Wednesday, 22 January 2014

Net Price Direct exposing my personal data


Most web application security testers will agree that after several years of experience you start to develop an incredible "sixth sense" which allows you to estimate how secure (or insecure!) a website is likely to be, merely by looking at the way the site behaves during normal use.  I'm talking about entirely passive observation of the way the site reacts, without even looking at any of the raw requests and responses that are sent to and from the application server, let alone attempting to manipulate them.

This sixth sense unavoidably gets tingled outside of the work place. We all buy things on the internet as private consumers, and that is certainly one such place where I've noticed quite a few suspicious things lately. However, nothing has been quite so glaringly obvious as the problem I stumbled upon tonight!

A few weeks ago, I bought some Lego from an Amazon.co.uk marketplace seller called Net Price Direct (a trade name of Hyde's Toys & Gift Ltd). My order arrived promptly and in excellent condition. I was very happy. Coincidentally, I also happened to buy the same item from their eBay store. This also arrived promptly and in good condition.

Tonight, I visited the seller's own website at www.netpricedirect.co.uk, and I was pleasantly surprised to see that the delivery costs were slightly better if you bought directly from them.  So I added a few items to my basket and went to the checkout (did I mention I like Lego quite a bit?).

As I had never used the site before - but had made previous purchases via Amazon and eBay - I entered my email address into this part of the login page:


All I submitted was my email address. To my disbelief, I was then taken to the following form, which was automatically populated with the personal details I had provided when placing previous orders via Amazon and eBay:


Crazy! All I did was enter my email address, and the website went ahead and gave out my name, address and telephone number.

I tried this from a different browser which had never visited the site before, and the same thing happened. Presumably, if someone has bought anything from their eBay or Amazon stores, but not yet registered an account on www.netpricedirect.co.uk, then their personal details might also be up for grabs by anyone who knows their email address. After an account has been registered, this vulnerability can no longer be exploited.

This seems like a rather daft flaw in the application logic. This amount of personal data should never be handed out to an unauthenticated party who knows nothing more than an affected user's email address.

But wait, what's that thing hovering in the bottom-right corner of every page on www.netpricedirect.co.uk? That's right, it's a Trusted Shops seal, which verifies the site as a "secure online shop"...



54 comments:

  1. I stumbled upon this topic via Google. Very interesting view on subject. Thanks for sharing.

    ReplyDelete
  2. thanks for this information. I thought that I will find more info about data room due diligence in this article. But nevertheless, I like your blog. ps. followed.

    ReplyDelete

  3. To effectively get the Palo Alto Networks Certified Network Security Engineer 6 affirmation, the applicant ought to pass the PCNSE6 Exam Questions, which is one of the prerequisites to have the qualification, the possibility for Networks Certified Network Security Engineer 6 ought to get the best and reasonable exam material like practice exams, PCNSE6 Brain Dumps and pdf. "http://www.gurufocus.com/news/455893/is-palo-altos-recent-drop-an-opportunity-to-buy
    "

    ReplyDelete
  4. Công ty vận chuyển hàng hóa chúng tôi chuyên cung cấp các dịch vụ liên quan đến vận chuyển hàng hóa. Có thể kể đến như dịch vụ chuyển hàng trong nước, ký gửi hàng hóa, dịch vụ chuyển phát nhanh trong nước giá rẻ, ...Những dịch vụ chúng tôi cung cấp đã được sự ủng hộ nhiệt tình của quý khách hàng. Hiện nay chúng tôi không ngừng cải tiến chất lượng dịch vụ để đem lại cho quý khách trải nghiệm tốt hơn.

    ReplyDelete
  5. mặc dầu còn hơn 1 tháng nữa mới đến Tết Nguyên đán 2017 nhưng tại Hà Nội, phổ biến cây đào bích, đào phai đã sớm khoe sắc trên gian phoi quan ao gia re.

