Yeh, I've just had one to, sadly I did purchase from them a DJI
Phantom 4 Pro + and paid £1725.00 for it, problem being they sent me a second hand one that some other customer had flown and used, horrible-horrible-horrible B******s, stay well away from them, forget the voucher it won't be worth the paper it's written on.
They have released many thousands of people private information mines included as with British Military Personnel there addresses and everything, Police also. They need to be booted out off the UK and not allowed to ever trade here again, they are an American outfit anyway it's just a postbox UK they are not even based here.
Security
Is it a bird? Is it a plane? No, it's a terrible leak of drone buyers' data
Tens of thousands of online shoppers' payment details left totally unencrypted
By
Gareth Corfield 6 Apr 2018 at 14:28
34 
SHARE ▼
Exclusive A popular drone dealership website left its entire transaction database exposed online with no encryption at all, revealing a host of purchases by thousands of police, military, government and private customers.
The DronesForLess.co.uk site was left wide open by its operators, who failed to protect critical parts of its web infrastructure from curious people, as spotted by Alan at
secret-bases.co.uk, who told
The Register.
We discovered more than 10,000 online purchase receipts had been saved to its web servers without any encryption or even password protection whatsoever – and the sensitive customer details in those receipts were exceptionally easy to access. Even your grandparents could have found it using Internet Explorer.
Details available for world+dog to browse through included names, addresses, phone numbers, email addresses, IP addresses, devices used to connect to the site, details of ordered items, the card issuer (e.g. Visa) and the last 4 digits of credit cards used to pay for goods.
Orders placed by police and military personnel included:
- A purchase of a DJI Phantom 3 quadcopter by a serving Metropolitan Police officer, delivered to the force's Empress State Building HQ in London, and made with a non-police email address composed of his unit's very distinctive abbreviation
- A British Army Reserve major who had an £1,100 drone posted to his unit's HQ
- A member of the Ministry of Defence's procurement division who bought a DJI Inspire 2, complete with spare battery and accidental damage insurance
- A member of the National Crime Agency, who appeared to have used his ***@nca.x.gsi.gov.uk secure email address to buy a Nikon Coolpix digital camera
It was unclear whether these purchases were for personal or governmental use.
Other orders seen by
The Reg include ones placed by: staff from privatised defence research firm Qinetiq; the UK's Defence Science and Technology Laboratory's radar R&D base at Portsdown Hill; the Brit Army's Infantry Trials and Development Unit; UK police forces up and down the country; local councils; governmental agencies; and thousands more orders placed by private individuals.
Many were for cameras and other optical gear as well as drones, reflecting the network of branded e-commerce sites that Drones For Less forms a part of.
Infosec researcher Scott Helme told us: "From a technical perspective having this kind of information in a publicly accessible directory is incredibly negligent. This information should be stored in a database and most certainly should not be available to the internet and stored in plain text!
"At a minimum the company involved need to contact all of the affected customers and inform them what data has been leaked so that they can take whatever steps they deem necessary, even if that’s just so they can be vigilant for potential phishing emails. I hope that the ICO will also take action against the company for such a negligent leak of personal information."
About that UK web address...
Drones For Less gives a London Mailboxes ETC shop (effectively a PO box number) as its postal address, and an 0203 SIP number – which can be configured to forward calls anywhere in the world – as a contact telephone number.
We first called it to report the breach to the site's operators on 2 April. After being invited to hold by a cheery North American-accented auto-answer message, we got through to a customer support rep who introduced himself as John. He also had a distinctly North American accent. John asked us to email him details of the breach. We did this and asked repeatedly for a statement from the firm, to no avail.
Repeated followup phonecalls resulted in John sending us the email addresses of others within Drones For Less, inviting us to ask them for a comment, which we have done.
The dronesforless.co.uk domain name is registered to a company calling itself Mapleleafphoto LLC. The address – 2 Toronto Street, Toronto, Canada,
as a Nominet Whois lookup shows – is a UPS shop, so is effectively another anonymous PO Box forwarding address.
A superficially similar website called Mapleleafphoto.ca gives a Quebec contact address which appears to lead to an industrial unit in that city.
The Drones For Less operator appeared, earlier this week, to be playing whack-a-mole with individual links to samples of the breached data we sent to him, taking those down but not others. Following sustained pressure, it now appears, to the best of
El Reg's ability to confirm, that the data has been removed from public view.
Drones For Less appears to be closely related to Cameras For Less, Video For Less and Tablets For Less, judging by house adverts on its Contact Us page.
A spokeswoman for the British government sent us a statement:
We treat the security of our information very seriously. We have asked the company involved to remove any public record of this data and to let all those affected know.
The UK Information Commissioner's Office and Canada's Office of the Privacy Commissioner are both aware of the breach. ®
)
