Wednesday, 22 January 2014

Net Price Direct exposing my personal data


Most web application security testers will agree that after several years of experience you start to develop an incredible "sixth sense" which allows you to estimate how secure (or insecure!) a website is likely to be, merely by looking at the way the site behaves during normal use.  I'm talking about entirely passive observation of the way the site reacts, without even looking at any of the raw requests and responses that are sent to and from the application server, let alone attempting to manipulate them.

This sixth sense unavoidably gets tingled outside of the work place. We all buy things on the internet as private consumers, and that is certainly one such place where I've noticed quite a few suspicious things lately. However, nothing has been quite so glaringly obvious as the problem I stumbled upon tonight!

A few weeks ago, I bought some Lego from an Amazon.co.uk marketplace seller called Net Price Direct (a trade name of Hyde's Toys & Gift Ltd). My order arrived promptly and in excellent condition. I was very happy. Coincidentally, I also happened to buy the same item from their eBay store. This also arrived promptly and in good condition.

Tonight, I visited the seller's own website at www.netpricedirect.co.uk, and I was pleasantly surprised to see that the delivery costs were slightly better if you bought directly from them.  So I added a few items to my basket and went to the checkout (did I mention I like Lego quite a bit?).

As I had never used the site before - but had made previous purchases via Amazon and eBay - I entered my email address into this part of the login page:


All I submitted was my email address. To my disbelief, I was then taken to the following form, which was automatically populated with the personal details I had provided when placing previous orders via Amazon and eBay:


Crazy! All I did was enter my email address, and the website went ahead and gave out my name, address and telephone number.

I tried this from a different browser which had never visited the site before, and the same thing happened. Presumably, if someone has bought anything from their eBay or Amazon stores, but not yet registered an account on www.netpricedirect.co.uk, then their personal details might also be up for grabs by anyone who knows their email address. After an account has been registered, this vulnerability can no longer be exploited.

This seems like a rather daft flaw in the application logic. This amount of personal data should never be handed out to an unauthenticated party who knows nothing more than an affected user's email address.

But wait, what's that thing hovering in the bottom-right corner of every page on www.netpricedirect.co.uk? That's right, it's a Trusted Shops seal, which verifies the site as a "secure online shop"...



69 comments:

  1. I stumbled upon this topic via Google. Very interesting view on subject. Thanks for sharing.

    ReplyDelete
  2. thanks for this information. I thought that I will find more info about data room due diligence in this article. But nevertheless, I like your blog. ps. followed.

    ReplyDelete

  3. To effectively get the Palo Alto Networks Certified Network Security Engineer 6 affirmation, the applicant ought to pass the PCNSE6 Exam Questions, which is one of the prerequisites to have the qualification, the possibility for Networks Certified Network Security Engineer 6 ought to get the best and reasonable exam material like practice exams, PCNSE6 Brain Dumps and pdf. "http://www.gurufocus.com/news/455893/is-palo-altos-recent-drop-an-opportunity-to-buy
    "

    ReplyDelete
  4. Công ty vận chuyển hàng hóa chúng tôi chuyên cung cấp các dịch vụ liên quan đến vận chuyển hàng hóa. Có thể kể đến như dịch vụ chuyển hàng trong nước, ký gửi hàng hóa, dịch vụ chuyển phát nhanh trong nước giá rẻ, ...Những dịch vụ chúng tôi cung cấp đã được sự ủng hộ nhiệt tình của quý khách hàng. Hiện nay chúng tôi không ngừng cải tiến chất lượng dịch vụ để đem lại cho quý khách trải nghiệm tốt hơn.

    ReplyDelete
  5. mặc dầu còn hơn 1 tháng nữa mới đến Tết Nguyên đán 2017 nhưng tại Hà Nội, phổ biến cây đào bích, đào phai đã sớm khoe sắc trên gian phoi quan ao gia re.

    Vừa tậu cành đào phai tại chợ hoa lăng xê, bà Nguyễn Thị Liên (51 tuổi, P.Bạch Mai, Q.Hai Bà Trưng) chia sẻ: “Tôi tậu cành đào phai giá 160.000 đồng. Năm nào vợ chồng tôi cũng đánh xe lên chợ này tậu cành đào về đón rằm tháng Chạp và Tết Dương lịch”.

    ReplyDelete
  6. Để sử dụng được Internet tốc độ cao, ngoài việc biết cú pháp đăng ký 4G Vinaphone người dùng phải có thiết bị hỗ trợ và sở hữu sim 4G của Vinaphone.

