Technical Advisory – ParcelTrack sends all pasteboard data to ParcelTrack’s servers on startup
ID: ed96b1a4-4acd-5c04-bd38-37329cfadf9d
STIX ID: report--ed96b1a4-4acd-5c04-bd38-37329cfadf9d
Feed Name: NCC Research
Threat Score
**Executive Summary:** ParcelTrack versions 3.3 on Android and iOS indiscriminately read the device clipboard/pasteboard at app startup and send its contents to ParcelTrack servers via an HTTP GET request, risking exposure of sensitive PII (e.g., credit card numbers, passwords); NCC Group disclosed the issue and ParcelTrack released fixes in version 3.4—users should upgrade.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.