Would you mind paste-binning/gist/posting the script? I'd be interested in seeing exactly how easy it was. I was playing around with the site last night but couldn't get anywhere.

I've posted a full writeup here: https://www.robertxiao.ca/hacking/locationsmart/

Was this in any way protected or did you just watch network requests in your browser, see an endpoint, and curl it? I'm not diminishing your discovery, just wondering if it was utterly trivial to use...

I modified a request in a fairly predictable way and bypassed the consent stage. See the full writeup here: https://www.robertxiao.ca/hacking/locationsmart/

Thanks for the write up!

All I can say is wow.

I was going to poke around that site yesterday after I saw the article, because looking at their website it really looked like there had to be some vulnerabilities. What you tried is exactly the kind of thing I would have looked at first.

Yep, there’s no way you’re the first to find this. Honestly I’m at a loss for words how absurd this is. We just need to assume this was actively exploited for who knows how long.

I definitely do not assume that I'm the first to find this, only the first to actually get it taken down. Worse, as the try site's been up since at least Jan 2017, that's nearly 18 months of exposure.

We won't know what the real exposure level was unless someone asks LocationSmart very persuasively.

Anybody know a EU citizen in the US who'd be prepared to request how often their data's been accessed using the GDPR regs?

I highly doubt they even know.

Ideally, they have access logs (for the web API, their backend location requests, or both) that could be used to detect patterns of misuse. Unfortunately, since their API is exclusively POST, the web server access logs will be less useful, but they could be used to detect e.g. direct API queries that skip the consent request.