Grabbing random DHL package signatures

http://blog.mclemon.cz/grabbing-dhl-signatures

by smcl • 13 years ago

62 51 13 years ago

blog.mclemon.cz

blackdogie2• 13 years ago

This is probably something you should have reported to DHL before you shared this.

As for analysis of signatures, it would be interesting to see if you could compare male / female writing, and see if there was anything you could learn, to predict if the writing was by a man or woman. There is a list that you can download from the Library of Congress http://www.census.gov/genealogy/www/data/1990surnames/names_... for first male / female names.

blackdogie2• 13 years ago

Well DHL at least are aware of the issue , via a twitter conversation https://twitter.com/DHLPaket/status/373388119175090176

duncan_bayne• 13 years ago

I called it in to DHL Australia, & followed it up today (no reply yet).

They were really easy to deal with; the chap on the phone was very helpful and took copious notes. All in all a much nicer process than when I called Mastercard about a vulnerability a few years ago.

So, raspberries to DHL for the bug existing in the first place, but kudos for the way they handled the report. Very impressive so far.

notimetorelax• 13 years ago

While it's good to expose such a security issue why would he grab 1000 signatures and than share the script? What do white hat security researches think of that?

sneak4• 13 years ago

Why would DHL publish -all- of the signatures on the web without even a rudimentary audit/security review?

This is 2013. It's not about the "grab". The act is publishing, making available. Those who access are not the gatekeepers.

squidi• 13 years ago

Two wrongs don't make a right

smcl5• 13 years ago

I didn't even think of it as a security thing. A surname, signature and vague region in a country is not a particularly narrow combination. I was mostly just wanting to look at the signatures themselves - I'm not by any stretch of the imagination expert in breaking security. Any idiot could take a URL and increment a param in the URL.

As to why I shared the script, I dunno I just figured others might find it interesting - though on reflection it's not particularly advanced.

thejosh• 13 years ago

uhhhh... didn't something like this happen with at&t a while back that is pretty well known now?

roywiggins• 13 years ago

Yeaaaah, you could probably fall afoul of the CFAA with this one... See: weev.

Edit: Ahh, I see you're based outside the US, carry on.

NKCSS• 13 years ago

Lol on the edit :P

warcode2• 13 years ago

Pretty standard for package trackers.

Only thing that helps is a sufficiently random tracking hash/string.

LukaszB2• 13 years ago

I work in this industry and even if the fix is as small as you mentioned is not going to happen for months/years... Sadly it's not only the case with one carrier

7952• 13 years ago

Anything sufficiently random to avoid automated guessing is going to be too long to enter on a keyboard.

soult• 13 years ago

On the German DHL package tracking page, you have to enter the recipient ZIP code before being shown recipient details like name and signature. The tracking code itself is 20 decimal characters, although it is not randomly generated.

madaxe• 13 years ago

This is pretty old news (has been the case for years and years with DHL), however by grabbing those signatures, you've just put yourself in Weev's shoes.

bigiain2• 13 years ago

If weev had done what he did from the Czeck Republic (and never entertained the idea of visiting the USA) he'd almost certainly be doing just fine right now (well, as "fine" as weev ever did…)

smcl5• 13 years ago

I've no intention of visiting the US anyway.

RossM• 13 years ago

Ethics aside, this is a pretty large oversight on the part of DHL. All you need to stop the incrementing is to require a second param such as the recipient postcode or customer surname. Plenty of other companies get this right.

mineo• 13 years ago

That's actually how the german DHL website works - unless you enter the recipients postcode, all you get is information that's not telling you who the recipient is (that is, the shipment progress, the latest status). If you enter the postcode, the recipients name and the name of the person the package was delivered to (for example your neighbor) will be revealed.

LukaszB2• 13 years ago

I like the way how TNT asks for PIN to display pod details..

Tarang• 13 years ago

You should have reported this to DHL first. Signatures are sensitive bits of information. While its a large oversight on DHLs part its still not right to upload people's signatures publicly

nly• 13 years ago

Fortunately, for many of us, signing for packages is probably the only frequent use of our scrawl so hopefully the potential for fraud from this hack is lessened.

I think a scarier prospect is that signature recognition may make it possible for someone to search for all the packages you've ever signed-for, regardless of the courier or location at which you accepted it. I'd be surprised if couriers weren't already doing this in collaboration with law enforcement.

sneak4• 13 years ago

On Sunday, weev will spend his 28th birthday in federal prison for doing this exact same thing.

The CFAA declines to define "unauthorized access", meaning that the site operator can simply label anything that wasn't what they envisioned as "unauthorized" and suddenly you're a felon.

