chuyển hàng hóa. Có thể kể đến như dịch vụ chuyển hàng trong nước, ký gửi hàng hóa, dịch vụ chuyển phát nhanh trong nước giá rẻ, ...Những dịch vụ chúng tôi cung cấp đã được sự ủng hộ nhiệt tình của quý khách hàng. Hiện nay chúng tôi không ngừng cải tiến chất lượng dịch vụ để đem lại cho quý khách trải nghiệm tốt hơn.
ReplyDeletemặc dầu còn hơn 1 tháng nữa mới đến Tết Nguyên đán 2017 nhưng tại Hà Nội, phổ biến cây đào bích, đào phai đã sớm khoe sắc trên gian phoi quan ao gia re.
ReplyDeleteVừa tậu cành đào phai tại chợ hoa lăng xê, bà Nguyễn Thị Liên (51 tuổi, P.Bạch Mai, Q.Hai Bà Trưng) chia sẻ: “Tôi tậu cành đào phai giá 160.000 đồng. Năm nào vợ chồng tôi cũng đánh xe lên chợ này tậu cành đào về đón rằm tháng Chạp và Tết Dương lịch”.
Để sử dụng được Internet tốc độ cao, ngoài việc biết cú pháp đăng ký 4G Vinaphone người dùng phải có thiết bị hỗ trợ và sở hữu sim 4G của Vinaphone.
ReplyDeleteMuch obliged to you for your post, I search for such article along time, today i discover it at long last. this post give me loads of exhort it is exceptionally helpful for me
ReplyDeletesiber güvenlik
As can be normal, the price of a specific item straightforwardly impacts on the measure of interest it gets from customers. price info
ReplyDeleteExcellent doc! Love suitable for location of which with show! It truly is only 1 beneficial write-up. Love while using the cherished truth together with ability you have and for that reason displayed in this posting. mcb personal loan - meezan bank car financing
ReplyDeleteIf you somehow happened to take a gander at any ventures it would be additionally be a pertinent inquiry to pose to how quick your cash will come back to you. Make money
ReplyDeleteThis type of message always inspiring and I prefer to read quality content, so happy to find good place to many here in the post, the writing is just great, thanks for the post.car leasing singapore
ReplyDeleteThe complete blogs are really inconceivable and definitely everyone will share this information.
ReplyDeletebitcoin blue print
Personally I think overjoyed I discovered the blogs.
ReplyDeleteit would be additionally be a pertinent inquiry to pose to how quick your cash will come back to you Sell Car Number Plate
ReplyDeleteThis is one of the most incredible blogs Ive read in a very long time.
ReplyDeletemua vé máy bay đi cao hùng
ve may bay di nhat ban
ve may bay di tokyo
vé máy bay hà nội đi hàn quốc
vé máy bay đi seoul giá rẻ
Excellent blog with valuable information and just added your blog to my bookmarking sites thank for sharing.
ReplyDeleteData Science Course in Bangalore
Our mission was to offer 'everyone' the best price upfront and a convenient and easy shopping experience. stucco repair denver
ReplyDeleteBest Software Training Institute in Delhi Madrid Software offers strategic training paths for the certification skills required to support today's technologies, while offering a Business Analytic course, Data science course in Delhi, Career in AI and Digital Marketing Course for clients looking to implement new/upgraded business applications.
ReplyDeletei like your post v nice blog parallel car importer Singapore
ReplyDeleteWhat an incredible message this is. Truly one of the best posts I have ever seen in my life. Wow, keep it up.
ReplyDeleteAI Courses in Bangalore
I am sure it will help many people. Keep up the good work. It's very compelling and I enjoyed browsing the entire blog.
ReplyDeleteBusiness Analytics Course in Bangalore
car valuation
ReplyDeletefree car valuation
online car valuation
Great article....
Download Cricket Mazza 11 live match cricket score app, Live Line & Fastest Score. Get Fastest Live cricket score app, Scorecard, Commentary, Match Info, and Schedules of All International & Domestic Matches, Series wise Stats, Records, Analysis and Facts, Trending News and Tweets, Recent ICC Player and Team Rankings. Also Download live cricket score apps for IOS, including Beach Cricket, Cricket T20 Fever 3D and other top answers suggested and ranked.
ReplyDeleteI appreciate your efforts which you have put into this article. Genuinely it is a useful article to increase our knowledge. Thanks for share an article like this.Airdrop Crypto Coin
ReplyDeleteI bookmarked your website because this site contains valuable information. I am very satisfied with the quality and the presentation of the articles. Thank you so much for saving great things. I am very grateful for this site.
