A security researcher discovered that goHardDrive, a used hard drive retailer, was exposing thousands of customer records through an insecure RMA status check system. The vulnerability allowed anyone to access customer names, addresses, emails, and order details by simply guessing sequential RMA numbers. Despite initial
Table of contents
The leak 🔗︎Scale of leak 🔗︎goHardDrive’s attempted fix 🔗︎goHardDrive removes RMA status checks entirely 🔗︎Bug bounty 🔗︎Timeline 🔗︎Sidenote: Leaks aside, this is a terrible return process 🔗︎Sort: