Directory Traversal Flaw Found in Companies House
The British government’s company register service was forced to temporarily deactivate its online filing service after someone found a serious vulnerability that allowed people to access directors’ sensitive personal data and potentially even amend companies’ records or file bogus accounts on their behalf.
See Also: Free Your IT Program of Tech Debt With an Enterprise Browser (eBook)
The Information Commissioner’s Office is now looking into the Companies House incident, the privacy regulator confirmed to Information Security Media Group on Monday.
There is no evidence that the vulnerability was maliciously exploited, though it has been present for around five months. Company directors in the United Kingdom are being urged to check their details on the Companies House platform nonetheless.
The flaw was discovered on Thursday by John Hewitt, operations director at corporate services firm Ghost Mail, who then alerted tax lawyer Dan Neidle, founder of the nonprofit Tax Policy Associates. It was Neidle who made Companies House aware of the flaw, after which he told the wider world in a Friday blog post.
Neidle described how Hewitt had demonstrated to him his ability to view another firm’s private Companies House dashboard, revealing information that is not usually exposed to the public, such as email addresses and full dates of birth for the firm’s directors.
“These are precisely the kinds of data used for fraud: impersonation, phishing, identity checks and social engineering – particularly targeting directors of small companies [as large companies generally have systems that mean one person alone cannot authorize payments],” Neidle wrote.
Neidle said in the post that exploiting the flaw did not require much technical knowledge. “All that was required was to log in to Companies House using your own details and access your own company’s dashboard. Then opt to ‘file for another company’ and enter the company number for any one of the five million companies registered with Companies House. At that point you’d be asked for an authentication code, which of course you don’t have. No problem. Press the ‘back’ key a few times to return to your dashboard. Except – it isn’t your dashboard. It’s the other company’s dashboard.”
Companies House CEO Andy King said in an apologetic Monday statement that the agency shuttered its WebFiling system early on Friday afternoon, reopening it at the start of Monday after resolving the issue and ensuring that the fix was “independently tested.” King said the vulnerability seemed to have been present since an update of the system in October last year.
“Our investigation has established that specific data from individual companies not normally published on the Companies House register may have been visible to other logged-in WebFiling users. This includes dates of birth, residential addresses and company email addresses. It may also have been possible for unauthorised filings – such as accounts or changes of director – to have been made on another company’s record,” King wrote.
“We believe that this issue could not have been used to extract data in large volumes or to access records systematically,” King added. “Any access would have been limited to individual company records, viewed one at a time by a registered WebFiling user.”
King said the agency had reported the incident to the ICO and to the National Cyber Security Centre. “We can confirm we have received a report from Companies House and are assessing the information provided,” the ICO said Monday, adding that business owners should be “checking regularly” for updates from Companies House and “following their advice.”
All companies should “check their registered details and filing history to make sure everything appears correct,” King wrote. If not, they should alert the agency and “include evidence to describe the concern.”
“If we find evidence that anyone has used this issue to access or change another company’s details without authorization, we will take firm action,” the agency chief wrote.