Australia Post hit by security breach again
AUSTRALIA Post's security operations have been hit by yet another security flaw - the third in four weeks.
AUSTRALIA Post's security operations have been hit by yet another security flaw - the third in four weeks.
The names, addresses, businesses, email addresses, landline and mobile numbers of Australia Post recipients are being exposed by simply manipulating the website URL.
News Ltd was alerted to the problem by an Australia Post customer, Trent Bourne, a 23-year-old website administrator from Homebush, Sydney who said he reported the issue to AusPost on their 13POST number Tuesday afternoon.
''They stated that the matter has been corrected,'' Mr Bourne said.
"I offered to show them the error but they declined the offer".
All users need to do is visit their address book once they have logged into their Click & Send account, and select to "modify" any of the addresses saved.
As of writing, the security flaw still has not been corrected.
Altering the six digit code at the end of the URL causes personal information from other customers' address books to be exposed.
When notified about the breach, Australia Post told News Ltd it had contacted its team to secure the site but said it couldn't say when the problem would be fixed.
''We are in the process of suspending the Click & Send website,'' the spokeswoman said.
''Australia Post takes the issue of our customers privacy extremely seriously and we are investigating an issue with our Click & Send service.''
''The issue relates to non-financial details of some customers becoming inadvertently visible.
''Australia Post would like to reassure Click & Send customers that their financial details have not been compromised.
''We apologise for any inconvenience caused.''
This is the third security flaw to be discovered on Australia Post's website in less than a month.
The discovery comes less than two weeks after Australia Post was forced to shut down its electronic parcel tracking service, after a customer revealed the names and locations of thousands of Australians who have been sent parcels.
Four weeks ago it was revealed that the company did not believe people were smart enough to discover a flaw on its Click & Send service that was putting customers' privacy at risk.
Australia Post claimed the service had been fixed and was completely secure after taking it offline to rectify the security flaw.
The Information Commissioner has been contacted for comment.