{"id":160,"date":"2010-03-23T16:05:01","date_gmt":"2010-03-23T23:05:01","guid":{"rendered":"http:\/\/www.infosecurity.pro\/?p=160"},"modified":"2019-04-20T16:26:20","modified_gmt":"2019-04-20T16:26:20","slug":"durex-condom-online-data-breach","status":"publish","type":"post","link":"https:\/\/www.infosecurity.pro\/?p=160","title":{"rendered":"Durex Condom Online Data Breach"},"content":{"rendered":"

\t\t\t\tOn 5th March 2010, I discovered a data breach on the Durex India website Kohinoor Passion. I had earlier ordered Durex products off their estore, and my order had arrived by courier in a nondescript shipping package as promised. Later, I passed an eye over the invoice enclosed with my order. I noticed that it appeared to have been printed off a website, since the url of the website was printed at the bottom of the invoice. Since my computer was switched on and connected to the internet at the time, I idly entered the url in my browser, and received a surprise when my invoice came up on screen, looking exactly as printed – showing my name, contact information, products ordered and amount invoiced.<\/em>\nI considered that my login to the Durex estore might still have been alive from my shopping session, and so tried again after clearing my browser history, cache and cookies. For good measure, I even restarted my computer. I could still access my invoice online.<\/em>\nNow my curiosity was piqued. I noticed that my order number was part of the url, and so randomly changed this number. To my amazement, another invoice came up, with the order details of someone else who had ordered Durex products online at the estore.<\/em>\nEach Durex estore invoice looks something like this:\n\"\"<\/a>\nNow replace the billing and shipping details with actual online shoppers’ names, postal and email addresses, and phone numbers, and you’ll realize the enormous amount of information that was at an unsecured location, freely available to anyone with a connection to the internet. (The main admin page http:\/\/www.kohinoorpassion.com\/admin\/ required a username and password, but apparently the subpages didn’t.)<\/em>\nI immediately starting emailing the following people (using my real name and email address) informing them of the breach:<\/em>\n13:39\u00a0\u00a0\u00a0 TTK-LIG Customer Service (TTK-LIG is the marketer of the Durex brand in India)\n14:49\u00a0\u00a0\u00a0 SSL International Open Door (SSL is the owner of the Durex brand worldwide)\n20:22\u00a0\u00a0\u00a0 Lisa Caton, Consumer Relations Manager at SSL (I received a vacation response)\n20:29\u00a0\u00a0\u00a0 Garry Watts, Chief Executive at SSL\n20:50\u00a0\u00a0\u00a0 Paul Doherty, Head of Corporate Affairs at SSL\n20:54\u00a0\u00a0\u00a0 Consumer Relations at SSL<\/em>\nWhen I went to bed, the data breach was still active, and more invoices seemed to have been added that day.<\/em>\nWhen I checked the next morning, the website had been modified, and any direct invoice access attempts redirected to the admin login page. Although I appreciated the speed taken to solve the problem, especially on a weekend, it is anyone’s guess how long the data breach was active before I discovered it, or how many customer records were accessed in that time from unauthorized locations.<\/em>\n\n\n

FAQs<\/h3>\n\n\n\n\n
\n\n\n
Q. Did you hack into the Durex customer database?<\/strong><\/div>\n\n\n\n\n
A.<\/strong> No, the Durex customer database was freely available online. I neither had to guess<\/a> a username and password, nor did I have to spoof<\/a> my IP address or use any other tricks<\/a> to access the invoices online.<\/div>\n\n\n\n\n
\n<\/strong><\/div>\n\n\n\n\n
Q. What was the date range of invoices you could access?<\/strong><\/div>\n\n\n\n\n
A.<\/strong> The earliest invoice I noticed had been issued on 23-Feb-2009. That means a range of 376 days before 6-Mar-2010, the date the breach was plugged.<\/div>\n\n\n\n\n
Q. Does that mean the data breach was active for 376 days before you discovered it?<\/strong><\/div>\n\n\n\n\n
\n\n\n
