{"id":394561,"date":"2021-04-28T09:02:05","date_gmt":"2021-04-28T07:02:05","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=394561"},"modified":"2021-04-28T09:06:20","modified_gmt":"2021-04-28T07:06:20","slug":"openserve-security-flaw-exposes-broadband-subscriber-information","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/394561-openserve-security-flaw-exposes-broadband-subscriber-information.html","title":{"rendered":"Openserve security flaw exposes broadband subscriber information"},"content":{"rendered":"

The Openserve Uniweb system contained a security vulnerability which potentially exposed broadband subscriber information to Internet service providers who were not supposed to see it.<\/p>\n

Openserve is the wholesale and networks division of Telkom. It operates the company’s wholesale landline copper and fibre infrastructure.<\/p>\n

As part of its wholesale offering to Internet service providers (ISPs), it provides a portal to track support services.<\/p>\n

Its Openserve Uniweb system contains information about broadband subscribers who have reported faults on their lines.<\/p>\n

MyBroadband received information from a concerned Internet service provider (ISP) executive who stumbled upon a security vulnerability in Uniweb.<\/p>\n

According to the ISP exec, any Openserve reseller with credentials to log into Uniweb online portal can simply change the reference number of a fault report in their browser’s URL bar and view the fault, even if it’s not their client.<\/p>\n

These reference numbers are always sequential, making them easy to guess, the executive said.<\/p>\n

\u201cYou can view the full history on each circuit which potentially contains cellphone numbers, names, addresses, and other personal information,\u201d he said.<\/p>\n

\u201cI assume this is a very old Telkom system and this has issues concerning the Protection of Personal Information Act (POPI).\u201d<\/p>\n

The ISP said that they tried to report the vulnerability to Telkom directly, but received no response.<\/p>\n

\u201cThis is worth bringing to people\u2019s attention as trying to log this via Telkom support failed miserably,\u201d he said.<\/p>\n

MyBroadband contacted Telkom for comment on the security flaw in its Uniweb portal, but the company did not respond by the time of publication.<\/p>\n

The Uniweb site has, however, been taken down for maintenance. This may be to fix the security problem.<\/p>\n

\"\"<\/a>

Openserve Uniweb interface<\/p><\/div>\n

\"\"<\/a>

Openserve Uniweb site down for maintenance<\/p><\/div>\n

Now read: New Openserve fibre prices \u2013 How much cheaper it is than Vumatel<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"

An Openserve fault reporting system accessible to Internet service providers contained a security vulnerability which potentially exposed broadband subscriber information.<\/p>\n","protected":false},"author":15,"featured_media":183294,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[35,33386,109,69531],"class_list":["post-394561","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-headline","tag-openserve","tag-telkom","tag-uniweb"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/394561"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=394561"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/394561\/revisions"}],"predecessor-version":[{"id":394993,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/394561\/revisions\/394993"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/183294"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=394561"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=394561"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=394561"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}