3

This question already has an answer here:

I'm a paying customer of a service. I can't change provider without damaging my own business.

I believe the website is vulnerable to very basic vulnerabilities (url tampering (IDOR)) that would disclose my personal information and potentially worse.

The admin denies the site is vulnerable and will not allow me to test nor will he have the site checked by professionals.

All I can think is to report my concern to https://ico.org.uk/concerns/ but without any concrete evidence beyond passwords being stored in plain-text.

How can I ensure the site fixes basic security issues if they exist?

marked as duplicate by Philipp, Bob Brown, Xander, Neil Smithline, Rory Alsop Jan 3 '16 at 10:58

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 3
    You really need to switch providers. If true, you have just outlined 2 potential security issues (passwords in plaintext and information disclosure via URL tampering). Can you elaborate more on how switching providers will damage your business? – mk444 Jan 2 '16 at 12:27
  • I don't know concerning the Computer Misuse Act, but your suggestion will most likely be at least a violation of your end user's contract with this provider... – WhiteWinterWolf Jan 2 '16 at 14:47
4

If you cannot (at least easily) switch providers (I assume that you are locked in to a service which cannot be moved) then you have to have a few things covered. For you, your business and your customers (if they make use of the service).

To start with, I am not a lawyer so you will be better off discussing this with a lawyer.

First read your service contract: is there anything about "reasonable efforts" the provider is supposed to make, from a security standpoint? If so, there are industrial best practices about how an application should be secured. You could point out to your provider that he is possibly in a breach of agreement.

Now - he may not care, knowing that you are locked in with him and resolving the issue in court is too long/complicated/whatever to you.

In that case you need to do some due diligence. The idea is that, in case of bad things happening (the service is breached, your and your customers' data is in the wild) you can prove that you have done all reasonable steps to alert about possible issues. Keep a copy of the exchanges. Then warn your admin that in case there is an issue, he will be responsible for all costs.

What you can do and the true value of your actions will considerably vary with the exact circumstances of your case. Again - consult a lawyer.

I would also strongly recommend planning for a provider switch. I am very much aware that this is not an easy option but it usually boils down to resources (time, money).

Finally, do not make any attempts to hack his site for demonstration purposes. This is not only possibly illegal (and subject to appreciation of a jury) but you may also harm his service with all the consequences (interruption for other customers for instance).

Not the answer you're looking for? Browse other questions tagged or ask your own question.