HotelHippo offline after security pro finds flaws

Share this article:

The HotelHippo hotel booking site has been taken offline after a customer who is a security expert said the site's IT systems were riddled with security flaws, according to his blog post.

While trying to book accommodations Scott Helme found that he could access information about others who had previously booked through the service.

It's possible to “start walking backwards through the booking reference numbers, which are sequential, and pull out the data associated with each one,” Helme wrote, though no credit card information was made available.

Helme uncovered a SQL injection vulnerability and failures to comply with PCI standards. He also noted concerns about HTTPs configurations. Helme alerted HotelHippo to the flaws June 25, and after the BBC got involved, the company released a statement saying it was taking “urgent action” to make fixes. The Information Commissioner's Office is investigating.


[An earlier version of this story incorrectly identified Scott Helme as Steve Helme.]
Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Information sharing requires breaking down barriers, White House cyber guru says

Information sharing requires breaking down barriers, White House ...

The White House has advanced an agenda to promote and facilitate information sharing on security threats and vulnerabilities.

Worm variant of Android ransomware, Koler, spreads via SMS

Worm variant of Android ransomware, Koler, spreads via ...

Upon infection, the Koler variant will send an SMS message to all contacts in the device's address book.

Patch for Windows flaw can be bypassed, prompts temporary fix from Microsoft

Patch for Windows flaw can be bypassed, prompts ...

The Windows zero-day received a patch last week, but the fix can still be bypassed by crafty attackers.