Recently, we held a talk at the Winterkongress1 of the Digitale Gesellschaft
Schweiz in Winterthur, Switzerland, about our research project on breaking
German parcel tracking sites. We could not name all the parcel services for
which we identified vulnerabilities respecting disclosure timelines. Today, we
describe our findings at GLS, another player in the German parcel market, and
the disclosure process of corresponding vulnerabilities.
Findings
Similar to the vulnerabilities previously disclosed for DHL2 and DPD3, and
UPS4, we identified that the GLS parcel tracking website discloses the
recipient’s geographic area by showing the name of the destination parcel
center. Furthermore, the recipient’s ZIP code was used to unlock personal
information (including the exact coordinates of the address) and features that
influence the parcel delivery process. The website did not implement
rate-limiting or other techniques to prevent brute-forcing ZIP codes using the
API.
Today, we describe our findings at United Parcel Service of America, Inc. (UPS),
another German parcel market player, and the corresponding vulnerabilities’
disclosure process.
Findings
Only a valid tracking number is needed to get the personal information of a
parcel’s receiver, including the sender’s location, the recipient’s name, and
the recipient’s location (city and country). It was possible to enumerate
numerous tracking numbers during testing by iterating from known ones. Since the
last digit of a tracking number is a checksum, it can be calculated. Also,
certain businesses have a predefined prefix in their tracking numbers. This
schema allows the enumeration of every parcel sent from a particular business.
Dennis and I already published blog posts about our research project dealing
with vulnerabilities in parcel tracking implementations at
DHL
and DPD. At the
Winterkongress (winter
congress) in Winterthur, Switzerland, we had the great opportunity to give a
talk about the matter. The talk was recorded and can be watched
here.
DigiGes held the Winterkongress, which
took place in Winterthur on 01.03. till 02.03.2024. The main topics are ethics,
threats, and opportunities of IT. This year, many talks looked at AI in some
way.
This blog post is the continuation of our parcel research. We already reported
about how we broke parcel tracking at
DHL
and the disclosure process of the identified problems. As DHL is not the only
parcel service in Germany, we also investigated the other available parcel
services. In this blog post, we want to talk about DPD, also called Geopost,
which belongs to the French Post Office.
Efficient Guessing of Tracking Numbers
DPD uses the recipient’s ZIP code to unlock detailed shipment information and
additional options. After trying some ZIP codes manually, we received CAPTCHA
prompts in the web interface (more on this later).
At Troopers 2023, we gave a talk on how to attack DHL parcel tracking
information based on OSINT. Since we previously had an exemplary disclosure
process about this attack with DHL, Mr. Kiehne (from DHL) joined us to provide
interesting background information and insights on how they addressed our
findings.
We want to thank DHL and especially Mr. Kiehne for sharing those insights with
us at Troopers 2023. It is the ideal case, but still not common that
organizations talk openly about their actions and views on a disclosure process.