AliExpress patches account mass harvesting flaw

Global threads bazaar AliExpress, an offshoot of global tat bazaar AliBaba, has patched a URL flaw that allowed attackers to harvest users' personal details including names, shipping addresses and phone numbers. The insecure direct object reference vulnerability reported by an unnamed researcher affected 7.7 million logged-in …

[IT Hack]

Neither here nor there....

Lovely! Then again...Russian e-commerce site...

[Peter 26]

Re: Neither here nor there....

I'm pretty sure it's chinese... not that it is limited to any country...

I've seen a similar issue on Santander's online banking. Enter a sort code and account number for a standing order and it automatically filled in their account name for you! They fixed that one very quickly.

[(AMPC) Anonymous and mostly paranoid coward]

Re: Neither here nor there....

Tried to use the sister site Alibaba to order some computers. I was soon getting mails from people purporting to be the original supplier offering increasingly lower prices.

I was a bit suspicous and checked with the factory Global sales manager, who told me the mails were bullshit, because they don't do electronics, just clothing and textiles. Nice

Beware.

[Ole Juul]

Re: Neither here nor there....

I've used the site to get some very good buys. Yes, I get quite a few e-mails from them, but I don't look at that kind of stuff beyond to see where it's from. Anyway, AliExpress is a good place in my experience. They're part of Alibaba Group Holding Limited which, for those that don't shop on-line or get out much, is a Chinese company and very large by our western standards.

[Anonymous Coward]

Re: Neither here nor there....

AliExpress is most definitely Chinese. I use them to get repair parts for a variety of gear, replacement tablet screens being the latest. Pretty damn nice people (or ruthless managers, both?) making sure that I'm satisfied with the transaction at the end of the day. Way cheaper than sending the devices off to be repaired if you're up for this kind of thing. No customs, no shipping, no tax. For me (US, California), what's not to like?

[Winkypop]

I always thought it was "Open Sesame"

Seems it was: "Open AliExpress"

[Peter X]

Amazon resellers

I've not used AliExpress myself... but I have ordered a few very cheap things through Amazon resellers that have actually been shipped direct from China. Should I worry that perhaps these resellers just re-enter my shipping details (and potentially payment) on another site?

[TReko]

Credit card numbers too

A number of people have had their credit card numbers appear on carding forums after using AliExpress. No PCI rules in China.

[Peter 26]

Re: Credit card numbers too

That sounds unlikely considering they don't let you store your CC details with them. That's one of the most annoying things about aliexpress, no paypal and no stored CC. It's probably for the best, but it means you have to go find your card every single time...