Neighbourhood Watch (NW) teams across the UK can now rest easy knowing that the developers behind a communications platform have fixed a bug in their web application that massively leaked their data .
See also: OWASP reveals it suffered a data breach
Nottingham -based VISAV is the company behind Neighborhood Alert , a platform that, among other things, claims to offer a secure messaging system between registered members of the Neighborhood Watch community and authorized administrators.
Neighbourhood Alert is accessible via web and mobile apps approved by national and regional local authorities across the UK. It has more than half a million users, according to its website.
In late March, a user reported a security issue to El Reg that allowed anyone to sign up as a Neighborhood Watch coordinator on the platform and create what’s known as a shape. This can be a sub-area, such as a 15-street block, within a larger area, such as a city. After selecting a shape — which was done by drawing an area within the platform’s digital map integration as large as they wanted — those who created the shape could see all the Neighborhood Watch members in that area.
See also: AT&T denies data leak allegations
The problem was that these moderators essentially didn't have to go through an approval or verification process. The data was accessible immediately after registering with credentials.
An investigation by The Register revealed that anyone could sign up using a fake name, email address and postcode to gain access to a range of personal data on UK citizens within minutes.
After drawing a shape, unverified users could choose to view the details of each registered Neighborhood Watch member in this area, which included full names, home and email, phone numbers (where provided), and small profile pictures.
Those who signed up to the platform's development from Greater Manchester could create a plan that would take in data from thousands of people. The same was true in other areas, according to trials.
See also: Viamedis: Data leak threatens millions of citizens
What are the preventive measures to avoid data leaks?
One of the most important preventive measures to avoid data leaks, as in the case of Neighborhood Watch, is to implement a strong access management system. This includes using multi-factor authentication, implementing least privilege policies, and monitoring data. In addition, it is essential to keep software and hardware updated. User education is also crucial. Users must be aware of the risks associated with data security and good practices to avoid leaks, such as avoiding sharing sensitive information through unsecured channels. Finally, using tools and techniques to protect data, such as encryption and encryption key management, can help prevent data breaches.
Source: theregister
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
