[LINK] Richard re corporate security

[stephen at melbpc.org.au]

Richard writes,

> .. working fine ..  Richard C

As are you, Richard .. sixteen good articles this week ..

http://search.theregister.co.uk/?author=Richard%20Chirgwin

And for eg this breaking news item was very well researched, in the
short time frame available for all very concerned Telstra customers
to log-in and change passwords .. 

http://www.theregister.co.uk/2011/12/09/telstra_opens_customer_database_in
_egregious_blunder/  (snip)

"Telstra shutters customer self-service site after security blunder

Passwords? We’ve heard of them"

By Richard Chirgwin. Posted in Security, 9th December 2011 23:11 GMT

Several sharp-eyed readers have pointed El Register to the latest 
corporate security howler in Australia: Telstra’s customer self-service 
site has had to be shut down after it sprayed sensitive customer data to 
the world at large.

First reported on the Australian broadband discussion site Whirlpool 
(original post here).. the potentially-massive breach allowed an Internet 
user to bypass the front-page security of the BigPond self-help site and 
access details of other users.

The exposed site offered customer service-level access to customers of 
Telstra bundled products. Information accessible included a veritable 
feast for identity theft: bundle information, telephone numbers, users’ 
names and addresses, and according to the Whirlpool discussion, users’ 
login and password information.

The Register cannot verify the extent of the breach, because once it 
became aware of the issue, Telstra barred access to the site 
(incidentally interrupting BigPond users’ access to Webmail).

The site is not actually hosted on a Telstra domain: it’s a cloud-based 
service on the custhelp.com domain operated by RightNow Technologies, 
which is currently in the throes of being acquired by Oracle. The 
Register has sought comment on the incident and is awaiting a response.

As The Australian notes, the serious privacy breach could affect a very 
large number of customers, with more than 650,000 new bundle customers 
sold last year. Australia’s Privacy Commissioner is investigating.

Telstra has stated that it will contact customers, but at the time of 
writing, this process did not seem to have begun. ®

Update: A reader has advised The Register that Telstra's BigPond POP and 
SMTP servers are currently offline. Although not on the affected RightNow 
servers, since customer logins may have been compromised, Telstra has 
probably taken services down as a precaution.

The carrier's status page states that "some online services remain 
unavailable as a precaution".

A Telstra spokesperson has stated on Twtter that as many as 60,000 
customers "will need password resets to reduce risk from privacy breach" 
(sic). This suggests the carrier has assessed the logs of its customer 
self-service portal and has an estimate of how many accounts may have 
been compromised. ®

--

Message sent using MelbPC WebMail Server