Skip to main content

Google search reveals private Telstra customer data

Posted by: admin 11 years, 6 months ago

A man googling for some information on SMS carrier access codes stumbled upon private Telstra customer data. The data could be used to authenticate a user to the phone company, allowing account take-over.  There appears to be a pattern:

In December 2011 an internal Telstra portal containing the details of almost 800,000 customers was found to be exposed on the public internet without password protection. The telco was also criticised in July 2012 for sending without permission to a company in Canada the URLs that its Next G network customers visited. In November 2010 another 3000 customers' data was breached.

I'm not piling on here (at least not trying to), I'm just pointing out, once again, that relying on a third party for security entails risk, often a lot of risk.  More and more companies and services rely on SMS for 'two-factor' authentication.  As I have said in the past, that is more secure that static passwords, but is it acceptable for your needs?  Carriers are dis-incented to secure their users accounts - account lock-outs are expensive and a system-wide increase in security means potentially millions of help-desk calls.

This is why WiKID has software tokens that run on the smart phones that perform encryption.  We rely on the carriers for a data connection, but not for the security of the system.

There are so many options for two-factor authentication now that the term is quite fuzzy.  You really need to analyze your situation and determine the risks you are willing to take along with the functionality you need.

Current rating: 1

Recent Posts

Archive

2024
2022
2021
2019
2018
2017
2016
2015
2014
2013
2012
2011
2010
2009
2008

Categories

Tags

Authors

Feeds

RSS / Atom