{"id":568939,"date":"2024-11-08T07:03:33","date_gmt":"2024-11-08T05:03:33","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=568939"},"modified":"2024-11-12T16:29:33","modified_gmt":"2024-11-12T14:29:33","slug":"security-flaws-in-sixty60-driver-system","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/568939-security-flaws-in-sixty60-driver-system.html","title":{"rendered":"Security flaws in online recruiting system for Sixty60 delivery drivers"},"content":{"rendered":"\n

An online application system to become a Checkers Sixty60 driver contained a security vulnerability that allowed users to view the personal information of other applicants.<\/p>\n\n\n\n

Sixty60’s drivers work for Pingo Delivery, a 50-50 joint venture between Shoprite and RTT Logistics.<\/p>\n\n\n\n

A concerned tech-savvy MyBroadband reader who was curious about the Sixty60 driver registration process discovered poorly configured recruitment website with significant security vulnerabilities called drive4pingo.co.za.<\/p>\n\n\n\n

Shoprite told MyBroadband that the website was run by a third-party recruitment service provider.<\/p>\n\n\n\n

“Within just 10 minutes, it became clear that there were serious data security issues,” the reader said. <\/p>\n\n\n\n

“I discovered a publicly accessible Django instance with debug mode enabled, along with hardcoded authentication credentials within the JavaScript.” <\/p>\n\n\n\n

“The web application was poorly configured and built with no apparent consideration for web security standards.”<\/p>\n\n\n\n

“This misconfiguration exposes sensitive application settings, internal information, and personal data.” <\/p>\n\n\n\n

The personal data he was able to view included the full names, phones numbers, dates of birth, email addresses, physical address, and ID, passport or permit numbers of applicants.<\/p>\n\n\n\n

In addition, they could see the applicants’ selfies, clothing and shoe sizes, and copies of their motorcycle licences and ID documents. <\/p>\n\n\n\n

The reader shared redacted records of the online applications submitted on the platform.<\/p>\n\n\n\n

The information included 243 pages consisting of 15 applications each, working out to 3,645 application sets. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Quick reaction from RTT<\/h2>\n\n\n\n

The reader said he initially contacted Pingo to report the problem but did not receive a response.<\/p>\n\n\n\n

After getting in touch with RTT’s chief technology Rudi Keet, the information was forwarded to the relevant people within Pingo. <\/p>\n\n\n\n

The reader recommended that the application website be taken offline immediately and that the Django debug mode on the production server be disabled.<\/p>\n\n\n\n

They also advised Pingo to remove the hardcoded credentials from the client-side JavaScript, secure them properly, and ensure that they are changed. <\/p>\n\n\n\n

Shortly after reporting the vulnerability, the application portal was offline. <\/p>\n\n\n\n

Attempting to visit the website at the time of publication presented a “This site can’t be reached” error.<\/p>\n\n\n\n

Contacted for comment, Shoprite confirmed that a concerned citizen made Pingo aware of the potential vulnerability on Friday, 25 October.<\/p>\n\n\n\n

“The website was taken down immediately,” Shoprite said. <\/p>\n\n\n\n

“Pingo will support the third-party service provider with any information as required by the Information Regulator.”<\/p>\n\n\n\n

RTT and Pingo did not provide feedback by the time of publication.<\/p>\n\n\n\n

Pingo under scrutiny <\/h2>\n\n\n\n

Shoprite is currently in discussions to acquire RTT’s stake in Pingo after the Competition Commission approved a takeover of the highly successful platform in September 2024<\/a>.<\/p>\n\n\n\n

This is not the first time Pingo’s treatment of Sixty60 drivers has drawn scrutiny.<\/p>\n\n\n\n

There have been mounting concerns about the conditions under which Sixty60 drivers are acquired to work.<\/p>\n\n\n\n

Recently, a Sixty60 driver contacted MyBroadband and described the platform’s controversial hiring and firing rotation process<\/a>.<\/p>\n\n\n\n

According to the driver, Pingo periodically activated and deactivated drivers’ accounts based on driver oversupply and order demand.<\/p>\n\n\n\n

Due to this approach, drivers who were randomly blocked would be unable to earn income on certain days. <\/p>\n\n\n\n

The cycle allegedly ended with about 15 drivers being dismissed by Pingo, something which would happen twice a year. <\/p>\n\n\n\n

Shoprite said that it only blocked drivers if they violated their service contract.<\/p>\n\n\n\n

Pingo was also accused of increasing shifts from nine hours to more than 12 hours per day.<\/p>\n\n\n\n

Rejecting an order would result in a driver being blocked from the app. <\/p>\n\n\n\n

Drivers earn about R7,600 per month before deductions for the motorcycle rental and fuel expenditure, which leaves them with about R2,800 in net monthly earnings.<\/p>\n\n\n\n

After Pingo scrapped a minimum daily earning fee of R350, drivers went on strike.<\/p>\n\n\n\n

When the driver went to address the issue with a person from Pingo’s head office, their motorcycle was loaded onto a truck, and they were blocked from the app.<\/p>\n\n\n\n

Pingo did not provide feedback to the driver on why their account had been blocked and motorcycle confiscated. It also never responded to MyBroadband’s query about the issue.<\/p>\n\n\n\n

The driver also alleged that they and a fellow driver made up half of the South Africans in a 30-driver team who had taken issue with the scrapping of the minimum earning fee.<\/p>\n\n\n\n

That seems to support previous allegations by popular South African Twitter\/X account Goolam, who suggested that over 99% of Pingo’s drivers were foreign nationals. <\/p>\n","protected":false},"excerpt":{"rendered":"

A MyBroadband reader found that a website used to recruit Sixty60 drivers is poorly configured, which could have resulted in users being able to see extensive personal information on applicants.<\/p>\n","protected":false},"author":341042,"featured_media":500381,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[71290,26872,75170,97646,97098,97099,49767,12679,24160,62188],"class_list":["post-568939","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-checkers-sixty60","tag-data-breach","tag-data-exposure","tag-pingo","tag-pingo-delivery","tag-rtt-logistics","tag-security-vulnerabilities","tag-shoprite","tag-shoprite-checkers","tag-sixty60"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/568939"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/341042"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=568939"}],"version-history":[{"count":16,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/568939\/revisions"}],"predecessor-version":[{"id":569758,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/568939\/revisions\/569758"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/500381"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=568939"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=568939"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=568939"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}