It’s possible to hack UPS tracking numbers to monitor other people’s iPad orders, consultant Stephen Foskett has discovered.
If you have a genuine iPad tracking number, you change the last two digits to get valid tracking numbers for other people’s iPad orders. I just checked, and I’m glad to see I’m not the only one with an iPad on a slow plane from China.
Here’s how the UPS tracking number breaks down, according to Foskett:
… the standard UPS format is “1ZAAAAAATTIIIIIPPC”, where AAAAAA is the account, TT is the service type, IIIII is the invoice, PP is the package, and C is the check digit. These numbers are not encrypted or at all random, and CodeProject has a complete decoding method.
To hack the tracking number, you increase the last number by one (the checksum), while decreasing the penultimate number by one (this is the last digit of the package number).
So if your package number ends in “63,” you can substitute “54,” “45,” “36,” “27,” and “18” to get valid tracking numbers for five more packages.
The hack works — I just tried it. I can now follow iPad packages going to Manchester Center, VT; Inverness, IL; Waverly, MN; Bridgewater, NJ; and Saint Louis, MO.
To make sure the packages are iPads, check the origin location (Shenzhen, CN) and weight (1.4Kgs).
Foskett suggests the hack could be exploited by analysts trying to figure out how many iPads Apple shipped this week. He thinks it could also reveal how many people are ordering two iPads, and the distribution of customers around the country.
UPS Tracking Hack Can Reveal iPad Orders and Destinations