Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

Show NLP summaries collection recirc on article pages

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

Boeing delays spaceflight again as it continues to struggle with leak

These ISIS news anchors are AI fakes. Their propaganda is real.

Why this company’s biggest fans turned against it

Joey Gallo returns, but Nats endure another quiet offensive night

A taco will always be a taco — no matter what we call it

Walter Johnson’s jersey from 1920 showdown with Babe Ruth is up for auction

Did Trump’s lawyers catch Michael Cohen in a ‘lie’? Let’s take a look.

Now playing off-Broadway: Trump’s synchronized sycophants

Biden faces pressure to pardon ex-Baltimore prosecutor Marilyn Mosby

Biden continues outreach to Black voters; Trump heading to Minnesota

At campus protests, ‘DO NOT TALK TO THE MEDIA’!

CNN gets a presidential debate — and a much-needed win

With its energy network nearly destroyed, Ukraine already fears the winter

Mexican taquería’s new Michelin star puts street eats on par with gourmet food

IDF recovers bodies of 3 Israelis killed on Oct. 7

The world’s coolest hotels want to tell you a story

Cruise ships to return to Baltimore two months after bridge collapse 

Some cruise prices are about to get a little more clear

Trump promises tax cuts and fewer rules. CEOs shouldn’t fall for it.

Tariffs against China hamstring the transition to a clean energy future

The Post’s choices in Northern Virginia’s U.S. House primaries

Puppy abandoned with heart-rending note is adopted, named Minerva

Man, 91, shocks tiny firehouse with $500K gift: ‘Nobody knew how much I’d saved’

Retired cop meets abandoned baby he helped 23 years ago: ‘What are the odds?’

In photos: The scene in Houston after severe storms killed at least 7 people

D.C.’s secret garden

Best Places to Work in the Federal Government 2023

Ask Amy: Can’t a single woman eat alone without interruption?

Miss Manners: Miss Manners: Gag gift falls flat

Carolyn Hax: Is it weird to ask other people to care about you?

Trump

Big Tech news and how to take control of your data and devices

See more coverage in your recommendations

Technology

Tips delivered to your inbox twice weekly

The Tech Friend newsletter

Business and Tech alerts

On a recent Wednesday evening, a university professor in a large town in western Germany was preparing several paintings to be sold through the British auction house Christie’s. Using his iPhone, he took pictures of the inherited works at his home to upload to the company’s website. Within a few weeks, the site promised, Christie’s would give him an estimate of their value and tell him if it was interested in auctioning them.

But by uploading the images, he not only sent pictures of the pieces to Christie’s, he also revealed their exact location for anyone to see online, according to two German cybersecurity researchers. Hundreds of other would-be Christie’s clients, including Americans, were exposed to the same vulnerability, the two researchers, Martin Tschirsich and André Zilch, told The Washington Post.

The findings show how cybersecurity vulnerabilities aren’t just an issue for Big Tech companies, but for almost everyone as more and more business is transacted over the internet. As was the case with the professor, photos uploaded to Christie’s oftentimes include GPS coordinates for where they were taken; those coordinates are so precise that they reveal not just a street address but can even indicate within a few feet exactly where inside a building a photo was taken. “Around 10 percent of the uploaded images contain exact GPS coordinates,” the researchers said.

At the end of July, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned generally about the kind of vulnerability the German researchers found. “[These vulnerabilities] have resulted in the compromise of personal, financial, and health information of millions of users and consumers,” CISA<a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-208a" target=_blank> said in a joint statement </a>with the National Security Agency and the Australian Cyber Security Center, without referring explicitly to any developments at the auction house.

Christie’s, which says it’s committed to treating personal data with the utmost care and security but has also been criticized for offering anonymity to clients, declined to answer questions about or confirm the researchers’ findings. “We continuously assess our security safeguards, thoroughly address issues relating to the security of our clients’ information, and comply with our legal and regulatory obligations,” the auction house said in a statement.

The company seems to have taken steps to resolve the issue, according to the researchers, though only after being contacted about it by The Post. “It was only Tuesday when Christie’s appears to have implemented technical measures to close the vulnerability,” Tschirsich said. He said the researchers had informed Christie’s about the problem more than two months ago.

It is unclear if Christie’s has informed any of its clients about the security lapse. The German professor, who spoke on the condition of anonymity because he did not want to discuss a breach of his personal data that may have been easily accessible to everyone online, said Christie’s had not contacted him. He said he learned his artworks’ location had been made public from The Post. “Especially with a renowned house like Christie’s, I would not have expected that,” he said.

Tschirsich and Zilch say they had alerted Christie’s to what they called a “serious vulnerability” by the time the professor had uploaded his images. Messages viewed by The Post show they first told Christie’s of the vulnerability in June. An offer by the researchers to help resolve the difficulty was rejected by a Christie’s executive, according to records the researchers shared with The Post. “Thank you, but we do not require any advice or assistance,” the executive said, after confirming that the researchers’ findings had been forwarded to an internal security team.

“As cybersecurity researchers we were very surprised by this reaction,” Zilch said.

Some tech companies routinely pay a fee to researchers who reveal a vulnerability that on the black market could be worth an even higher prize. Larger companies also have what are called <a href="https://www.washingtonpost.com/technology/2021/09/09/apple-bug-bounty/" target=_blank>bug bounty programs</a> to incentivize cybersecurity researchers to report flaws that can lead to breaches. However, Christie’s does not appear to advertise such a program.

Tschirsich and Zilch say they were not looking for a bounty or a job from Christie’s, but just wanted the company to fix a vulnerability that put users at risk. Both for years have probed systems for vulnerabilities with the goal of reporting them to companies and organizations, often free of charge. In the past, the two have <a href="https://www.spiegel.de/netzwelt/gesundheit-so-kamen-hacker-an-einen-elektronischen-arztausweis-a-00000000-0002-0001-0000-000168667183" target=_blank>identified vulnerabilities</a> putting the health data of patients in Germany at risk. Tschirsich, together with other researchers, also <a href="https://www.reuters.com/article/germany-election-cyber-idUKL8N1LO54H" target=_blank>uncovered problems</a> in German election software that could have disrupted the counting of votes. Both problems were investigated  at no charge and fixed after the researchers warned the affected organizations about them.

The German researchers took a look at Christie’s after an acquaintance asked them about how secure its service was. “Unfortunately, it only took us a few minutes to come across this serious vulnerability,” Tschirsich told The Post. “The vulnerability is so simple that it can be exploited by anyone with a browser within a few minutes.”

Tschirsich said Christie’s lack of a quick response surprised him. “It actually takes only a few hours to temporarily close the vulnerability and two days to completely fix the problem,” Zilch said.

Member of the “Story Killers” investigative team that won the Online Journalism Award, 2023

Winner of the Otto Brenner Preis for investigative and data-driven reporting, 2022

Shortlist for Reporterpreis for feature stories, 2019

Max Hoppenstedt is an Arthur F. Burns Fellow with The Washington Post's tech desk.

Max Hoppenstedt

washpost

Security flaw at Christie’s exposed location data of artwork owners sought to sell

the-washington-post

Illustration by Elena Lacey/The Washington Post; iStock

The Washington Post

CHRISTIESSECURITY

Help Desk

Artificial Intelligence

Internet Culture

Space

Tech Policy

Tech

prism://prism.query/two-sites,/technology,/politics/powerpost/the-technology-202?limit=20