Dave Lee reports:
An online service recommended by most of the UK’s police forces has fixed a privacy flaw after being alerted by a security expert.
Immobilise allows members of the public to add records to the National Property Register, detailing valuables in their homes.
But security consultant Paul Moore discovered a flaw that made it possible to access other people’s records.
Recipero, operators of Immobilise, said it had fixed the vulnerability.
Read more on BBC.
But as Graham Cluley notes:
But what you won’t necessarily realise when reading that news report is that the only reason the problem got fixed was because Paul Moore told the BBC about it, and the Beeb’s technology team began to sniff around and ask Immobilise some awkward questions.
Immobilise didn’t seem to take the problem anything like as seriously back in 2013, when they were first told about the flaw by Moore.
As of the time of this posting, Immobilise is offline, with the following message appearing:
Immobilise is offline for maintenance
Service update information
Date: 08 January 2015
Server resource issue
Unfortunately, due to unprecedented website traffic resulting from recent publicity, demand for the Immobilise website has exceeded current allocated resources.
To address this issue we have taken the Property Register offline whilst we perform maintenance and add additional frontend server capability.
Please rest assured that all account data remains secure.
Our apologies for any inconvenience.
Please check back again later. Thank you.