Parcels on Insinuator.net - Bold Statements

Breaking GLS Parcel Tracking

Thu, 25 Apr 2024 00:00:00 +0000

Recently, we held a talk at the Winterkongress¹ of the Digitale Gesellschaft Schweiz in Winterthur, Switzerland, about our research project on breaking German parcel tracking sites. We could not name all the parcel services for which we identified vulnerabilities respecting disclosure timelines. Today, we describe our findings at GLS, another player in the German parcel market, and the disclosure process of corresponding vulnerabilities.

Findings

Similar to the vulnerabilities previously disclosed for DHL² and DPD³, and UPS⁴, we identified that the GLS parcel tracking website discloses the recipient’s geographic area by showing the name of the destination parcel center. Furthermore, the recipient’s ZIP code was used to unlock personal information (including the exact coordinates of the address) and features that influence the parcel delivery process. The website did not implement rate-limiting or other techniques to prevent brute-forcing ZIP codes using the API.

Breaking UPS Parcel Tracking

Wed, 10 Apr 2024 00:00:00 +0000

Today, we describe our findings at United Parcel Service of America, Inc. (UPS), another German parcel market player, and the corresponding vulnerabilities’ disclosure process.

Findings

Only a valid tracking number is needed to get the personal information of a parcel’s receiver, including the sender’s location, the recipient’s name, and the recipient’s location (city and country). It was possible to enumerate numerous tracking numbers during testing by iterating from known ones. Since the last digit of a tracking number is a checksum, it can be calculated. Also, certain businesses have a predefined prefix in their tracking numbers. This schema allows the enumeration of every parcel sent from a particular business.

I know what you ordered last summer @ Winterkongress 2024

Wed, 03 Apr 2024 00:00:00 +0000

Dennis and I already published blog posts about our research project dealing with vulnerabilities in parcel tracking implementations at DHL and DPD. At the Winterkongress (winter congress) in Winterthur, Switzerland, we had the great opportunity to give a talk about the matter. The talk was recorded and can be watched here.

DigiGes held the Winterkongress, which took place in Winterthur on 01.03. till 02.03.2024. The main topics are ethics, threats, and opportunities of IT. This year, many talks looked at AI in some way.

Breaking DPD Parcel Tracking

Tue, 12 Sep 2023 00:00:00 +0000

This blog post is the continuation of our parcel research. We already reported about how we broke parcel tracking at DHL and the disclosure process of the identified problems. As DHL is not the only parcel service in Germany, we also investigated the other available parcel services. In this blog post, we want to talk about DPD, also called Geopost, which belongs to the French Post Office.

Efficient Guessing of Tracking Numbers

DPD uses the recipient’s ZIP code to unlock detailed shipment information and additional options. After trying some ZIP codes manually, we received CAPTCHA prompts in the web interface (more on this later).

All your parcel are belong to us – Talk at Troopers 2023

Tue, 11 Jul 2023 00:00:00 +0000

At Troopers 2023, we gave a talk on how to attack DHL parcel tracking information based on OSINT. Since we previously had an exemplary disclosure process about this attack with DHL, Mr. Kiehne (from DHL) joined us to provide interesting background information and insights on how they addressed our findings.

We want to thank DHL and especially Mr. Kiehne for sharing those insights with us at Troopers 2023. It is the ideal case, but still not common that organizations talk openly about their actions and views on a disclosure process.