Feeds

BT-owned ISP Plusnet fails to plug security hole on its customer signup page

Spaffs new user credentials all over the interwebulator

Security for virtualized datacentres

Exclusive - Updated Sheffield-based telco Plusnet isn't doing any of its new customers "proud" right now, after an anonymous source told The Register that the company was currently transmitting personal details over an unencrypted web page.

The firm, which is owned by telecom giant BT, is asking interested subscribers to fill in a form online that - when submitted - "can be seen by other people while it is in transit".

Incredibly, Plusnet was told about the obvious security blunder by our concerned source over two weeks ago.

We were told:

I was just shocked by the way the sales rep brushed off my reporting of this during the contract setup (after discovering the vulnerability I used the phone instead).

She assured me that the security team would deal with it right away. In my opinion, over two weeks is more than enough time to sort this out.

Also, factor in the point that (as many new customers ordering an initial broadband setup are likely to do) I was using an open Wi-Fi hotspot to visit their site!

Our source added that he had used a private VPN connection to sign up to the ISP, but noted that many ordinary folk will fill in the form, safe in the knowledge that an outfit owned by BT would surely have its security credentials in order.

Click here for a larger version of this screen grab

Another source told us:

Plusnet ... store user passwords in unencrypted form, as I learnt when considering opening an account with them last summer [yes, six months ago]. When I told the 'tech' person I was talking to that many of the credentials could be used to access users' accounts with third party services, he replied that that was impossible. Though he didn't say why. I got broadband from someone else in the end.

Vulture Central was easily able to replicate the Plusnet cockup via the Firefox browser.

Among other things, the form requires an individual's full name, telephone number, username and password. ®

Update

The Reg questioned the firm over its lax security measures for new customers and this statement was provided to us by a spokesman a few hours after we published the story:

All Plusnet customer passwords are stored with full encryption. Our customer sign up page is currently unencrypted, and we are in the process of fixing this urgently.

It would appear that the company only began working on a fix after we'd been in touch. Funny that ...

Choosing a cloud hosting partner with confidence

More from The Register

next story
You! AT&T! The only thing 'unlimited' about you is your CHEEK, growl feds
Man, we did everything but knock on their doors - carrier
The DRUGSTORES DON'T WORK, CVS makes IT WORSE ... for Apple Pay
Goog Wallet apparently also spurned in NFC lockdown
Watch out, Samsung and Apple: Xiaomi's No 3 in smartphones now
From obscurity to selling 19 million mobes a quarter
Brazil greenlights $200m internet cable to Europe in bid to outfox NSA
Only one problem: it won't make the slightest difference. And they know it
Wanna hop carriers with your iPad's Apple SIM? AVOID AT&T
Unless you want your network-swapping tech disabled for good, that is
Knocking Knox: Samsung DENIES vuln claims, says mysterious blogger is a JOKER
But YES, system does store encryption key on the device
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
The Heartbleed Bug: how to protect your business with Symantec
What happens when the next Heartbleed (or worse) comes along, and what can you do to weather another chapter in an all-too-familiar string of debilitating attacks?