From an online article on news.com.au
"
A SECURITY flaw on Australia Post's website is putting customers' privacy at risk, with the company allegedly believing people were not smart enough to find the glitch.
The names and addresses of customers that use Australia Post's "Click & Send" service were being exposed by simply manipulating the website url.
The flaw could violate Australia's privacy code.
News Ltd was alerted to the problem by an Australia Post customer, Trent Bourne, a 23-year-old website administrator from Homebush, Sydney, who three times tried to alert the company about the problem.
"The first time they said `oh, our customers are not as smart as you so they will never find this glitch'," he said.
On the other two occasions Mr Bourne said his complaints were ignored.
The flaw is no longer accessible because Australia Post suspended the service after being contacted by News Ltd.
It had been found in the final stage of the Click & Send transaction. Once a user had logged into their account and created an item to send, they were required to print a label to stick on the parcel.
When that happened a pop-up window appeared containing the invoice transaction.
For a user's information to be exposed, all you needed to do was change the six digit shipping ID that could be found in the url that appeared along the top of the pop-up box to another random six digit number and hit enter. The page reloaded to reveal the name and address of another customer and the intended recipient of the parcel. Users needed only change one or two digits to access other customers' invoices.
The invoice also contained an article and reference number - which could be used to access credit card information stored within user accounts.
It was an easy process which News Ltd was able to replicate.
The glitch could not be used to target an individual, but provided a wealth of information through random searches.
Australia Post told News Ltd that the Click & Send service had "been temporarily suspended due to a system error".
"Customers who use the service have been notified via the online site," the spokesperson said.
"As a result, the site has been temporarily deactivated, as our team works to ensure the security of the system for all customers.
"We hope to have the service back up and running as soon as possible.
"Australia Post would like to reassure Click & Send customers that at no stage were their financial details compromised.
"Customers who wish to send parcels should visit their local Australia Post outlet who will assist them."
Australia Post said it had no record of Mr Bourne's complaint.
The Australian Information Commissioner has been contacted for comment."
