Feeds

Vodafone secures email-flashing barn door

Horse settled down, bringing up foals

The Essential Guide to IT Transformation

Vodafone has secured the security breach that allowed anyone with a bit of time on their hands to collect subscribers' email addresses and phone numbers.

The hole came to light on Wednesday and allowed anyone to enter a phone number and get the corresponding email address, or enter a valid user name to get both the email and phone number of that user. As word spread about the flaw and customers started getting emails from strangers who knew their phone numbers, Vodafone spent the last couple of days scrabbling to fix the problem.

The flaw isn't new, but hadn't been noticed until now. When a user forgets their password Vodafone asks for their phone number and sends an email to the corresponding address with a reminder. The problem was that the site also confirmed to whom the email had been sent, displaying the subscriber's email address. Users quickly discovered the same thing could be achieved by guessing a login name, in which case both the phone number and email address could be collected.

But now that's been fixed, so customers who forget their password will still get sent a reminder but will have to take it on faith that Vodafone has sent the message to the right place.

"We have sent an email to your registered email address," Voda says. "When you get it, click on the link. This will take you to a page where you can reset your password and view your username." We tried it this morning and have yet to receive the corresponding email, so some work is obviously ongoing, but at least it didn't display our email address to the world.

Quite how many email addresses were compromised in the 48 hours Vodafone spent fixing the problem we don't know. The operator has been busy reassuring customers, explaining: "The personal data stored on their My Account profile has not been directly at risk as a result of the site's functionality."

This is true, but the customer's email address and phone number might well have been compromised and that might matter to them. ®

Build a business case: developing custom apps

More from The Register

next story
Scotland's BIG question: Will independence cost me my broadband?
They can take our lives, but they'll never take our SPECTRUM
Trying to sell your house? It'd better have KILLER mobile coverage
More NB than transport links to next-gen buyers - study
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Auntie remains MYSTIFIED by that weekend BBC iPlayer and website outage
Still doing 'forensics' on the caching layer – Beeb digi wonk
Speak your brains on SIGNAL-FREE mobile comms firm here
Is goTenna tech a goer? Time to grill CEO, CTO
NBN Co adds apartments to FTTP rollout
Commercial trial locations to go live in September
Samsung Z Tizen OS mobe is post-phoned – this time for good?
Russian launch for Sammy's non-droid knocked back
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.