1

Background:
Many shipping companies (like DHL, UPS, national postal services, etc) will allow the recipient of a package to track their package online, and will often display the address that the package is being delivered to before it has been delivered, and/or the "proof of delivery" with the address of where it was delivered to and who signed for the package. However, this publicly presents the delivery information for every package, and an attacker simply needs to scrape that data.

Questions:
Is this considered dangerous? Has there been any reported/documented "attacks" on shippers or recipients performed by exploiting the delivery information presented by couriers?

Possible Attack:
This thought came to my attention due to an article about how 4,500 marijuana purchasers had their addresses stolen. Basically, people purchased marijuana legally online from a Canadian government website (the Ontario Cannabis Store, or OCS), but an attacker was able to use a Canada Post "tracking tool" to get the delivery information for those shipments. It doesn't explain how the attacker did it, but it's not hard to come up with at least one possible method:

Canada Post (and many other courier companies around the world) allow a shipper to provide a "reference number" with their shipments, which many shippers use as a place to store an identifier, such as the order number, for the shipment. Both the shipper and the recipient can use this reference number for tracking, rather than using the tracking number generated by the shipping company. So what this attacker may have done, was received a package from OCS, noted the reference number and figured out a pattern (eg "OCS" followed by 6 digits), then brute forced the Canada Post tracking tool to try and find a bunch of packages that match (even easier to do if the reference number was an incrementing order number). From there, they were able to get the delivery address and signature of marijuana recipients.

This particular attack was a privacy breach, but it's not hard to see this used for things like corporate espionage (if you can figure out your competitor's reference number patterns, you can start monitoring their shipments and observe who their clients are), or even theft. For example, if you live in a large city, you could find a reference number pattern for a large retailer (say, from an Amazon distribution centre), and monitor all of their shipments. Once you find a shipment destined for your city, you just monitor the tracking to see if it ended up being left in a "safe" place (eg "by the side door"), or if it was signed for by a human...And if it wasn't signed for by a human, the attacker has an address that they can just go steal the package from.

You could, of course, do many other things, like redirect a package to a different address (many companies only require the tracking number and verification of the original destination address, which can be gathered from tracking), or be used to glean information for social engineering. But I'm not trying to create an exhaustive list; I'm basically just asking if this is viewed as an attack vector by any industries (shipping companies or pen testers), and/or if it is commonly targetted. Displaying the destination address and/or the "proof of delivery" seems to be industry standard, and I don't know if this is simply a case of "user convenience" outweighing the potential risk, or if companies just don't consider it dangerous to present this information publicly.

  • UPS uses 8 digit codes, which makes brute-forcing a lot harder without violating API terms. – dandavis Nov 12 '18 at 20:31
  • @dandavis Brute-forcing tracking numbers from the shipping company is just one method of getting this tracking information - although I should note that there are companies that just generate sequential tracking numbers. In the example I gave, I specifically referred to tracking a shipper-provided reference number, which is kind of like letting a user create their own password...It has the potential to be easily guessable, and if a shipper uses a reference number pattern that can be guessed, then an attacker suddenly has access to see all the shipments/consignee addresses from that shipper. – RToyo Nov 12 '18 at 20:44
  • The swiss post uses roughly sequential tracking numbers, it would be easy to enumerate them: service.post.ch/EasyTrack/submitParcelData.do then use eg "99.00.300003.12026943" and enumerate from there. It does not reveal an individual address though, only the town. – Marcel Apr 12 '19 at 8:05
0

First off in many countries addresses are viewed as public information anyway.

On top of this as far as i'm aware these services offer no way to enumerate current deliveries. You usually either need a tracking number and/or postcode. If you have the postcode you already have the address. If it requires a tracking number this effectively acts as a password.

The only real risk I see is the ability to derive secondary information. For example in a system which only requires a postcode you could monitor your neighbours and see who is getting what package when. If it gives a transit history or the name of the sender you may also be able to work out what they've ordered (for example your pregnant neighbour ordering from a company specialising in paternity testing...).

|improve this answer|||||
  • usually there's only geographic info on the tracking history, not sender/company info. – dandavis Nov 12 '18 at 20:32
  • 1
    Thank you for your answer. Most companies allow you to track by tracking number and/or postcode, but as I mentioned in the question, many allow you to track via a shipper-defined reference number. If the shipper decides to use an incrementing reference number, it's very simple to continually track shipments as they depart. That's where I see the real vulnerability. And as for the bit about addresses being public information, that's true, but this information has the potential to tie an address to a seller or a purchase. – RToyo Nov 12 '18 at 20:41
0

Not if implemented correctly

Information about my package is something that should be only available to parties of interest, which is in most cases the sender and the recipient. I'm excluding the logistics company itself, as they are not using their external API to query this data anyways.

When a new shipment is added to the system, a unique and unguessable identifier, otherwise known as a Universally Unique Identifier (UUID). Here's an example UUID: b5830ea7-1007-4830-9c30-1dd95be968af

The UUID of the package should then be distributed to the sender and the recipient. Forwarding to the recipient is either done by the logistics company, or by the sender, depending on how it is set up.

The only way to access tracking information is by having this UUID. Since the UUID is 128 bits long, the chances of an attacker guessing a UUID at random is negligibly small.

How to not implement correctly

Of course, the far more interesting scenarios is what happens if it's not implemented correctly. I've once encountered a post service, where in order to get access to the tracking information, you had to enter your address and - I quote - "In order to verify your identity, you need to submit your last name". Because, as we all know, last names are very secret information not known to the public in any way.

In general, it's not a good idea to implement a system in which the only method of verification is to query publicly available information. The possible attacks were described pretty well in your question anyways.

|improve this answer|||||
  • This is a good explanation of how to protect the information, and thank you for answering. But I'm not sure it follows the spirit of the question of having the destination information publicly available as many transportation companies currently do. If you require a UUID to view the shipment destination, it's no longer public information. – RToyo Apr 12 '19 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.