Feeds

Wanadoo in customer data security flap

Index browsing exposure uncovered

Secure remote control for conventional and virtual desktops

UK ISP Wanadoo has fixed a serious security problem that exposed the account information of many of its subscribers.

The flaw arose because its web servers were incorrectly configured, thereby allowing users to view the contents of an entire folder instead of just an index web page.

Because of this index browsing flaw, it was possible for snoops to uncover the real name, user name, password, email address, and web space sub domain of listed customers from the affected account recovery system web servers. No authentication would have been required to retrieve this data.

Postings on a Wanadoo user forum suggest the issue has existed for more than two years. However, there is no evidence that it has been exploited by hackers.

After the flaw came to light last weekend, Wanadoo acted to investigate the problem and roll out a fix.

In a statement, the ISP said: "Wanadoo can confirm that a small number of links to files containing customer details have been posted on the internet. Wanadoo would like to reassure customers that this was an isolated incident and as soon as we were made aware of the problem, the information was removed from the public domain.

"We are alerting those customers involved, advising them to change their password details. Our customers’ security is paramount and we take this situation extremely seriously. An investigation is currently taking place to uncover how this happened and ensure that this does not happen again." ®

Remote control for virtualized desktops

Whitepapers

Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
The total economic impact of Druva inSync
Examining the ROI enterprises may realize by implementing inSync, as they look to improve backup and recovery of endpoint data in a cost-effective manner.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Business security measures using SSL
Examines the major types of threats to information security that businesses face today and the techniques for mitigating those threats.