Demon splurges details of 3,600 customers in billing email Demon Internet sent thousands of business and government subscribers an email this morning telling them all about a new e-billing system, and tacked on details, including passwords, for 3,600 customers. The email - supposedly from Simon Blackburn Demon's director of customer service - has been sent to customers opting for e- …
"A spokeswoman for Demon said the company had changed the passwords which were sent out and was in the process of changing user names too"
What were they doing storing passwords in the clear in the first place. What were they doing emailing this document around the company.
Back in the 90s when I joined them they were a small company that cared about their customers. Since they got taken over by Thus they've increasingly turned into a faceless organisation that couldn't give a rats arse about them. Their helpdesk is hosted in abroad and is a joke - half the "consultants" on it have a tough time telling your their own name in a recognisable language never mind solve your problem - whereas it used to be in southend staffed by technical types who had a clue, and their webpages ftp service seems to have an issue at least once a week. This cockup doesn't surprise me in the least.
The question isn't even why anyone is still with Demon: for some years now it has been why you're still with Nildram, to where you'd moved after the first mass migration away from Demon when Thus first got involved. As seems sadly inevitable, that bolthole went downhill too and it was time to abandon it in turn.
(Andrews & Arnold are lovely though)
Paris, because it's who Cliff would have chosen
The 'passwords in plaintext' is a non-issue. The e-mail was about a new service, e-billing, which required a username and password to log in. It's a chicken and egg situation. You need a password to log in, you have no password so how do you log in. Ah, yes, the provider gives you a password, but it has to be in plain text.
This CSV file is just a data source for an e-mail merge that accidentally got attached to the e-mail itself. There's no reason to suppose the e-billing system stores passwords in plaintext.
So someone pressed the wrong button in Outlook. Stupid mistake. Easily fixed. Nothing to see. Move along now.
Skizz
Although they shouldn't be stored in plaintext, most ISPs have a need to be able to retrieve a plaintext password. Why?
Well the one scenario I've definitely come across is when reporting an ADSL fault to BT, you need to submit the end user's connection username and password to BT in the fault report. You can't just change the password to something else, then submit that, as then you'd need to get the customer to change the password on their router.
So before people comment about passwords being available in plaintext, it might be nice if they looked at the operational reasons for it.
This kind of thing is just going to keep happening unless and until some organisation is prosecuted under data protection legislation and fined the maximum amount possible. We keep being told how much identity fraud is costing the country, and how much police forces are spending to fight it. Demon's crime may be the result of carelessness, but it is a crime none the less and they should have to pay the penalty - Say £1000 per set of details, £360K should get thier attention...
I was there for 12 years, first uding an Amiga A1200 for email, newsgroups (Thor) and the web (AWeb when you had to buy a browser)
I left last year because I got Joejobbed on my pseudo sub-domain, and got 75,000 emails on my account.
So minus a few marks for scanning incoming messages.
Then they couldn't release my email back to my control, and the only way to get a new Demon sub-domain was to pay for the privilege.
So I jumped. And I'd recommend others to as well
@ Skizz -Have you EVER used an onlilne service before? Most (reputable ones anyway) allow you to enter your details, account number, address, dob etc and create your own username and password to avoid stupid mistakes like this and storing passwords in plain text.
@ AC 12:14 - That may be a valid reason for connection details (although I'm not sure it is, and I wonder how many end users know about this practice?) but this was not the same login. This was for a new billing system that Demon should have allowed their users to set up their own accounts for.
Simples.
Paris? Because she's pretty.
> I received the email and attachments - my details were not in
> the CSV file - but my password was...allocated to someone else.
Of course, it's not normally a problem if someone else has the same password as you, because neither of you would know.
OTOH, if Demon are re-using a limited number of passwords, that would be naughty (my lawyer advised me not to say "criminal").
There's always a need to need to perform one access of a system where you don't have full access to credentials (ie. an initial registration), but there's so many different ways to achieve it in the year 2009, for instance;
- verification against a challenge letter (yes, a real letter sent in the post)
- verification against a challenge sent by SMS to a registered mobile phone
- verification against a certification pad (like PINsentry), or software equivalent
- verification against a password registered on a website in response to an an email containing a link with a reference
Bottom line is that it is unforgivable that details are sent out in a fashion like this. This is not a High Street store enticing new customers with a loyalty scheme, it's an ISP that should know better. Back in the day they were a great ISP as well, full of technical competence and great on delivery.
I agree that Data Protection action should be taken against Demon so that a lesson is taught to all companies that employ incompetent fools to manage data of the masses. If they have to think before pressing the button, they might prevent shams like this.
Paris, because no password needed to access her backdoor.
This post has been deleted by its author
This sort of occurrence is way to common, unfortunately. Hopefully, in this case, Demon was simply sending out passwords they had generated, rather than passwords previously used by customers, because, as well all know, password re-use is horribly high.
You can see how this sort of thing would happen by a mail merge sort of activity, but it is also unfortunate that Demon isn't using technology that would have detected just this sort of accidental leakage and prevented it from occurring. Further to a previous poster's point, there are also great encryption solutions available that would allow them to send this information out without resorting to plain text emails.
Michael Argast, Security Analyst, Sophos
I've been with "A Tenner a Month" [Demon] for a while. A couple of years ago they tried to introduce e-billing for my account. It wasn't working properly then and still doesn't work for me yet.
I wonder if the Crims will have any more luck gaining access to my account than I have had?
Today I phoned Demon to get them to check the access lists on a router they manage for my employer. All I gave them was the IP address of the router, and they told me everything I asked for. Didn't even give my name or company. More than a bit scary, and makes this story seem entirely expected.
A comma-separated file with cleartext names and passwords? Just HAVING that ANYWHERE means they need to spanked very hard. Actually sending it around means they need to the hung, drawn and quartered. What are these incompetent idiots doing in charge of anything more complicated than a swing set?
When I signed up for Demon and paid a year in advance ...
Never got billed for the following year ....
.... they instructed debt collectors instead!
Service was pretty erratic too, with extended outages (up to a day or more) depressingly common.
Why anyone still subscribes to them is a mystery.
I was with Demon from just after they started until November, last year. It had gone downhill too far to be saved, and was just an incompetent shambles at that time. It seems like there has been no improvement, and, although being naturally cautious and initially reluctant to re-arrange things so that I could change, I'm glad I did, and just in time. Demon started as a small business that really contained knowledgeable staff who would help and sort things out quickly. After being initially sold, it transformed itself into a limb of a faceless money-making organisation that seemed to care little about its small private customers, and in which most helpful and very good staff were either driven away (thus resetting the "salary clock") or made redundant. How the mightly fell! The only thing left to wonder is whether it has actually reached the bottom yet.
Now that is really scary.
Some poor temp on minimum wage straight out of scumbag poly with an honours degree in excel (to do the needful) no doubt.
Alternatively employ someone who knows how to knock up a perl script properly and let the mail servers do the job instead. Might save a bob or too in litigation, never mind a good kicking to the share price.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