ReplyDeleteData Science Training in Bangalore
I'm quite impressed with your work. Please continue to share this type of material with us.
ReplyDeleteI am sure it will help many people. Keep up the good work. It's very compelling and I enjoyed browsing the entire blog.
ReplyDeleteBusiness Analytics Course in Bangalore
I read all the articles. I appreciate you and get more knowledge that’s helped me. Keep it up. Thank you so much for sharing this Windows 10 Activator txt
ReplyDeleteExcellent effort to make this blog more wonderful and informative. The information shared was very useful.
ReplyDeleteCloud Computing Course Fees in Bangalore
Such a very useful article. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article.data analytics course in lucknow
ReplyDeleteDefinitely I got a very very attractive blog that really helpful for every one who is looking good knowledge. Thanks.
ReplyDelete섯다
I inquisitive more enthusiasm for some of them trust you will give more data on this subjects in your next articles.
ReplyDelete성인웹툰
This is a great post I seen because of offer it. It is truly what I needed to see seek in future you will proceed after sharing such a magnificent post.
ReplyDelete토토사이트
Very useful article to read and Information was helpful.I would like to thank you for the efforts you had made for writing this awesome article.
ReplyDeleteData Analytics Course
There is obviously a lot to know about this. I think you made some good points in Features also. Keep working, great job! Data Science Training in Dombivli
ReplyDeleteReally, this article is truly one of the best in the article. And this one that I found quite fascinating and should be part of my collection. Very good work!.
ReplyDeleteData Science Training in Amritsar
If more people that write articles really concerned themselves with writing great content like you, more readers would be interested in their writings. Thank you for caring about your content. เว็บบอล ufabet
ReplyDeleteI think this is an informative and very useful and knowledgeable blog. therefore, I would like to thank you for your effort.
ReplyDeleteData Science Course in Amritsar
Most of you are thinking that the best approach to defend is at the network or code-level, and definitely that is one chunk of puzzle. Cybersecurity Bachelor's Degree Program in the United States
ReplyDeleteDigital Marketing Course
ReplyDeletehttps://www.startupicons.in/blogs/
I've seen articles on the same subject many times, but your writing is the simplest and clearest of them. I will refer to 메이저놀이터추천
ReplyDeleteGreat blog. Thanks for sharing such a nice content Law 360 Alerts
ReplyDeleteGreat post Class Action Now
ReplyDeleteI need to concede. Genuinely seldom would it be advisable for me I experience a blog that is both educative and engaging, and undoubtedly, Really. Much obliged for firing this up. I simply needed to illuminate you that assuming you plan on visiting Turkey, getting an e-visa for Turkey would be the most ideal choice because of its simple cycle, lower cost and more limited holding up time get more
ReplyDeleteNice site. Keep up the great work
ReplyDeletehttps://www.unitedbookmarkings.win/how-can-you-increase-your-acquisition-1
I've seen articles on similar subject ordinarily, yet your composing is the easiest and most clear of them. I will allude to Klein Stock Law
ReplyDeleteLove this blog section so much! https://www.deviantart.com/gierretfjv/journal/12-steps-to-finding-the-perfect-klein-law-928173295
ReplyDeleteGreat post https://fredinmpzq.doodlekit.com/blog/entry/22478320/the-most-common-complaints-about-and-why-theyre-bunk
ReplyDeleteI've been looking for this information for a long time and have now found it on your fantastic website next page
ReplyDeleteWinning is nice, and getting paid out in time and in a protected method is even better. Our payout guide will inform you {how to|the method to|tips on how to} spot casinos with fast payouts. Our 25-step evaluate course of is rigorously designed to ensure every casino we recommend is of the 우리카지노 highest high quality. We take a look at|have a look at} information safety and regulation, bonus phrases and circumstances, recreation selection and progressive jackpots.
ReplyDeleteITR-4 Form ITR-4 Form is the Income Tax Return form for taxpayers who chose a presumptive income scheme under Section 44ADA, Section 44AD, and Section 44AE of the Income Tax Act.
ReplyDeleteEPF is an acronym for Employees’ Provident Fund. A Composite Claim Form is launched by EPFO as a consolidated settlement of claim form to initiate an EPF withdrawal. To know more, click here
ReplyDeleteInformative article I concur with this. Your blog is quite attractive. Thank you for allowing me to view this material; it's truly sound. This article has the potential to inspire me greatly.
ReplyDeletetruck accidents lawyers
This is a nice blog, Well-written. Thanks for this. Learn more
ReplyDelete