Web mail Incident Report (FULL Not link)

Our customers will be aware of a recent serious security issue affecting our Webmail service. This document contains the results of our investigation and what actions we are now taking to minimise the resulting impact for our customers.

We are extremely sorry for the inconvenience and upset this may have caused our customers. We hope this report will provide some reassurance to our customers about how seriously we are taking these events.

Contents
1. Incident Summary

2. Breakdown of events

3. Our response and plans going forward


Incident Summary

Further details, explanations and answers to questions we have been asked are below the summary section.

What happened?

A malicious attack was performed against vulnerability in our implementation of our Webmail software which allowed the attackers to:


- Take a copy of our webmail database, which contained the email addresses of customers who have used Webmail. This also included email addresses contained in customers

Edited by soundsystem (Thu 24-May-07 00:50:58)

Honesty is always a good thing and should be congratulated. The dates have been confirmed and an acknowledgement that they missed the issue when first raised. I would love to put more thoughts down in words but am too tired to do this tonight. Will pick up on this at lunch time tomorrow if I get a chance. The thread will probably be 10 pages long by then...

> Only customers without up-to-date Windows software and inadequate anti-virus software would have the Trojan affect their PCs.

That is simply not true. My PC has neither up-to-date Windows software nor any anti-virus software. Yet it was still not at risk because it doesn't have Windows at all. My PC is a Microsoft-free zone.

I do wish people would stop assuming that "Windows" and "PC" are synonymous.

Edited by linux (Thu 24-May-07 02:13:01)

Indeed, overall a very positive report. Obviously there will be more questions and discussion, but as you say it's late. And for now I think everyone involved in making the report and getting it out should be given the chance to take a moment and pat themselves on the back. And accept my (and I'm sure others) thanks. It's the sort of humble, clear and informative thing it's good to see. Well done

It's also great to see many of the changes that have been asked for for years finally being put into place and what looks like a very clear and honest change in attitude and company ethic. Having a dedicated security team is possibly overdue but again at least it's now happening. Once the practicalities of getting customers immediate problems is dealt with I'm sure there is plenty that individuals and the company as a whole have learnt that can be used to make things better for everyone.

Great respopnse from PlusNet. Full marks to them.

This is really for the attention of the PN Support, but worth having out in the open.

In reply to:

---

1) The ability to change your username

2) Get a free .uk domain name

3) SSL encrypted connections for POP3 and IMAP email and FTP

4) Improvements to the

~ If you can read this, your AG/TB settings are not configured for performance ~

Camie

SAR 715...plusnet...6893kbps/383kbps

~ The AG'ers Mugshots ~

~ Camie's Forums ~

It was also worth noting that the compromised Servers were:- "Each of these machines was a Linux server".

Just proves that, when it comes to the crunch, Linux appears to be vulnerable to hacking & vulnerabilities as well!

Under the circumstances, appears to be a very good posting by PN!!

Hopefully, this is an indication of PN returning to their "culture", of a few years back, when they were ALWAYS fully open & honest with their customers!

I didn't see anything about vulnerabilities in Linux. I only read about server configuration issues and Perl/PHP issues - neither of which point to a Linux vulnerability.

It was the atmail application that was vulnerable, not the underlying OS, hence why it was reported to the application developers.