Feeds

Telstra shutters customer self-service site after security blunder

Passwords? We’ve heard of them

Secure remote control for conventional and virtual desktops

Several sharp-eyed readers have pointed El Register to the latest corporate security howler in Australia: Telstra’s customer self-service site has had to be shut down after it sprayed sensitive customer data to the world at large.

First reported on the Australian broadband discussion site Whirlpool (original post here) and then picked up by the Sydney Morning Herald and then The Australian, the potentially-massive breach allowed an Internet user to bypass the front-page security of the BigPond self-help site and access details of other users.

The exposed site offered customer service-level access to customers of Telstra bundled products. Information accessible included a veritable feast for identity theft: bundle information, telephone numbers, users’ names and addresses, and according to the Whirlpool discussion, users’ login and password information.

The Register cannot verify the extent of the breach, because once it became aware of the issue, Telstra barred access to the site (incidentally interrupting BigPond users’ access to Webmail).

The site is not actually hosted on a Telstra domain: it’s a cloud-based service on the custhelp.com domain operated by RightNow Technologies, which is currently in the throes of being acquired by Oracle. The Register has sought comment on the incident and is awaiting a response.

As The Australian notes, the serious privacy breach could affect a very large number of customers, with more than 650,000 new bundle customers sold last year. Australia’s Privacy Commissioner is investigating.

Telstra has stated that it will contact customers, but at the time of writing, this process did not seem to have begun. ®

Update: A reader has advised The Register that Telstra's BigPond POP and SMTP servers are currently offline. Although not on the affected RightNow servers, since customer logins may have been compromised, Telstra has probably taken services down as a precaution.

The carrier's status page states that "some online services remain unavailable as a precaution".

A Telstra spokesperson has stated on Twtter that as many as 60,000 customers "will need password resets to reduce risk from privacy breach" (sic). This suggests the carrier has assessed the logs of its customer self-service portal and has an estimate of how many accounts may have been compromised. ®

New hybrid storage solutions

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.