    Vừa tậu cành đào phai tại chợ hoa lăng xê, bà Nguyễn Thị Liên (51 tuổi, P.Bạch Mai, Q.Hai Bà Trưng) chia sẻ: “Tôi tậu cành đào phai giá 160.000 đồng. Năm nào vợ chồng tôi cũng đánh xe lên chợ này tậu cành đào về đón rằm tháng Chạp và Tết Dương lịch”.

    ReplyDelete
  6. Để sử dụng được Internet tốc độ cao, ngoài việc biết cú pháp đăng ký 4G Vinaphone người dùng phải có thiết bị hỗ trợ và sở hữu sim 4G của Vinaphone.

    ReplyDelete
  7. Much obliged to you for your post, I search for such article along time, today i discover it at long last. this post give me loads of exhort it is exceptionally helpful for me
    siber güvenlik

    ReplyDelete
  8. As can be normal, the price of a specific item straightforwardly impacts on the measure of interest it gets from customers. price info

    ReplyDelete
  9. Excellent doc! Love suitable for location of which with show! It truly is only 1 beneficial write-up. Love while using the cherished truth together with ability you have and for that reason displayed in this posting. mcb personal loan - meezan bank car financing

    ReplyDelete
  10. If you somehow happened to take a gander at any ventures it would be additionally be a pertinent inquiry to pose to how quick your cash will come back to you. Make money

    ReplyDelete
  11. This type of message always inspiring and I prefer to read quality content, so happy to find good place to many here in the post, the writing is just great, thanks for the post.car leasing singapore

    ReplyDelete
  12. The complete blogs are really inconceivable and definitely everyone will share this information.
    bitcoin blue print

    ReplyDelete
  13. Personally I think overjoyed I discovered the blogs.

    ReplyDelete
  14. it would be additionally be a pertinent inquiry to pose to how quick your cash will come back to you Sell Car Number Plate

    ReplyDelete
  15. Excellent blog with valuable information and just added your blog to my bookmarking sites thank for sharing.
    Data Science Course in Bangalore

    ReplyDelete
  16. Our mission was to offer 'everyone' the best price upfront and a convenient and easy shopping experience. stucco repair denver

    ReplyDelete
  17. Best Software Training Institute in Delhi Madrid Software offers strategic training paths for the certification skills required to support today's technologies, while offering a Business Analytic course, Data science course in Delhi, Career in AI and Digital Marketing Course for clients looking to implement new/upgraded business applications.

    ReplyDelete
  18. What an incredible message this is. Truly one of the best posts I have ever seen in my life. Wow, keep it up.
    AI Courses in Bangalore

    ReplyDelete
  19. I am sure it will help many people. Keep up the good work. It's very compelling and I enjoyed browsing the entire blog.
    Business Analytics Course in Bangalore

    ReplyDelete
  20. Download Cricket Mazza 11 live match cricket score app, Live Line & Fastest Score. Get Fastest Live cricket score app, Scorecard, Commentary, Match Info, and Schedules of All International & Domestic Matches, Series wise Stats, Records, Analysis and Facts, Trending News and Tweets, Recent ICC Player and Team Rankings. Also Download live cricket score apps for IOS, including Beach Cricket, Cricket T20 Fever 3D and other top answers suggested and ranked.

    ReplyDelete
  21. I appreciate your efforts which you have put into this article. Genuinely it is a useful article to increase our knowledge. Thanks for share an article like this.Airdrop Crypto Coin

    ReplyDelete
  22. I bookmarked your website because this site contains valuable information. I am very satisfied with the quality and the presentation of the articles. Thank you so much for saving great things. I am very grateful for this site.

    Data Science Training in Bangalore

    ReplyDelete
  23. I'm quite impressed with your work. Please continue to share this type of material with us.

