1

Our invoice vendor serves invoice images via http and does not require any type of authentication.

 EX: http://example.com/companyid/image.php?id=Lhjjfkedhf_739567395

Using HTTPS would be a good start but what about how the id is generated? They claim it's randomly generated and follows no sequence but is there any risk in someone writing a script to try and ping random ids to see what returns a response?

The first directory is a company directory so any brute force attempt would still allow the hacker to filter by company id.

2
  • Do they email you the invoice link? If not, how do you get it? Mar 10, 2016 at 15:04
  • It uses an api to send the link to another application. Mar 10, 2016 at 16:08

1 Answer 1

1

Disclaimer: Without knowing the specifics of how the ID is generated, everything is just a guess.

The ID, Lhjjfkedhf_739567395, appears to be a concatenation of two components, a 10-character upper-/lower-case string and a 10-digit number. Assuming that is correct, there are 5210 possible values for the string and 1010 possible values for the numeric portion. It seems very unlikely to me that these values are independent (though with a sample of one, it's hard to know). So let's just assume that only the letter portion is truly random and that the numeric portion is some internal ID that they use.

5210 has the an order of magnitude of 1017. As this is such a large number (there are approximately 107 seconds in a year), it means that the vast majority of the possible values will be unused. As such, iterating through them or randomly guessing values to find a used one, especially as it seems you need to make a network connection to confirm each guess, would take a prohibitively long amount of time.

This analysis will only be correct if the initial guesses I made about the format of the IDs are correct and if they use a secure random number generator. Otherwise the situation could be much worse.

2
  • It doesn't seem appropriate as part of the answer, but I would be very concerned sharing confidential information with a company that uses HTTP for any business sensitive operations. It seems like they are not generally focused on security. Mar 10, 2016 at 16:54
  • If you updated your answer to say that there are approximately pi * 10^7 seconds in a year I would magically give you another +1 in addition to the standard one.
    – WoJ
    Mar 10, 2016 at 19:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .