{"id":297690,"date":"2019-03-01T09:57:05","date_gmt":"2019-03-01T07:57:05","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=297690"},"modified":"2019-03-01T09:59:17","modified_gmt":"2019-03-01T07:59:17","slug":"eskom-customer-data-leak-what-really-happened","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/297690-eskom-customer-data-leak-what-really-happened.html","title":{"rendered":"Eskom customer data leak – What really happened"},"content":{"rendered":"

Security researcher Devin Stokes recently took to Twitter to disclose a database vulnerability that was causing the private details<\/strong><\/a> of Eskom clients to be leaked online.<\/p>\n

Stokes said that he took the decision to go public after Eskom failed to respond to his emails, requests for comment from news organisations, and direct messages on Twitter.<\/p>\n

Following the disclosure, Stokes posted a screenshot of a customer record in a live database – which showed the person\u2019s full name and credit card details.<\/p>\n

Eskom denied responsibility for the leak, however, stating that it had traced the origins of the problem to an exposed Mongo database hosted on a server in the United States.<\/p>\n

\u201cWe have managed to trace the company responsible for this server and the database. The company is very cooperative and has since confirmed that the server has been shut down,\u201d said Eskom\u2019s acting chief information officer Nondumiso Zibi.<\/p>\n

EMS Invirotel<\/h3>\n

\"EMS<\/a><\/p>\n

Following Eskom\u2019s response, a company called EMS Invirotel took responsibility for the leak.<\/p>\n

At the time of publication, navigating to EMS Invirotel\u2019s website<\/a><\/strong> using HTTPS results in a warning that its security certificate expired more than a year and a half ago. Proceeding despite the warning returns a \u201cNot Found\u201d (404) error. Using HTTP to navigate to the URL caused the site to redirect to Afrihost\u2019s homepage.<\/p>\n

An archived version<\/a><\/strong> of the company\u2019s site reveals that EMS Invirotel supplies smart metering and utility account management systems.<\/p>\n

In a statement published<\/a><\/strong> online, which EMS Invirotel has confirmed is authentic, the company confirmed that a database with certain customer information was accessed by an unauthorised third party.<\/p>\n

The database was hosted on a cloud server in the United States, EMS Invirotel stated.<\/p>\n

It added that it shut off the server while it investigated the issue, and contacted all its customers who may have been or may still be potentially impacted by the security breach.<\/p>\n

\u201cWe understand and respect the fact that customers place their trust in us when providing their details to us, and we do not take this situation lightly in any regard,\u201d EMS Invirotel said.<\/p>\n

\u201cWe shall report the matter to the relevant authorities and will work with them in addressing this matter further.\u201d<\/p>\n

Hacking attempt caused database to become public<\/h3>\n

Expanding on the leak, EMS Invirotel said that any security researcher who breached their server would have had to bypass extensive security measures to access the database.<\/p>\n

\u201cThe security employed on the server was far more advanced than that which is required by the minimum standards, and was regularly updated with the latest security patches,\u201d the company said.<\/p>\n

However, according to Stokes, the database was exposed to the Internet without any authentication present.<\/p>\n

Queried about this, EMS Invirotel told MyBroadband that a hacking attempt resulted in a particular database being published on an unsecured port, causing it to be publicly accessible.<\/p>\n

The \u201cattempted hacking\u201d also caused them to be unable to secure the database after the intrusion was detected, the company said.<\/p>\n

\u201cAccordingly the only way that we were able to \u2018unpublish\u2019 the database and secure the data was to completely shut down the server, which we duly did,\u201d EMS Invirotel said.<\/p>\n

Now read: South Africa\u2019s Cybercrimes Bill \u2013 How it will affect networks<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"

Security researcher Devin Stokes recently took to Twitter to disclose an “Eskom” database vulnerability.<\/p>\n","protected":false},"author":15,"featured_media":126470,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[57254,57714,181,35],"class_list":["post-297690","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-devin-stokes","tag-ems-invirotel","tag-eskom","tag-headline"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/297690"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=297690"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/297690\/revisions"}],"predecessor-version":[{"id":297908,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/297690\/revisions\/297908"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/126470"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=297690"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=297690"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=297690"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}