Major DSTV security flaw

[Random3328]

Hey all

I raised this to DSTV support last year and they haven't done anything, I was more asked why I did such a thing in the first place.

People who have DSTV accounts outside of South Africa, can technically access another person's account in SA, just by simply logging in with their connect ID. For example let's say a user from Zimbabwe goes to the SA URL, instead of their countries URL, and then they complete the login process. The profile that will show up, will not be theirs but someone else completely different, you can then modify everything to do with their account, and no limitations on it.

Now this has some serious worry as you have access to all their personal information, can change subscription plans and modify their billing without ever obtaining their login information.

I have attached two images of the two separate accounts as an example that this can be done and achieved.

 

[epah]

Your fault for still subscribing to DSTV. we dont care here.

 

[I.am.Sam]

Your fault for still subscribing to DSTV. we dont care here.

stop telling people you dont care when you cant afford dstv

 

[Gambit]

Hey all

I raised this to DSTV support last year and they haven't done anything, I was more asked why I did such a thing in the first place.

People who have DSTV accounts outside of South Africa, can technically access another person's account in SA, just by simply logging in with their connect ID. For example let's say a user from Zimbabwe goes to the SA URL, instead of their countries URL, and then they complete the login process. The profile that will show up, will not be theirs but someone else completely different, you can then modify everything to do with their account, and no limitations on it.

Now this has some serious worry as you have access to all their personal information, can change subscription plans and modify their billing without ever obtaining their login information.

I have attached two images of the two separate accounts as an example that this can be done and achieved.

Thanks for taking the time to report this. I have sent this to my contacts at Multichoice

 

[Brian_G]

People who have DSTV accounts outside of South Africa, can technically access another person's account in SA, just by simply logging in with their connect ID.

Jan from the staff here has seen this and knows peeps at Multichoice.

May be a once-off oddity but can't test with my old external accs. as they're without decoders now.
I did try it in reverse (SA details used in another country) - glad to say that doesn't work.

@Geoff.D - FYI

 

[Brian_G]

Your fault for still subscribing to DSTV. we dont care here.

200 people in a subscriber poll say differently
Dear DStv - technical faults thread

 

[chrisc]

A Nigerian friend who lives here in Cape Town knows about this. His brother in Lagos accessed His account and sent him a screenshot

 

[Brian_G]

A Nigerian friend who lives here in Cape Town knows about this. His brother in Lagos accessed His account and sent him a screenshot

View attachment 1470125

Sounds like at least the surname needs to be the same.

 

[NeonNinja]

Cool story bro...

 

[krugie]

Your fault for still subscribing to DSTV. we dont care here.

The topic clearly states "including DSTV" - scroll past if you are not interested. The only thing we don't care about is your opinion unrelated to the discussion.