2

Lets assume you just bought something and it is getting shipped via a major package shipping agency (such as FedEx or UPS etc.). You are given a tracking number which you can use to view where the package is. Now somehow a hacker is able to obtain this number. What could possibly be compromised?

Would the hacker be able to change the package destination to themselves?

Could the hacker steal personal information from the number (assuming the did not obtain any from the original method they got the number in the first place)?

An ideal answer would include a comparison of the different package carriers and additional information that could answer future questions

  • 1
    Please explain the down votes. – Eric Johnson May 15 '16 at 12:51
  • I don't understand the down votes either. It seems a legit question to me. – Yokai May 15 '16 at 13:51
1

A hacker that just has a tracking number won't be able to do very much with it on it's own. However, if a hacker can gain access to the logistics database of the shipping company's entire operation, that tracking number, if the hacker so chooses, can then change the destination address in the system as an update and pretend that you initiated that change. In this way, they could have packages dropped at random addresses where the hacker would then personally pick up the package and sign your name to complete. The shipping company will see your signature and will believe that you received your package.

However such logistics systems are usually heavily monitored and in my research on the subject, I don't find many cases of such a risky hack occurring. Though it is not implausible.

  • You say "A hacker that just has a tracking number won't be able to do very much with it on it's own." What is very much? That was more what I was trying to get to with this question. – Eric Johnson May 15 '16 at 12:50
  • 1
    Without access to the logistics database, the only thing the hacker can really do with a tracking number is watch the progress of the package. If he/she knows your name, he/she can call and act like you and possibly change the destination address by providing the tracking number. But its a long shot I would assume because I have had to change a package destination myself and I needed a good bit of information so UPS would change the address. – Yokai May 15 '16 at 13:48
  • 1
    But like I mentioned, it is indeed plausible that a skilled hacker can do more. Social engineering is an extremely valuable skill if one has the character to use persuasive thought coercion. – Yokai May 15 '16 at 13:50
  • UPS uses a software called, On-Road Integrated Optimization Navigation (ORION) which if compromised could effect a global delivery, inventory, and tracking system. It would be utter chaos for them. So really, your question is a good one that begs inquiry into the larger scope. – Yokai May 15 '16 at 13:56
1

This depends on the service used to ship the goods. Certain services (e.g. GLS in Germany) will allow you to reroute the parcel to a nearby GLS-Hub after it has been sent on its way. By using social engineering and the hotlines of delivery services one might be able to divert parcels of other services too. Most delivery services will only allow you to redirect a parcel to a "safe location" this will be an office of the service provider that you will force you to prove your identity to pick it up.

Regarding personal information: DHL in Germany requires you to know the destination ZIP-Code to track a parcel in detail. Other providers might leak information through their tracking portals.

This said, the attacker will most certainly not be able to steal the parcel, but will be able to delay the shipment by certain periods.

1

I just had my iPad shipment re-routed from FedEx to a local store where the thief signed for the package with a name almost exactly as mine. I ordered the iPad via cell phone/internet without wifi connected. I checked the routing a few times via the same cell phone...

Somehow the thief now has my iPad and FedEx says there is nothing they can do about it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.