Optus admits to huge privacy breaches

[silicon_toad2000]

http://www.theaustralian.com.au/business/latest/optus-admits-to-huge-privacy-breaches/story-e6frg90f-1227281206349

...and these are some of the clowns who will be in charge of australians metadata

The first incident was in February 2013, when Optus made a change to its website. A coding error meant Optus customers who completed a rate plan change via the website had their White Pages listing preference changed from No to Yes.

The names, addresses and mobile phone numbers of 122,000 Optus customers were then listed online without customer consent.

The second incident saw Netgear and Cisco modems left vulnerable after Optus left the management ports for these models open. The telco had incorrectly assumed they were only accessible for network management purposes. Optus also issued 197,000 of the Netgear modems and 111,000 of the Cisco modems to its customers with factory default settings, including user default names and passwords in place.

On April 4 2014, Optus says it fixed the vulnerability by implementing access controls and modifying configuration files on its modems.

The third incident occurred between September 2013 and May13 2014, in which a flaw in Optus’s security processes led to some customers not being prompted for their password when attempting to retrieve voicemail information from outside the Optus network.

This meant an unauthorised party could potentially access and use customer voicemail accounts messages.

The commissioner Timothy Pilgrim said he was concerned that Optus may not have taken reasonable steps to secure the personal information it held, as required by Australian Privacy Principle 11 which relates to security of personal information.

[GhostShip]

I don't believe in this amount of "accidental" stupidity, its more likely that these occurrences are "allowed" to take place by national security services to spy on customers and remotely access their systems with little to no hard work, the biggest UK ISP, BT did the self same thing some years ago, the only penalty seems to involve the ISP company apologising, even a multi million dollar fine is peanuts to the intelligence agencies who would likely pay any such fines to the ISP secretly as an operational expense.

[White Stripes]

this amount of "accidental" stupidity

did you see the sony leak? users putting their passwords as filenames? .... this amount of stupidity isnt accidental ... its really just plain stupidity...