A.<\/strong> I don’t know. By some coincidence, the breach could <\/em>have opened up just a few minutes before I tried accessing the website on 5-Mar-2010, maybe as an accidental result of a website maintenance happening at that very instant<\/em>. However, that possibility seems unlikely. TTK-LIG and SSL are the right people to answer this question, since they have access (I hope) to their website change logs.<\/div>\n\n\n\n\n
\n\n\n
Q. Yikes! I just looked through my records and notice that I have an invoice issued in the date range mentioned. Did someone other than SSL or TTK-LIG access it?<\/strong><\/div>\n\n\n\n\n
A.<\/strong> I have no idea, since I do not have access to the kohinoorpassion.com website logs. What is quite certain though, is that your invoice was publicly accessible on the internet for some amount of time, and in that duration anyone could have\u00a0downloaded\u00a0it easily.<\/div>\n\n\n\n\n
Q. I haven’t bought any Durex products, but I did buy Kohinoor products online. Could my information have been compromised, too?<\/strong><\/div>\n\n\n\n\n
A.<\/strong> Since both Durex and Kohinoor likely use the same admin website, it is possible that your details were made public too. Please contact TTK-LIG regarding this, and update me if they reply.<\/div>\n\n\n\n\n
Q. After you brought the breach to the notice of Durex, have they made the site completely secure?<\/strong><\/div>\n\n\n\n\n
A.<\/strong> Since I am not a data security expert, I cannot comment on this. The admin section of the site (which contains the customer information) is still on the internet, though it now requires a username and password to access. The logic behind choosing this (arguably low) level of security needs to be questioned. Studies<\/a> have<\/a> shown<\/a> that it is statistically not tough to guess someone’s password.<\/div>\n\n\n\n\n
Q. Who can I contact to express my concern regarding this breach?<\/strong><\/div>\n\n\n\n\n
A.<\/strong> The Contacts<\/a> page has a list of some people you can write \/ email \/ call \/ fax.<\/div>\n\n\n\n\n
Q. Who are you?<\/strong><\/div>\n\n\n\n\n
A.<\/strong> I am a customer of the Durex India estore, whose records have been compromised by this data breach. Beyond that, I have no desire to reveal anything more about myself.<\/div>\n\n\n\n\n
\n\n\n
Q. Why create this website? What do you want?<\/strong><\/div>\n\n\n\n\n
A.<\/strong> I’d like an unconditional apology from TTK-LIG Limited or SSL International plc, for being negligent with my personal data.<\/div>\n\n\n<\/div>\n\n\n\n\n
Q. What will you do with the data that you could access from the Durex website?<\/strong><\/div>\n\n\n\n\n
A.<\/strong> I will not share the personal data with anyone <\/em>for any<\/em> reason, period. Also, I will not contact anyone in the list personally, unless they contact me first. Once SSL and\/or TTK-LIG contacts all us affected customers and releases an apology and\u00a0statement that\u00a0addresses all concerns\u00a0satisfactorily, I will delete all traces of the data from my system.<\/div>\n\n\n\n\n
Q. I am an affected customer too. Since you know about me now, I’d like to know more about you, too.<\/strong><\/div>\n\n\n\n\n
A.<\/strong> That’s a fair argument, but with such a large number of affected customers out there, I cannot risk letting my identity be leaked by any one of them, and soon becoming public knowledge. I have a long career ahead of me, and do not want to spend it being known as the person who blew the whistle on Durex.<\/div>\n\n\n\n\n
Now if my identity becomes public for any reason, I will know that someone at SSL or TTK-LIG is responsible, since they are the only people who know who I am. And that<\/em> will be a far more serious incident than an unintentional release of information (I’m guessing and hoping this data breach is unintentional).<\/div>\n\n\n<\/div>\n\n\n\n\n
\n\n\n
Q. Why is this such a big deal?<\/strong><\/div>\n\n\n\n\n
A.<\/strong> Besides the obvious, Durex had\u00a0posted a privacy policy on their website, which I went through repeatedly before placing my order. The privacy policy begins by stating:<\/div>\n\n\n\n\n
