Feeds

MI5 security alert finally runs on secure server

Rush job patched up

Combat fraud and increase customer satisfaction

MI5's terror status mailing list has been made a little more secure even though the service has still not been moved onto a fully secure UK government-run infrastructure.

The service, launched by MI5 last Tuesday, is designed to allow subscribers to receive email notification of changing national security threat levels by email.

But an investigation by privacy website Spyblog showed it was sending web subscription forms to the US without encryption. Initially, data submitted to the list was wide open to snoopers.

The subscription system has been changed so it no longer uses the WhatCounts.com services in the USA and so it uses SSL links to submit data to web servers based in the UK. These servers are being run by a private firm called MailTrack and not the UK government. The mailing list was modified late on Friday from its "shambolic" early version, SpyBlog reports.

"The email list subscription service no longer seems to send your personal data to the USA in an unencrypted format, but it is still not being hosted entirely on secure UK Government IT infrastructure. However, signing up this way no longer gets you an email confirmation immediately, you will now have to wait 'a few days'," SpyBlog told El Reg.

The set-up of the system, even ignoring the delay in processing data, is far from ideal, however. Submitted web forms are processed at a site called https://mi5.h0st.biz/xdata.html, which looks suspiciously like a phishing site, but was legitimately registered by MailTrack.

SpyBlog's assessment that the service was established as a "rush job" is supported by emails received by El Reg suggesting that British defence technology company QinetiQ was only informed about plans to launch the service on Monday, 8 January - only a day before the email alert service went live in an insecure format.

Even though changes have been made to improve this somewhat, the affair leaves a number of questions unanswered, as SpyBlog notes, not least who authorised the list to go live without rudimentary security precautions.

More on the aftermath of this web security shambles can be found here. ®

3 Big data security analytics techniques

More from The Register

next story
EU: Let's cost financial traders $400m a day, because EVIL BANKERS. Right?
Wait 'til this one hits your pension fund where it hurts
Systems meltdown plunges US immigration courts into pen-and-paper stone age
Massive outage could last four weeks, sources claim
RIP net neutrality? FCC boss mulls 'two-speed internet'
Financial fast track to replace level competitive playing field, report claims
Lavabit loses contempt of court appeal over protecting Snowden, customers
Judges rule complaints about government power are too little, too late
UK.gov chucks £28m at F1 tech for buses and diggers plan
Well, not really F1 but who's heard of LMP and VLN*?
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
Record labels sue Pandora over vintage song royalties
Companies want payout on recordings made before 1972
Edward Snowden on his Putin TV appearance: 'Why all the criticism?'
Denies Q&A cameo was meant to slam US, big-up Russia
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.