Netflix Leak Sensitive Data with Cookie SNAFU

irving Peon

Messages:: 65

Likes Received:: 2

Best Answers:: 0

Trophy Points:: 0

#1

Hey folks - Netflix rolled out some code over the Labor Day weekend that caused various login problems. They set up a url to clear user cookies, after which the problems seem to go away. The problem is that issues were not just related to users being unable to log in. Users were also switched to other users' accounts, gaining complete control of the accounts, including viewing partial credit card numbers, address and email information, and gaining access to the account cancellation screen.

A more indepth version with screenshots is available at http://www.xyclopsoft.com/blog/2012/09/03/netflix-cookie-error-reveals-private-information/, quotes from that article here:

I called Netflix (using the service code from the account I do not own) to let them know what was going on, and to find out how much they knew so far. As anyone who has worked with cookies knows, it can seem like it is a pain in the behind to run any kind of forced cookie refresh method (though technically it is possible, and actually pretty simple, so I have to wonder why they are not doing this), so instead Netflix are directing people who are â€œhaving trouble logging inâ€ to visit http://netflix.com/clearcookies which will apparently solve this problem. You know, aside from the fact that they just gave out your info to strangers.

â€œWe made some changes to the website over the weekend,â€ said the call center phone jockey, â€œand while we had some problems yesterday the weird stuff didnâ€™t start happening until a short while ago, when people started complaining they were logged into the wrong account. At first, we though they were confused, but as time has gone on weâ€™ve realized this is a real and serious problem.â€ All the more serious because, as of the time I called, they still had â€œno idea why this is happening.â€
Click to expand...

Digging deeper, the problem became much more troubling. I had access to the last 4 digits of this fellowâ€™s credit card. I had his full address. I had his name, and his hotmail email account. I doubt it would be too hard to gain access to his email account with just that information. If I had an inclination to do so, and I found it too difficult, I could always send him an email or write. If I felt it was too urgent, there was always the option of a whitepages search for his phone number. Presumably, this also meant that the details on our account were up for grabs. Wonderful.
Click to expand...

I feel like I'm going to have to cancel my account. This is just way too bad a security lapse. Am I overreacting? Thoughts?