885 million records, one changed number in a URL
First American exposed mortgage documents because anyone could change a document number in the link.
Last week it emerged that First American, a big US title insurance company, had exposed about 885 million documents on its website: bank account numbers, Social Security numbers, mortgage records, going back to 2003. Anyone with a link to one document could change a number in the address and see someone else’s.
No login. No hacking tool. Just counting.
This kind of bug is called an insecure direct object reference, and it’s one of the most common ones I find:
- Every request must check that the logged-in user is allowed to see that specific record.
- Use random, unguessable IDs for documents and links, as an extra layer.
- Shared links should expire and require a login for sensitive files.
- Test it yourself: log in as user A and try to open user B’s things.