You are obviously not aware of the times in which we live.

lucaspiller• 13 years ago

The UK is the same. I don't think it has been tested in court, but the Computer Misuse Act 1990 makes "Unauthorised access to computer material" illegal. Doing this would legally fall under this, resulting in a fine of up to £5000 or 6 months behind bars.

mseebach• 13 years ago

So, the actual sentencing is certainly overzealous, but are you arguing that "unauthorized access" shouldn't be illegal? Should it just be a free-for-all: if you can get into it, you're welcome, and you can do whatever you want with any data you can get your hands on? If not, what's the threshold? Are you allowed to guess a password? What if you bruteforce it? Can you use a zero-day vulnerability in Rails?

Both Weev and this guy clearly knew that they were accessing data they weren't supposed to access, even if the protection in place was/is clearly inadequate.

warcode2• 13 years ago

Unauthorized Access should mean there is something that enforces authorization in front of it, and you circumvented that or forcefully passed through.

Legal actions based on security through obscurity is a silly idea.

oftenwrong• 13 years ago

I think it is wrong that these companies go unpunished. It would be one thing if it was an "actual" hack, but in these cases the companies are literally giving away the private information of their customers to anyone who asks for it.

That they are giving out signatures makes it even worse, as it could easily be used for identity theft. I am never using DHL again.

smcl5• 13 years ago

I am, I just reckon this is not quite the same. Some shitty pixellated signatures are not a particularly big deal

aroch• 13 years ago

The shitty, pixellated signatures could be used to fraudulently sign electronic documents...

whyleyc• 13 years ago

In weev's case all he grabbed were email addresses but this landed him with 41 months in a federal prison and a fine of $73,000.

My advice would be to take down the script, remove the signature image from your blog post and contact DHL (if you haven't already).

gbaygon• 13 years ago

According to the site he is based in Czech Republic, are the laws there the same there as in the USA? and if not, do you think that he could face extradition for this?

evadne• 13 years ago

Time to practice generic and illegible signatures. For example, draw four circles and cross it out.

They are everywhere… a particular hotel’s breakfast order card you hang on the door knob requires a signature, banks require them, you sometimes have to sign when paying with a credit card, people expect you to doodle in a little box whenever there is exchange of money and goods.

Remind me to print HERP DERP next time with DHL please.

smcl5• 13 years ago

Actually if you look through the signatures I grabbed, a lot of them are just a big capital "D", a random squiggle or just the same name as is published but in a semi-legible form

arbuge• 13 years ago

It seems to me that signatures are way past their useful shelf life. The world is not set up to verify them against anything. If you sign off on a package with a fake signature, you'll probably be fine - the computer will check the box as having a signature on file and close the delivery - and you won't be exposed to privacy breach like this.

More sinister: if somebody grabs your check book and starts writing bad checks, I doubt the bank will pay much attention to whatever they scribble on them and you'll have a real nuisance on your hands.

claudius• 13 years ago

My bank doesn’t do checks, but they check the signature on incoming (paper) mail with a signature of mine they have stored somewhere – I had to come in once specifically because my signature was different.

Similarly, when signing leases for flats, you usually need a copy of your passport/ID to prove that the signature is indeed yours.

Edit: Oh, and just pretending to be someone else is a lesser crime than pretending to be someone else and faking their signature, so requiring a signature might help as some sort of deterrent. (You can still do three circles for your signature, but doing three circles while impersonating someone else and giving the impression that said three circles are their signature is a crime on its own (in Germany (IANAL))).

lotsofcows• 13 years ago

Your signature has only every been useful as your "mark". Any formal contract requires two witnesses or a notary.

If you go to court over some contract, how much the signature looks like yours is not particularly important - it's whether or not you made it.

Stories about people signing contracts "Mickey Mouse" are apocryphal for the same reason.

The only place your signature really counts is when signing a credit card bill - something that was only ever really a convenience until a better(ish) solution came along.

petercooper• 13 years ago

This doesn't surprise me. I think DHL is an absolute joke when it comes to security and validating identity.

For several months, DHL's debt collectors have been pursuing my company for unpaid import taxes because some fraudsters trivially used our (misspelled) company name on their account (without any true "ID theft" taking place). Despite mountains of proof to the contrary, the case continues and may be headed for court.

I'm so tempted to report this to the ICO because it seems like a violation of British data protection laws.

fnordfnordfnord• 13 years ago

inb4 'righteously' indignant people are offended that OP 'hacked', 'stole', 'broke in to', 'etc' but not the least bit worried that DHL has utterly failed to protect that which ought to be confidential information, (for years).

davidbanham• 13 years ago

Kind of shocked that anyone thinks this is a significant breach. It is 2013. Nothing of significance is secured by "the kind of unusual way I write my name" any more.

What I did find interesting was how much effort most people seem to apply to doing a proper signature on that tiny, awkward device. I just dash a line and the delivery guy is happy.

sengstrom• 13 years ago

I usually sign "Chuck Norris" at the grocery store.

kekumu• 13 years ago

I think USPS is basically the same way. I just shipped something with Signature Confirmation. The only thing I needed was the tracking number, and then I could sign up to receive an email with the signature in a PDF. Maybe you have to sign up before it's delivered though.

Grabbing random DHL package signatures

Related Stories