“When you visit the Durex website you may be asked to provide personal information, such as your name, mailing address, email address, telephone number, and other personal information. SSL International plc, the owners of the Durex brand, will ensure the privacy, safety and security of this information.”<\/em><\/div>\n\n\n\n\n
Clearly, SSL International plc has not done a very good job of ensuring.<\/div>\n\n\n\n\n
If SSL believes that it is not responsible for TTK-LIG’s mess-ups, they should navigate through the Durex website<\/a> and notice how it seamlessly leads to the Durex India estore, keeping the Durex brand consistent, and without any warning that the user was entering an area where SSL policies were not applicable. In any case, TTK-LIG (the operator of the India estore) has posted its own privacy policy on the Durex India website, which states:<\/div>\n\n\n\n\n
“Under no circumstances will user information be shared in any manner with external organizations for any reason whatsoever except to the group companies of TTK-LIG Limited for use for purposes stated herein.”<\/em><\/div>\n\n\n\n\n
\n<\/em><\/div>\n\n\n\n\n
Q. You dumb nut, don’t you know better than to order products of a sexual nature online? Especially in India, a country not<\/a> really<\/a> known<\/a> for<\/a> upholding privacy<\/a> values<\/a>?<\/strong><\/div>\n\n\n\n\n
A.<\/strong> I know, I know.. I am not the sort of person to shy away from visiting a chemist. However, a lot of products on the Durex estore are not commonly available at chemists. I know this, because I have specifically asked for them at multiple stores. After looking at the Durex India website a bunch of times over many months, and learning more about the available products, order process and privacy policy, curiosity finally got the better of me and I went ahead and ordered. Chalk it up as yet another of the dumb things that people will do for (good and safe) sex.<\/div>\n\n\n\n\n
Also, hindsight is 20\/20 (or, since we follow metric in India, 6\/6)<\/div>\n\n\n\n\n
Q. Will you still buy Durex?<\/strong><\/div>\n\n\n\n\n
A.<\/strong> Yes, I believe they make the\u00a0best\u00a0available-in-India\u00a0products\u00a0in their market segments. I just hope they make their entire\u00a0product\u00a0range widely available in stores, since I will be very reluctant to buy them online now.<\/div>\n\n\n<\/div>\n\n\n<\/div>\n\n\n<\/div>\n\n]]>\t\t<\/p>\n","protected":false},"excerpt":{"rendered":"

\t\t\t\t\t\t<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"amazonpipp_noncename":"","amazon-product-isactive":"","amazon-product-single-asin":"","amazon-product-content-location":"","amazon-product-content-hook-override":"","amazon-product-excerpt-hook-override":"","amazon-product-singular-only":"","amazon-product-amazon-desc":"","amazon-product-show-gallery":"","amazon-product-show-features":"","amazon-product-newwindow":"","amazon-product-show-list-price":"","amazon-product-show-used-price":"","amazon-product-show-saved-amt":"","amazon-product-timestamp":"","amazon-product-new-title":"","amazon-product-use-cartURL":"","amazon_featured_post_meta_key":"","_amazon_featured_alt":"","amazon-product-template":"","footnotes":""},"categories":[66,64,65],"tags":[],"class_list":["post-160","post","type-post","status-publish","format-standard","hentry","category-breaches","category-risks","category-vulnerabilities"],"_links":{"self":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/160","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=160"}],"version-history":[{"count":1,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/160\/revisions"}],"predecessor-version":[{"id":8336,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/160\/revisions\/8336"}],"wp:attachment":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=160"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=160"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=160"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}