Home
 » ISP News » 
Sponsored

BT Shuns Phone Privacy Bug that Exposes UK Customers to Abuse

Tuesday, November 27th, 2012 (1:32 pm) - Score 644
bt_privacy_fail

BT has been accused of negligence after one of its customers discovered that the national telecoms operator had made it easy for anybody to gain access to personal customer account names and add unwanted services to another user’s phone line without their permission.

The flaw, which we were easily able to verify with a friends service, allows anybody with the phone number and postcode of a particular property to change the subscription service and gain access to additional personal details (full name of the account holder) through BT’s online “Upgrade your Calling Plan” service.

It goes without saying that such an easily accessible system with no firm security checks, except a basic check-box, could be abused for malicious purposes, although so far BT have only agreed to remove the account holders name from its public display.

A BT Spokesperson said (The Register):

Different levels of security apply to different products. Where judged as appropriate, for the purpose of customer convenience we do allow a limited number of services to be ordered online using the phone number and postcode.

It should not have been possible to view the name of the account holder by entering just the phone number and postcode. Thank you very much for bringing this to our attention, we have taken the appropriate action to close this issue.”

Apparently knowing the phone number and postcode of a property, which can easily be found via the phone directory, is all the security that customers need. So far as we’re aware the vast majority of other telecoms operators and broadband ISPs tend to require at least a username and password before allowing anybody to make similar changes to their services, which is a more sensible approach.

Add to Diigo
Mark Jackson
By Mark Jackson
Mark is a professional technology writer, IT consultant and computer engineer from Dorset (England), he also founded ISPreview in 1999 and enjoys analysing the latest telecoms and broadband developments. Find me on Twitter, , Facebook and Linkedin.
Leave a Comment
2 Responses
  1. Avatar DTMark

    Aha – so if I want to know if someone has Caller Display and knows whether it’s me calling or not, I can go onto the BT website, put their phone number and postcode in, and find out?

    This sort of negligent security leak is really appalling for any company, let alone a major one with IT offerings (!). I’d be hanging my head in my hands if I’d coded that.

  2. Avatar joey

    You know why they can’t/won’t fix it?

    Because it was coded by some crackhead in India, and they cant find him.

Comments RSS Feed

Javascript must be enabled to post (most browsers do this automatically)

Privacy Notice: Please note that news comments are anonymous, which means that we do NOT require you to enter any real personal details to post a message. By clicking to submit a post you agree to storing your comment content, display name, IP, email and / or website details in our database, for as long as the post remains live.

Only the submitted name and comment will be displayed in public, while the rest will be kept private (we will never share this outside of ISPreview, regardless of whether the data is real or fake). This comment system uses submitted IP, email and website address data to spot abuse and spammers. All data is transferred via an encrypted (https secure) session.

NOTE 1: Sometimes your comment might not appear immediately due to site cache (this is cleared every few hours) or it may be caught by automated moderation / anti-spam.

NOTE 2: Comments that break our rules, spam, troll or post via known fake IP/proxy servers may be blocked or removed.
Cheapest Superfast ISPs
  • Hyperoptic £21.00 (*25.00)
    Avg. Speed 50Mbps, Unlimited
    Gift: £50 Shopping Voucher
  • TalkTalk £21.95 (*36.00)
    Avg. Speed 38Mbps, Unlimited
    Gift: None
  • xln telecom £22.74 (*47.94)
    Avg. Speed 66Mbps, Unlimited (FUP)
    Gift: None
  • Post Office £22.90 (*37.00)
    Avg. Speed 38Mbps, Unlimited
    Gift: None
  • Direct Save Telecom £22.95 (*29.95)
    Avg. Speed 35Mbps, Unlimited
    Gift: None
Prices inc. Line Rental | View All
The Top 20 Category Tags
  1. BT (2533)
  2. FTTP (2254)
  3. FTTC (1676)
  4. Building Digital UK (1616)
  5. Politics (1444)
  6. Openreach (1432)
  7. Business (1258)
  8. Statistics (1110)
  9. FTTH (1105)
  10. Mobile Broadband (1056)
  11. Fibre Optic (978)
  12. Ofcom Regulation (922)
  13. 4G (918)
  14. Wireless Internet (917)
  15. Virgin Media (870)
  16. EE (602)
  17. Sky Broadband (600)
  18. TalkTalk (586)
  19. Vodafone (532)
  20. 3G (417)
Promotion
Helpful ISP Guides and Tips
»
»
»
»
»
»
»
»
»
»
»
»
»
»
»
»
»
»
»
»
»
»
»
»
»
»
»
»
Sponsored

Copyright © 1999 to Present - ISPreview.co.uk - All Rights Reserved - Terms , Privacy and Cookie Policy , Links , Website Rules , Contact