Re:When security goes right
by jodrellblank on Friday December 26, 2014 @02:20PM
(#8799903)
Apart from risk to individual customers, it means a competitor ISP could keep a running track of how many customers they have and how fast they are growing/shrinking.
Also how many customers on which products - some graphs will top out at 4Mb and some at 25Mb, etc.
And it implies there wasn't a thorough security review on that server-which-has-access-to-customer-data, so any malicious attacker might turn more attention to it for a way into more access.
Cperciva says the access required a valid login, it's plausible that login could be customer number + password, which would make brute forcing easier with a list of current customer numbers.
Hmm
If they're big enough to have customers across Canada, usage patterns could reveal timezones. And whether the residence is unoccupied during work hours / what typical work hours are.
Longer term usage patterns could reveal if they tend to go out at nights, on weekends, over holiday seasons.
What else... maybe usage drops correlate with major sports events for some profiling?
Also how many customers on which products - some graphs will top out at 4Mb and some at 25Mb, etc.
And it implies there wasn't a thorough security review on that server-which-has-access-to-customer-data, so any malicious attacker might turn more attention to it for a way into more access.
Cperciva says the access required a valid login, it's plausible that login could be customer number + password, which would make brute forcing easier with a list of current customer numbers.
Hmm
If they're big enough to have customers across Canada, usage patterns could reveal timezones. And whether the residence is unoccupied during work hours / what typical work hours are.
Longer term usage patterns could reveal if they tend to go out at nights, on weekends, over holiday seasons.
What else... maybe usage drops correlate with major sports events for some profiling?