Feeds

Vodafone secures email-flashing barn door

Horse settled down, bringing up foals

Internet Security Threat Report 2014

Vodafone has secured the security breach that allowed anyone with a bit of time on their hands to collect subscribers' email addresses and phone numbers.

The hole came to light on Wednesday and allowed anyone to enter a phone number and get the corresponding email address, or enter a valid user name to get both the email and phone number of that user. As word spread about the flaw and customers started getting emails from strangers who knew their phone numbers, Vodafone spent the last couple of days scrabbling to fix the problem.

The flaw isn't new, but hadn't been noticed until now. When a user forgets their password Vodafone asks for their phone number and sends an email to the corresponding address with a reminder. The problem was that the site also confirmed to whom the email had been sent, displaying the subscriber's email address. Users quickly discovered the same thing could be achieved by guessing a login name, in which case both the phone number and email address could be collected.

But now that's been fixed, so customers who forget their password will still get sent a reminder but will have to take it on faith that Vodafone has sent the message to the right place.

"We have sent an email to your registered email address," Voda says. "When you get it, click on the link. This will take you to a page where you can reset your password and view your username." We tried it this morning and have yet to receive the corresponding email, so some work is obviously ongoing, but at least it didn't display our email address to the world.

Quite how many email addresses were compromised in the 48 hours Vodafone spent fixing the problem we don't know. The operator has been busy reassuring customers, explaining: "The personal data stored on their My Account profile has not been directly at risk as a result of the site's functionality."

This is true, but the customer's email address and phone number might well have been compromised and that might matter to them. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Mighty Blighty broadbanders beg: Let us lay cable in BT's, er, ducts
Complain to Ofcom that telco has 'effective monopoly'
Download alert: Nearly ALL top 100 Android, iOS paid apps hacked
Attack of the Clones? Yeah, but much, much scarier – report
Broadband sellers in the UK are UP TO no good, says Which?
Speedy network claims only apply to 10% of customers
Yahoo! blames! MONSTER! email! OUTAGE! on! CUT! CABLE! bungle!
Weekend woe for BT as telco struggles to restore service
Fujitsu CTO: We'll be 3D-printing tech execs in 15 years
Fleshy techie disses network neutrality, helmet-less motorcyclists
Facebook, working on Facebook at Work, works on Facebook. At Work
You don't want your cat or drunk pics at the office
Soz, web devs: Google snatches its Wallet off the table
Killing off web service in 3 months... but app-happy bonkers are fine
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
The total economic impact of Druva inSync
Examining the ROI enterprises may realize by implementing inSync, as they look to improve backup and recovery of endpoint data in a cost-effective manner.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.