MailChimp Found Leaking Email Addresses

itman · Jan 19, 2018

Sounds like real bad "monkey business" to me.

MailChimp, the bulk email company responsible for sending millions of newsletters, promotional mail and other mass communiques every day, has been leaking respondents’ email addresses.

Security researcher Terence Eden found what he termed “an annoying privacy violation,” adding that the issue can expose personal information. The issue is this: When a respondent clicks a link in a MailChimp email, the browser opens the link and sends the newly visited webpage what is known as a “Referer Header” (the misspelling is intentional).

“This says, ‘Hello new site, I was referred here by this previous website,’” said Eden, in a blog. “This has some privacy implications – the administrator of a website can see which website you were on. Usually this is fairly benign, but it can leak sensitive information.”

As part of generating these Referer Headers, when users receive an email from a MailChip mailing list, it generates a unique link that points to the newsletter or other piece of mail that was sent out, he explained, which are collated in logs that can be accessed by the site administrator. The link goes to the web version of a specific user's copy of the email, which means, at the bottom, there are links to change the email address as well as unsubscribe.

The unsubscribe link, when clicked, shows the user’s full email address.
Click to expand...

https://www.infosecurity-magazine.com/news/mailchimp-found-leaking-email/

Log in or Sign up

MailChimp Found Leaking Email Addresses

itman Registered Member

Log in or Sign up

MailChimp Found Leaking Email Addresses

itman Registered Member

Useful Searches