Feeds

Telstra shutters customer self-service site after security blunder

Passwords? We’ve heard of them

Secure remote control for conventional and virtual desktops

Several sharp-eyed readers have pointed El Register to the latest corporate security howler in Australia: Telstra’s customer self-service site has had to be shut down after it sprayed sensitive customer data to the world at large.

First reported on the Australian broadband discussion site Whirlpool (original post here) and then picked up by the Sydney Morning Herald and then The Australian, the potentially-massive breach allowed an Internet user to bypass the front-page security of the BigPond self-help site and access details of other users.

The exposed site offered customer service-level access to customers of Telstra bundled products. Information accessible included a veritable feast for identity theft: bundle information, telephone numbers, users’ names and addresses, and according to the Whirlpool discussion, users’ login and password information.

The Register cannot verify the extent of the breach, because once it became aware of the issue, Telstra barred access to the site (incidentally interrupting BigPond users’ access to Webmail).

The site is not actually hosted on a Telstra domain: it’s a cloud-based service on the custhelp.com domain operated by RightNow Technologies, which is currently in the throes of being acquired by Oracle. The Register has sought comment on the incident and is awaiting a response.

As The Australian notes, the serious privacy breach could affect a very large number of customers, with more than 650,000 new bundle customers sold last year. Australia’s Privacy Commissioner is investigating.

Telstra has stated that it will contact customers, but at the time of writing, this process did not seem to have begun. ®

Update: A reader has advised The Register that Telstra's BigPond POP and SMTP servers are currently offline. Although not on the affected RightNow servers, since customer logins may have been compromised, Telstra has probably taken services down as a precaution.

The carrier's status page states that "some online services remain unavailable as a precaution".

A Telstra spokesperson has stated on Twtter that as many as 60,000 customers "will need password resets to reduce risk from privacy breach" (sic). This suggests the carrier has assessed the logs of its customer self-service portal and has an estimate of how many accounts may have been compromised. ®

Intelligent flash storage arrays

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Free virtual appliance for wire data analytics
The ExtraHop Discovery Edition is a free virtual appliance will help you to discover the performance of your applications across the network, web, VDI, database, and storage tiers.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Business security measures using SSL
Examines the major types of threats to information security that businesses face today and the techniques for mitigating those threats.