The United States Postal Service (USPS) has patched a security flaw that allowed anyone with an account at usps.com to view the account details of any of the 60 million people signed up to the service. In some cases, the flaw even allowed for changes to be made to those accounts.
In a post on his website, security specialist Brian Krebs said that he was recently contacted by a researcher who said he’d told the USPS about the flaw last year. After receiving no response, the researcher contacted Krebs, who took up the issue with the USPS. The Postal Service says it has now patched the bug.
Asked why it apparently took a year to deal with the issue, a USPS spokesperson told Digital Trends that it “has not been able to substantiate the claim … that the researcher reached out to us a year ago.”
Krebs said the bug concerned an authentication vulnerability in the usps.com API linked to a USPS service called “Informed Visibility,” which provides businesses, advertisers, and other bulk mail senders with access to near real-time tracking data connected with their mail campaigns and packages.
As well as exposing near real-time data about packages and mail being sent by USPS commercial customers, Krebs explained that the vulnerability let any logged-in usps.com user search the system for account details belonging to any other user, “such as email address, username, user ID, account number, street address, phone number, authorized users, mailing campaign data, and other information.”
Changes could also be made to that data, though Krebs noted that for some data fields, a validation step — such as a confirmation message sent to the email address linked to the account — prevented the alteration from taking place.
Highlighting the seriousness of the flaw, security researcher Krebs said that “no special hacking tools were needed to pull this data, other than knowledge of how to view and modify data elements processed by a regular web browser like Chrome or Firefox.” Those with the know-how would have been able to access information about who lived inside a particular premises by performing a regular search on its street address.
In a statement to Digital Trends, the Postal Service said: “Any information suggesting criminals have tried to exploit potential vulnerabilities in our network is taken very seriously. Out of an abundance of caution, the Postal Service is further investigating to ensure that anyone who may have sought to access our systems inappropriately is pursued to the fullest extent of the law.”
The USPS added that at the current time there is no evidence to suggest that customer records have been exploited in any way.
