ISP Security Flaw (Wanadoo)

I thought that it may be of interest for people to know that one of
the UK's leading Internet Service Providers, Wanadoo (formerly Freeserve)
is suffering from a serious yet very simple security flaw that exposes the
account information of many of its customers.

The problem that allows this is a simple and fairly common
vulnerability, index browsing that exists in their account recovery system
web servers. The web servers have been incorrectly configured allowing the
user to view the contents of an entire folder instead of just an index web page,
ex: index.htm or index.php and as this particular system relies on unique
undisclosed filenames to stop users retrieving each others accounts this simple
flaw proves to be far more dangerous.

This vulnerability has existed for no less than 2 years and has remained
unnoticed and unresolved. The information is easily accessible to any user
with a web browser(granny Higgins could do it) and reveals the Real Name,
Username,Password,E-mail Address and Web space sub domain of the listed customers.

Accessing this information (to my knowledge) is not even illegal as the web
servers it's stored on do not challenge you for authentication when accessing it.
I feel that any company dealing with technology at this level should be far more
aware of security and yet it seems that it has been grossly neglected at the expense
of the customer. If an ISP is making mistakes of this magnitude how can any of
its users ever hope to be safe?

Below are the links that give access to the aforementioned servers. I do this as
a matter of making it public knowledge and forcing prompt action in fixing the issue,
so please anyone thinking of abusing it show some restraint.

**URL's Removed Due To Gross Unpopularity**


-Gammarays

This type of information would not benefit us at all. This is a Security Community.

Perhaps Wanadoo should hear about this?

If you are so concerned about the privacy of the customers, why would you share it with us?

I don't think I will be following those links.

-Deeboe

The information isn't really mean't to be for gain, its so alot of people will pressure Wanadoo as I know people already have and even now they have still failed to act. they have received phone calls and complaint forms and I suspect a fair few emails.

Generally what happens with companies like this is they pretend there never was a problem then they slap a cheap patch over it and never bother to review overall security, As i stated this information is been hosted up on a public server with no challenge for authentication and so for all we know all kinds of unscrupolous characters could have been crawling over it for a long time. At least this way Wanadoo is liable to answer for the mistake.

In regard to the privacy of the customers i admit its regretable that this is gonna cause a few people a great deal of inconvenience, if it hasn't already done so some point over the last few years already, however I beleive if the company sees the consequences of overlooking security at first hand then they will not be so easy to make the same mistake in the future.

If people are willing enough to take me on my word then thats great but had i not posted the links people would no doubt brand me a liar and just ignore it.

Thanks for the feedback.

-Gammarays

Hi,
I've taken the liberty of emailing their abuse web address with a link to your post and a screen shot of it. This may bring some action. It might not be the action you wanted though. Btw, wouldn't notifying law enforcement/government (even a newspaper or tv station for that matter) be a better way of doing this than posting it on the internet? I really don't think you should have done this.

Thanks for notifying them, Yes i understand this seems like an extreme step and I can see why alot of people disapprove of it. Im glad you mentioned the contacting of an outside "neutral" party such as the media, I did attempt to contact the BBC a week ago, I feel a week is sufficent time to give me at least some form of preliminary reply, which they did not and so I have resorted to the use of the Internet as I know information here is very much more difficult to supress and censor

Thanks for the feedback.

-Gammarays

Well I gather from the general response to this thread that providing the URL's was an unpopular move, so I shall buckle to peer pressure and remove them if it so pleases you.

When people post any kind of security related infomation they are making it availible to deviants as is the nature of full-disclosure if that is not welcome then sobeit.

Quote:

---

Originally posted here by Gammarays
Well I gather from the general response to this thread that providing the URL's was an unpopular move, so I shall buckle to peer pressure and remove them if it so pleases you.

When people post any kind of security related infomation they are making it availible to deviants as is the nature of full-disclosure if that is not welcome then sobeit.

---

Good Evening,

Full-disclosure can be completed in either a responsible or an irresponsible method. Thanks for your consideration.

cheers

Sounds like the problem I had a number of years ago....
I told the ISP.... All it got me was a bill for 50 grand and
medical problems

http://users.adelphia.net/~franksradio/

I provided the means for people to see it for themselves because seeing is believing, I could have posted up screenshots but would anyone actually beleive it?, would anyone pressure Wanadoo on the mere speculation created by an image that could easilly be faked.

