A Comcast Security Flaw Exposed Millions of Customers’ Personal Information
The address exposure vulnerability is really, really bad. Just about anyone was able to impersonate another Comcast customer by sending their home IP address in the X-Forwarded-For header to Comcast's device activation page, and easily see a masked version of their address (first number of street number and partial street name; street name is trivial to figure out with IP geolocation, street number would need some trial and error).I wonder how many Comcast customers were doxed with this method before it was fixed.