BT caught out by Email loophole

Posted on 29 Sep 2000 at 18:10

A customer of BT's Talk21 email service has found he can access other user's email accounts.

Business user John Heaton made the discovery when trying to send out a marketing email on behalf of his business, Hotelkeeper.net. In theory, those that visited his site by clicking on a link from the email are tracked when they reach the site.

But instead of finding out his customer's movements, Heaton found he could access their email accounts if they were Talk21 customers. That meant he had all the user privileges of the account holders themselves and could send emails and delete documents.

"I was utterly astonished," said Heaton. He immediately contacted BT to inform them of the problem but heard nothing back. "I was angry I received no response from BT over such an appalling security flaw," he added.

When contacted, BT said it had no evidence of a security breach but was looking into the allegations.

Author: Caroline Gilmour