Men's Wearhouse Perfect Fit App Vulnerability Exposing Customer Information

http://randywestergren.com/mens-wearhouse-perfect-fit-app-vulnerability-exposing-customer-information/

by rwestergren • 12 years ago

9 5 12 years ago

NathanKP2• 12 years ago

I'm trying to imagine what line of thought led to this "authentication" scheme. Surely someone along the way must have realized that this was a terrible idea?

Dublum2• 12 years ago

Right? I'm also curious about the fix. The vulnerability he describes is most obviously that they fail to associate the token you get after login with an actual account, so you can re-use that token to bind an arbitrary account, but binding to a device ID is also problematic, because that information isn't inherently private. Another app could harvest it and be compromised which then leaks the info, or it could be exposed in some other way because it's not unique to their application.

NathanKP2• 12 years ago

One possible fix would be to only allow an account to bind to a device ID if that device ID wasn't already linked to another account. This would prevent you from just fishing through their info by linking your account to random device ID's.

You'd have to know the email address associated with the account, but that of course means you are using the device ID as the username and the email address as the "password", which is still pretty bad in my opinion.

Men's Wearhouse Perfect Fit App Vulnerability Exposing Customer Information

Related Stories