Feeds

Serious security slip at BTOpenwoe

Credit card details unprotected

  • alert
  • submit to reddit

Build a business case: developing custom apps

Due to a serious security lapse, users signing up to BTOpenworld's ADSL service have been invited to send credit card details over an insecure internet connection.

A vulture-eyed Register reader, who tried to sign up to the telcom giant's domestic version of BTOpenworld, noticed he was invited to submit his credit card details over an insecure http connection. He had been trying to register for the home 500 service. He also discovered that orders for the broadband service submitted over the phone were input by BT's operators using the same insecure web page.

Unlike https (Secure Hypertext Transfer Protocol), which uses Secure Socket Layer to encrypt traffic between a server and client devices, http uses no security protection. As a result users who registered for the service allowed their credit card details to be transmitted in the clear - making it relatively straightforward for crackers to obtain those details.

The registration process also involved users submitting confidential personal details, such as home address, phone number and even a suggested email password, in an insecure manner.

A BT spokesman admitted the telco had made a serious security error but confirmed that the problem has now being fixed. He said the security and privacy gaff had happened during the process of upgrading the design of the Openworld site last Thursday.

"This issue, which affected only one of the products on offer, happened due to human error and has now being fixed. BT would like to apologise to its customers for this undesirable lapse in security," he said.

He added that a "thorough review and investigation of the incident" will be undertaken by BT into the incident.

Earlier this afternoon when we tried to register with the home 500 service, which involves a 500Kbps broadband connection for a set up fee of £150 and monthly rental of £39.99, we found it to be insecure. However by 15.30pm GMT, after the issue was notified to BT, a secure sign-up procedure was in place.

Wayne Sowery, technical director at security consultancy MIS Corporate Defence, said that whilst the vulnerability was in place in would have been "viable" for hackers to redirect traffic away from the Openworld site using an attack on DNS servers. Since http traffic can be cached there was a chance another user could see the details submitted, he added.

Sowery added the problem was doubly embarrassing for BT because through Trustwise BT was a provider of digital certificates, the very technology it had not implemented in this case. ®

To see a full-size screen grab of the insecure BTOpenworld registration page click the image below.



Related stories
BT wants Openwow not to Openwoe
BT's ADSL roll-out hits snags
BTopenworld security glitch reveals thousands of customer names

Related Link

BTopenworld

Build a business case: developing custom apps

More from The Register

next story
Sysadmin Day 2014: Quick, there's still time to get the beers in
He walked over the broken glass, killed the thugs... and er... reconnected the cables*
Auntie remains MYSTIFIED by that weekend BBC iPlayer and website outage
Still doing 'forensics' on the caching layer – Beeb digi wonk
Microsoft says 'weird things' can happen during Windows Server 2003 migrations
Fix coming for bug that makes Kerberos croak when you run two domain controllers
Cisco says network virtualisation won't pay off everywhere
Another sign of strain in the Borg/VMware relationship?
VVOL update: Are any vendors NOT leaping into bed with VMware?
It's not yet been released but everyone thinks it's the dog's danglies
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.