Royal Mail cyber security still a mess, say infosec researchers

[TrueBlueTerrier]

https://www.theregister.com/2023/11/13/ ... y_still_a/

INFOSEC IN BRIEF After spending almost a year cleaning up after various security snafus, the UK's Royal Mail has left an open redirect flaw on one of its sites, according to infosec types. We're told this vulnerability potentially exposes customers to malware infections and phishing attacks.

Open redirects essentially allow attackers to use a legitimate website or a web application – in this case, a Royal Mail website – to redirect users to a malicious website by manipulating the URL. It occurs when the application doesn't validate user input, so miscreants can manipulate it as they please.

Once they've tricked users into going to a fake website, criminals can steal credentials and financial account information, or fool visitors into downloading malware.

According to a Cybernews investigating team, one of the British postal service's websites has this type of security flaw, which potentially sets customers up for phishing attacks. The researchers did not say which site has the issue, since it appears to be still actively exploitable.

"We've repeatedly informed the company about the flaw, and the site in question has been down for months now, indicating that Royal Mail is working to mitigate the issue or has already done so," Cybernews's Jurgita Lapienytė explained. "The company has yet to respond to our requests for comments."

The Register hasn't heard back, either.