    ReplyDelete
  24. I am sure it will help many people. Keep up the good work. It's very compelling and I enjoyed browsing the entire blog.
    Business Analytics Course in Bangalore

    ReplyDelete
  25. I read all the articles. I appreciate you and get more knowledge that’s helped me. Keep it up. Thank you so much for sharing this Windows 10 Activator txt

    ReplyDelete
  26. Excellent effort to make this blog more wonderful and informative. The information shared was very useful.
    Cloud Computing Course Fees in Bangalore

    ReplyDelete
  27. Such a very useful article. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article.data analytics course in lucknow

    ReplyDelete
  28. Definitely I got a very very attractive blog that really helpful for every one who is looking good knowledge. Thanks.
    섯다

    ReplyDelete
  29. I inquisitive more enthusiasm for some of them trust you will give more data on this subjects in your next articles.
    성인웹툰

    ReplyDelete
  30. This is a great post I seen because of offer it. It is truly what I needed to see seek in future you will proceed after sharing such a magnificent post.
    토토사이트

    ReplyDelete
  31. Very useful article to read and Information was helpful.I would like to thank you for the efforts you had made for writing this awesome article.
    Data Analytics Course

    ReplyDelete
  32. There is obviously a lot to know about this. I think you made some good points in Features also. Keep working, great job! Data Science Training in Dombivli

    ReplyDelete
  33. Really, this article is truly one of the best in the article. And this one that I found quite fascinating and should be part of my collection. Very good work!.
    Data Science Training in Amritsar

    ReplyDelete
  34. If more people that write articles really concerned themselves with writing great content like you, more readers would be interested in their writings. Thank you for caring about your content. เว็บบอล ufabet

    ReplyDelete
  35. I think this is an informative and very useful and knowledgeable blog. therefore, I would like to thank you for your effort.
    Data Science Course in Amritsar

    ReplyDelete
  36. Most of you are thinking that the best approach to defend is at the network or code-level, and definitely that is one chunk of puzzle. Cybersecurity Bachelor's Degree Program in the United States

    ReplyDelete
  37. Digital Marketing Course

    https://www.startupicons.in/blogs/

    ReplyDelete
  38. I've seen articles on the same subject many times, but your writing is the simplest and clearest of them. I will refer to 메이저놀이터추천

    ReplyDelete
  39. Great blog. Thanks for sharing such a nice content Law 360 Alerts

    ReplyDelete
  40. I need to concede. Genuinely seldom would it be advisable for me I experience a blog that is both educative and engaging, and undoubtedly, Really. Much obliged for firing this up. I simply needed to illuminate you that assuming you plan on visiting Turkey, getting an e-visa for Turkey would be the most ideal choice because of its simple cycle, lower cost and more limited holding up time get more

    ReplyDelete
  41. I've seen articles on similar subject ordinarily, yet your composing is the easiest and most clear of them. I will allude to Klein Stock Law

    ReplyDelete
  42. I've been looking for this information for a long time and have now found it on your fantastic website next page

    ReplyDelete
  43. Winning is nice, and getting paid out in time and in a protected method is even better. Our payout guide will inform you {how to|the method to|tips on how to} spot casinos with fast payouts. Our 25-step evaluate course of is rigorously designed to ensure every casino we recommend is of the 우리카지노 highest high quality. We take a look at|have a look at} information safety and regulation, bonus phrases and circumstances, recreation selection and progressive jackpots.

    ReplyDelete
  44. ITR-4 Form ITR-4 Form is the Income Tax Return form for taxpayers who chose a presumptive income scheme under Section 44ADA, Section 44AD, and Section 44AE of the Income Tax Act.

    ReplyDelete
  45. EPF is an acronym for Employees’ Provident Fund. A Composite Claim Form is launched by EPFO as a consolidated settlement of claim form to initiate an EPF withdrawal. To know more, click here

    ReplyDelete
  46. Informative article I concur with this. Your blog is quite attractive. Thank you for allowing me to view this material; it's truly sound. This article has the potential to inspire me greatly.
    truck accidents lawyers

    ReplyDelete
  47. This is a nice blog, Well-written. Thanks for this. Learn more

    ReplyDelete