South Africans have yet again had their private data exposed on the internet due to sloppy software management. Illustration: Lisa Nelson When you call a financial company, and you’re on hold with a message saying “Your call is being recorded for quality and security purposes,” you rightly expect that the conversation you eventually have with the human on the other end is confidential and secure. Unfortunately many South Africans have been let down. On Wednesday night we discovered that Open V, an IT company , had left thousands of recordings of one of its customer’s telephone calls available to download off the internet. As far as we can tell, these recordings, which go back to 27 July, had been available since 6 September. Based in Gqeberha and operating since 2006, Open V says on its website that it specialises in a range of IT services, including cybersecurity, “ensuring that medium and large businesses stay ahead in a rapidly evolving digital landscape”. Its “managing executive” is Siva Naidoo and its “chief information officer” is Stuart Kemp. Where it was possible for us to identify them, the voice recordings were either incoming, outgoing or internal to Edge Financial Group, a Gqeberha financial services company that, among other things, brokers medical scheme cover. Many of the calls were made by Edge employees to Discovery or Bonitas. Thousands of the calls were of substantial length. We downloaded a few dozen of the audio files to understand what was going on. As soon as participants began to discuss medical or financial information, we stopped listening. Based on the conversations we sampled, they mostly involved medical scheme queries. We contacted Discovery and Edge on Thursday morning to inform them what was happening. Officials from both companies were alarmed, immediately took action and assured us that the matter would be reported to the relevant authorities. (Many other companies were involved in the recordings, but we only contacted Edge because it was the Open V customer whose data was breached and Discovery because it is the largest medical scheme in the country and a large number of the calls involved Discovery. We emphasise that neither company had control over what happened here.) Edge’s managing director, Edward Gutsche, wrote to GroundUp: “To date we have ensured that our FSCA compliance officer has been notified and shall also be awaiting the report [from Open V] so that he can, if need be, inform FSCA.” “I am quite angry, if it is verified in the report, that Edge as a client of Open V, has had our rights and our clients’ rights prejudiced and that (with no insult intended) it was a media organisation that picked up on the alleged breach instead of Open V themselves,” wrote Gutsche. A company that discovers a data breach must, in terms of the Protection of Personal Information Act (POPIA), notify the Information Regulator and, where possible, the people whose data has been exposed. We also contacted Open V on Thursday morning by email and phone. About half an hour after we told an Open V employee about the problem, the site was taken offline. Open V, instead of responding to our questions, sent us the letter in the box below. We used a tool called Shodan to identify the publicly accessible site. Security consultants, students, as well as hackers, some with ill intentions, use Shodan for this purpose. No password guessing or unlawful actions were involved; this data was exposed due to a configuration error by Open V. With the URL (an IP address in this case), no technical skills were required to access the files; you simply had to click on them, and they would be available in your browser. Besides over 9,000 audio files (of which at least 1,900 were of substantial length, i.e. not merely dropped calls), the site included exposed databases, usernames, passwords and proprietary source code. One possible avenue of attack for hackers with criminal motives would be to use information gleaned from the aud
Ver más en News Today