{"id":47222,"date":"2022-06-23T08:30:07","date_gmt":"2022-06-23T08:30:07","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/halfords-suffers-a-puncture-in-the-customer-details-department\/"},"modified":"2022-06-23T08:30:07","modified_gmt":"2022-06-23T08:30:07","slug":"halfords-suffers-a-puncture-in-the-customer-details-department","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/halfords-suffers-a-puncture-in-the-customer-details-department\/","title":{"rendered":"Halfords suffers a puncture in the customer details department"},"content":{"rendered":"

UK automobile service and parts seller Halfords has shared the details of its customers a little too freely, according to the findings of a security researcher.<\/p>\n

Like many, cyber security consultant Chris Hatton<\/a> used Halfords to keep his car in tip-top condition, from tires through to the annual safety checks required for many UK cars.<\/p>\n

In January, Hatton replaced a tire on his car using a service from Halfords. It’s a simple enough process \u2013 pick a tire online, select a date, then wait. A helpful confirmation email arrived with a link for order tracking. A curious soul, Hatton looked at what was happening behind the scenes when clicking the link and “noticed some API calls that seemed ripe for an IDOR” [Insecure Direct Object Reference].<\/p>\n