    ReplyDelete
  7. Much obliged to you for your post, I search for such article along time, today i discover it at long last. this post give me loads of exhort it is exceptionally helpful for me
    siber güvenlik

    ReplyDelete
  8. As can be normal, the price of a specific item straightforwardly impacts on the measure of interest it gets from customers. price info

    ReplyDelete
  9. This is very interesting, You’re a very skilled blogger. I have joined your rss feed and look forward to seeking more of your excellent post. Also, I have shared your website in my social networks!
    Thank you and best of luck.hotele , sprawdz rowniez hotele w górach

    ReplyDelete
  10. Excellent doc! Love suitable for location of which with show! It truly is only 1 beneficial write-up. Love while using the cherished truth together with ability you have and for that reason displayed in this posting. mcb personal loan - meezan bank car financing

    ReplyDelete
  11. If you somehow happened to take a gander at any ventures it would be additionally be a pertinent inquiry to pose to how quick your cash will come back to you. Make money

    ReplyDelete
  12. This type of message always inspiring and I prefer to read quality content, so happy to find good place to many here in the post, the writing is just great, thanks for the post.car leasing singapore

    ReplyDelete
  13. The complete blogs are really inconceivable and definitely everyone will share this information.
    bitcoin blue print

    ReplyDelete
  14. Personally I think overjoyed I discovered the blogs.

    ReplyDelete
  15. it would be additionally be a pertinent inquiry to pose to how quick your cash will come back to you Sell Car Number Plate

    ReplyDelete
  16. Excellent blog with valuable information and just added your blog to my bookmarking sites thank for sharing.
    Data Science Course in Bangalore

    ReplyDelete
  17. Our mission was to offer 'everyone' the best price upfront and a convenient and easy shopping experience. stucco repair denver

    ReplyDelete
  18. Best Software Training Institute in Delhi Madrid Software offers strategic training paths for the certification skills required to support today's technologies, while offering a Business Analytic course, Data science course in Delhi, Career in AI and Digital Marketing Course for clients looking to implement new/upgraded business applications.

    ReplyDelete
  19. Awesome article. I enjoyed reading your articles. this can be really a good scan for me. wanting forward to reading new articles. maintain the nice work!
    Data Science Courses in Bangalore

    ReplyDelete
  20. What an incredible message this is. Truly one of the best posts I have ever seen in my life. Wow, keep it up.
    AI Courses in Bangalore

    ReplyDelete
  21. I am sure it will help many people. Keep up the good work. It's very compelling and I enjoyed browsing the entire blog.
    Business Analytics Course in Bangalore

    ReplyDelete
  22. Download Cricket Mazza 11 live match cricket score app, Live Line & Fastest Score. Get Fastest Live cricket score app, Scorecard, Commentary, Match Info, and Schedules of All International & Domestic Matches, Series wise Stats, Records, Analysis and Facts, Trending News and Tweets, Recent ICC Player and Team Rankings. Also Download live cricket score apps for IOS, including Beach Cricket, Cricket T20 Fever 3D and other top answers suggested and ranked.

    ReplyDelete
  23. I appreciate your efforts which you have put into this article. Genuinely it is a useful article to increase our knowledge. Thanks for share an article like this.Airdrop Crypto Coin

    ReplyDelete
  24. I bookmarked your website because this site contains valuable information. I am very satisfied with the quality and the presentation of the articles. Thank you so much for saving great things. I am very grateful for this site.

    Data Science Training in Bangalore

    ReplyDelete
  25. I have voiced some of the posts on your website now, and I really like your blogging style. I added it to my list of favorite blogging sites and will be back soon ...

    Digital Marketing Training in Bangalore

    ReplyDelete
  26. I found Habit to be a transparent site, a social hub that is a conglomerate of buyers and sellers willing to offer digital advice online at a decent cost.

    Artificial Intelligence Training in Bangalore

    ReplyDelete
  27. You actually make it seem like it's really easy with your acting, but I think it's something I think I would never understand. I find that too complicated and extremely broad. I look forward to your next message. I'll try to figure it out!

    Machine Learning Course in Bangalore

    ReplyDelete

  28. I'm quite impressed with your work. Please continue to share this type of material with us.

    digital marketing training in hyderabad

    ReplyDelete
  29. I'm quite impressed with your work. Please continue to share this type of material with us.

    ReplyDelete

  30. I am really enjoying reading your well written articles. I am looking forward to reading new articles. Keep up the good work.
    Data Science Courses in Bangalore

    ReplyDelete
  31. I am sure it will help many people. Keep up the good work. It's very compelling and I enjoyed browsing the entire blog.
    Business Analytics Course in Bangalore

    ReplyDelete
  32. What an incredible message this is. Truly one of the best posts I have ever seen in my life. Wow, keep it up.
    AI Courses in Bangalore

    ReplyDelete
  33. Thank you a bunch for sharing this with all of us you actually realize what you are talking about! Bookmarked. 토토

    ReplyDelete
  34. I read all the articles. I appreciate you and get more knowledge that’s helped me. Keep it up. Thank you so much for sharing this Windows 10 Activator txt

    ReplyDelete
  35. Excellent effort to make this blog more wonderful and informative. The information shared was very useful.
    Cloud Computing Course Fees in Bangalore

    ReplyDelete
  36. Such a very useful article. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article.data analytics course in lucknow

    ReplyDelete
  37. I think this is an informative and very useful and knowledgeable blog. therefore, I would like to thank you for your effort.
    Data Science Course in Jaipur

    ReplyDelete
  38. Definitely I got a very very attractive blog that really helpful for every one who is looking good knowledge. Thanks.
    섯다

    ReplyDelete
  39. I wanted to thank you for this excellent read!! I definitely loved every little bit of it.
    스포츠토토

    ReplyDelete
  40. I inquisitive more enthusiasm for some of them trust you will give more data on this subjects in your next articles.
    성인웹툰

    ReplyDelete
  41. This is a great post I seen because of offer it. It is truly what I needed to see seek in future you will proceed after sharing such a magnificent post.
    토토사이트

    ReplyDelete
  42. Very useful article to read and Information was helpful.I would like to thank you for the efforts you had made for writing this awesome article.
    Data Analytics Course

    ReplyDelete
  43. There is obviously a lot to know about this. I think you made some good points in Features also. Keep working, great job! Data Science Training in Dombivli

    ReplyDelete
  44. Really, this article is truly one of the best in the article. And this one that I found quite fascinating and should be part of my collection. Very good work!.
    Data Science Training in Amritsar

    ReplyDelete
  45. If more people that write articles really concerned themselves with writing great content like you, more readers would be interested in their writings. Thank you for caring about your content. เว็บบอล ufabet

    ReplyDelete
  46. I think this is an informative and very useful and knowledgeable blog. therefore, I would like to thank you for your effort.
    Data Science Course in Amritsar

    ReplyDelete
  47. Most of you are thinking that the best approach to defend is at the network or code-level, and definitely that is one chunk of puzzle. Cybersecurity Bachelor's Degree Program in the United States

    ReplyDelete
  48. ove to read it,Waiting For More new Update and I Already Read your Recent Post its Great Thank..great article. thank you for sharin..Great post. Thank You For Sharing Valuable. information. It is Very Informative article..I urge you to peruse this content it is fun portrayed .. 먹튀검증커뮤니티

    ReplyDelete
  49. Digital Marketing Course

    https://www.startupicons.in/blogs/

    ReplyDelete
  50. Pretty useful article. I merely stumbled upon your internet site and wanted to say that I’ve very favored learning your weblog posts. Any signifies I’ll be subscribing with your feed and I hope you publish once additional soon. 메이저사이트

    ReplyDelete
  51. It seems like I've never seen an article of a kind like . It literally means the best thorn. It seems to be a fantastic article. It is the best among articles related to 메이저안전놀이터. seems very easy, but it's a difficult kind of article, and it's perfect.

    ReplyDelete
  52. I've seen articles on the same subject many times, but your writing is the simplest and clearest of them. I will refer to 메이저놀이터추천

    ReplyDelete
  53. I’m impressed, I have to admit. Truly rarely should i encounter a blog that’s both educative and entertaining, and without a doubt, you’ve hit the nail within the head. Your notion is outstanding; the pain is an issue that insufficient everyone is speaking intelligently about. I am very happy that we stumbled across this inside my try to find some thing relating to this. 메이저토토추천

    ReplyDelete
  54. Awesome post thank you for sharing rieshemp

    ReplyDelete
  55. Nice site. Keep up the great work Litigation View

    ReplyDelete
  56. Great blog. Thanks for sharing such a nice content Law 360 Alerts

    ReplyDelete
  57. I need to concede. Genuinely seldom would it be advisable for me I experience a blog that is both educative and engaging, and undoubtedly, Really. Much obliged for firing this up. I simply needed to illuminate you that assuming you plan on visiting Turkey, getting an e-visa for Turkey would be the most ideal choice because of its simple cycle, lower cost and more limited holding up time get more

    ReplyDelete
  58. I've seen articles on similar subject ordinarily, yet your composing is the easiest and most clear of them. I will allude to Klein Stock Law

    ReplyDelete
  59. Glad to found this amazing blog. Looking for more. https://troyxhsp.bloggersdelight.dk/2022/0

    ReplyDelete
  60. I am grateful for your wonderful content that you have provided for us. I am confident that the vast majority of the general public would find this useful. https://penzu.com/p/06166dfb

    ReplyDelete