I know what you ordered last summer @ Winterkongress 2024

Wed, 03 Apr 2024 00:00:00 +0000

Dennis and I already published blog posts about our research project dealing with vulnerabilities in parcel tracking implementations at DHL and DPD. At the Winterkongress (winter congress) in Winterthur, Switzerland, we had the great opportunity to give a talk about the matter. The talk was recorded and can be watched here.

DigiGes held the Winterkongress, which took place in Winterthur on 01.03. till 02.03.2024. The main topics are ethics, threats, and opportunities of IT. This year, many talks looked at AI in some way.

Breaking DPD Parcel Tracking

Tue, 12 Sep 2023 00:00:00 +0000

This blog post is the continuation of our parcel research. We already reported about how we broke parcel tracking at DHL and the disclosure process of the identified problems. As DHL is not the only parcel service in Germany, we also investigated the other available parcel services. In this blog post, we want to talk about DPD, also called Geopost, which belongs to the French Post Office.

Efficient Guessing of Tracking Numbers

DPD uses the recipient’s ZIP code to unlock detailed shipment information and additional options. After trying some ZIP codes manually, we received CAPTCHA prompts in the web interface (more on this later).

DPD on Insinuator.net - Bold Statements

I know what you ordered last summer @ Winterkongress 2024

Breaking DPD Parcel Tracking

Efficient Guessing of Tracking Numbers