As you mentioned it does throw the doors open to deviants but i assure you it did not take a vast amount of effort to work out it was there and I would certainly not be suprised if it was already being silently abused, which in my opinion is far more dangerous. That said I wouldn't want to invite any vultures to the feast so for now it is indeed best that the finer details are omitted at least untill Wanadoo rectify the issue.

Thanks for the Feedback

-Gammarays

I for one, am for full disclosure.

That said, there is a protocol that must be followed because of the consiquences for placing information in the hands of those who may abuse it.

Now, the first thing you should have done was contact the ISP and give them a reasonable chance to fix the issue. If they don't respond, give them two more trys.

For the sake of argument, let's say that they do fix the problem. From there, you take the original exploit and post it on a security mailing list or site with details pointing to the fix. Most companies will credit you somewhere in the fix so you're recognized as the one who helped close the issue.

The bottom line is that it's irresponsible to disclose holes without having a fix. By the tone of your post, it sounds to me like you're displeased with this company already and the disclosure may be fueled by a little something more than your concern for others.

Again, full disclosure is fine when done correctly. In this case, I don't believe that you've gone about resolving the issue appropriately.

--TH13

Ok, first of all thanks to Highlander for the link, I found it intresting reading and it definately demonstrates typical behaviour of a company when confronted with a problem like this.

As for the views regarding full-disclosure, I agree on all but the smaller details. I feel its nessacary to highlight the action I have taken before making this post as it would seem alot of people presume that I have jumped straight in at the deep end and just thrown it out there without any kind of consideration before hand.

I had sent them 2 emails with a good spacing of time between them (2-3 weeks), neither of which yielded a response, I then more recently tried to contact a more neutral party whom i have previously mentioned, they also ignored me.

Now either everybodies spam filter is turned on or someone thinks im joking or they simply don't care. The way I see it im trying to do them a favour and they're making it very difficult, I've even heard from a 3rd party that he phoned them and had a conversation with someone who claimed they were in the server room, however from the details elaborated it would seem that who ever it was, was more concerned about customers finding out than patching. Infact even as i write this the problem still exists and I find myself inclined to send yet another email just to try see if I can get any form of response.

As you correctly noted I do have a somewhat negative opinion of them, but this is more a result of how they've handled this situation than a motive for how it came about.

Thanks for the Feedback

-Gammarays

If you find yourself completely ignored *and* you have a fix then I'd say disclosing the details is just fine. In extreme cases, I also do this but *only* if I can provide a fix and only if I publish the details of my contact attempts with the vendor.

When you dump the details of an exploit out on a public list when there is no fix available, you haven't helped anyone other than the bad guys.

Thank you for posting.

--Th13

Well I've just got the good news, They've fixed It!

It may have taken a while but I think the increased volume of complaints regarding the subject had finally come to their notice. Thanks to everyone who emailed them or submitted a complaint form, it makes the difference.

-Gammarays

Well, it's been covered in the press too. Check it out:
http://www.theregister.co.uk/2006/05...security_flap/

Cheers,
cgkanchi

In a statement, the ISP said: "Wanadoo can confirm that a small number of links to files containing customer details have been posted on the internet. Wanadoo would like to reassure customers that this was an isolated incident and as soon as we were made aware of the problem, the information was removed from the public domain.

But according to Gammarays, they knew about the problem long before the posting of the links. So what they're really saying is, "We knew we had a problem, and as soon as we realized a whole bunch of other people knew we had a problem, we finally decided to fix it."

Which makes me wonder, is the biggest security problem on the internet technical or cultural?

Quote:

---

Which makes me wonder, is the biggest security problem on the internet technical or cultural?

---

Excellent point.....

You will find the biggest security hole is always going to be users.....then lazy admins with the attitude...if it aint broke ...dont fix it.

Also...upper management....really doesnt seem to care about security...unless its gonna affect the bottom line....(I try and use the words "lawsuit" and "fine", "privacy act" alot in those types of meetings)....

"There are no technical solutions to administrative problems"

Hey I was just at a seminar on computer\network security...and heard a story how easy it was to social engineer into a banks system........physical access........all the passwords, routers and firewalls in the world aint gonna help out when someone walks out the door with your server.

MLF