A major vulnerability in the Companies House website enabled free access to the “dashboard” of any of the five million registered companies. It revealed directors’ home addresses and email addresses, and appears to have enabled modification of company and director details – even filing of accounts.
The vulnerability was discovered yesterday by John Hewitt at Ghost Mail, a corporate services provider. He got in touch with us immediately. We verified the issue and alerted Companies House immediately. Their systems have now been temporarily shut down, which is why we are publishing. The FT have the story here.
It’s best demonstrated with this short video. It shows me using the vulnerability to view the private Companies House dashboard of ClarityDW Ltd, a digital communications consultancy owned by Jonathan Phillips. Jonathan kindly gave us permission to do this:
When John first told me, I assumed it was a highly technical exploit or “hack”. It was nothing of the sort. All that was required was to log in to Companies House using your own details and access your own company’s dashboard. Then opt to “file for another company” and enter the company number for any one of the five million companies registered with Companies House. At that point you’d be asked for an authentication code, which of course you don’t have. No problem. Press the “back” key a few times to return to your dashboard. Except – it isn’t your dashboard. It’s the other company’s dashboard.
When John first showed this, I thought it might be something odd about his account or his computer. So I verified myself – and it worked immediately. It reveals all the information usually available on the dashboard, including private information that’s not shown, such as personal email addresses and full dates of birth (and you can see that in the video, with Jonathan’s personal information masked).
We also verified that the vulnerability appeared to enable editing. John Hewitt, with my permission, edited my home address for a company that I own. The system appeared to accept this in the same way as any normal edit (although we don’t know at this point if it would have taken effect). It also looks like it was possible to file accounts.
We told Companies House of the vulnerability as soon as we became aware of it; soon afterwards, the web filing system shut down, presenting this:
We received this response from Companies House’s press office:
And the service availability page says:
The obvious questions are:
- How long was Companies House’s website vulnerable to this “exploit” (if we can call it that)? Hours, days or months? Research suggests an exploit will, on average, be exploited within 15 days.
- Can Companies House track the usage of the exploit, and see which companies were impacted?
There are obvious security and GDPR implications of revealing directors’ home and email addresses for millions of companies. All the more so if nobody knows which companies were impacted by the vulnerability.
Thanks most of all to John Hewitt at Ghost Mail. I hope he receives formal thanks from Companies House.
And thanks to Jonathan Phillips for helping verify the vulnerability, and allowing his own company to be used as a guinea pig.
Herran Finance – another fake bank at Companies House
Who’s behind the fake banks on Companies House?
UK companies with no UK director are 17× more likely to show signs of fraud
How criminals use “muppets” to commit corporate fraud – and how to stop them
Who is Michail Roerich, and why did he build the world’s most convincing fake companies?
Leave a Reply to Damian Williams Cancel reply