The website of consumer credit reporting giant Experian carried a major privacy vulnerability that allowed hackers to obtain customer credit reports, and all it took was a little identity data (opens in new tab), and a little tweak to the address displayed in the URL bar, experts have revealed.
Cybersecurity researcher Jenya Kushnir discovered the flaw on Telegram, after observing hackers selling stolen reports, and worked with KrebsOnSecurity (opens in new tab) to investigate it further.
The idea was simple – if you had the victim’s name, address, birthday and Social Security number (all of which might be obtained from a previous incident), you could go to one of the websites offering free credit reports, and submit the data to request one. At that point, the website would redirect you to the Experian website where you’d be required to submit more personally identifiable information, such as questions about previous addresses of living and such.
Experian hack
And here is where the flaw is exploitable. There is no need to answer any of those questions – all you’d need to do at this point is simply change the address displayed in the URL bar, from “/acr/oow/” to “/acr/report,” and you’d be presented with the report.
While testing the concept, Krebs found that tweaking the address first redirects to “/acr/OcwError”, but trying the tweak again worked: “Experian’s website then immediately displayed my entire credit file,” the report states.
The good news (if it can be seen as such) is that Experian’s reports are filled with inaccuracies. In the case of Krebs, it held numerous phone numbers, only one of which was owned by the author, some time in the past.
Experian remains quiet about the matter, but the problem seems to have been fixed in the meantime. We don’t know for how long the flaw was active on the site, or how many reports were fraudulently generated during that time.
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba