The web site of shopper credit score reporting large Experian carried a serious privateness vulnerability that allowed hackers to acquire buyer credit score studies, and all it took was a bit of identification knowledge (opens in new tab), and a bit of tweak to the deal with displayed within the URL bar, consultants have revealed.

Cybersecurity researcher Jenya Kushnir found the flaw on Telegram, after observing hackers promoting stolen studies, and labored with KrebsOnSecurity (opens in new tab) to research it additional.

The concept was easy – should you had the sufferer’s identify, deal with, birthday and Social Safety quantity (all of which may be obtained from a earlier incident), you could possibly go to one of many web sites providing free credit score studies, and submit the information to request one. At that time, the web site would redirect you to the Experian web site the place you’d be required to submit extra personally identifiable data, reminiscent of questions on earlier addresses of dwelling and such.

Experian hack

And right here is the place the flaw is exploitable. There isn’t any must reply any of these questions – all you’d must do at this level is solely change the deal with displayed within the URL bar, from “/acr/oow/” to “/acr/report,” and also you’d be introduced with the report. 

Whereas testing the idea, Krebs discovered that tweaking the deal with first redirects to “/acr/OcwError”, however making an attempt the tweak once more labored: “Experian’s web site then instantly displayed my total credit score file,” the report states.

The excellent news (if it may be seen as such) is that Experian’s studies are stuffed with inaccuracies. Within the case of Krebs, it held quite a few cellphone numbers, solely certainly one of which was owned by the writer, a while up to now. 

Experian stays quiet concerning the matter, however the issue appears to have been fastened within the meantime. We don’t know for a way lengthy the flaw was lively on the positioning, or what number of studies have been fraudulently generated throughout that point. 

• These are one of the best endpoint safety (opens in new tab) instruments round