Toshiba in Rugby World Cup personal data compo cockup
Toshiba has made something of a ruck-up in a Rugby World Cup competition, exposing customer details in the process.
UK consumers purchasing new Toshiba laptops were offered a £1 rebate for every point England’s Toby Flood scores in the tournament, which kicks off next weekend. Customers were invited to apply by submitting their personal details to a website, receiving a link to a certificate of registration in return.
The suggested URLs came in the form:
toshibaregistrations.com/rugbyworldcup/Certificates/TOSH1500.pdf.
Henry Dillon, on receiving this certificate, realised certificates containing personal information had been uploaded to an open webserver with no attempt made to obfuscate the URL.
Sure enough Henry was able to see the personal details (name, home address, date of birth, telephone number, model and serial number of laptop bought) of other users by changing the number in the final part of the URL from TOSH1500.pdf to TOSH1501.PDF or other values. Toshiba plugged the security snafu in late August, which Dillon estimates might have affected 1,800 competition entrants.
Dillon, who waited until Toshiba had pulled the plug on the offending PDFs, has a write-up of the problem (containing an obfuscated grab of one of the offending PDFs) in a blog post here.
We asked Toshiba to comment on the lapse but had yet to hear back at the time of publication. Dillon told El Reg that he had not reported the matter to data privacy watchdogs at the ICO. ®
Article source: http://go.theregister.com/feed/www.theregister.co.uk/2011/09/06/toshiba_rugby_world_cup_data_spill/