Join Club

Arlington County Plugs Home Services Security Vulnerability

Arlington Dept. of Environmental Services web formArlington County has plugged a vulnerability in its automated services system for homeowners, after the vulnerability was brought to officials’ attention by ARLnow.com and a local IT services provider.

The vulnerability was in a phone system and website used by the Arlington Dept. of Environmental Services to automate waste pickup scheduling and water service changes.

The phone system would allow a caller to enter either an account number or their address. When one entered an address, however, the system would then provide that homeowner’s name and account number.

With the account number, one could theoretically go online and shut off the home’s water service, or order a big pile of mulch to be delivered to their yard and billed to their account.

ARLnow.com tested the vulnerability and came one click away from sending a big mulch pile to the front yard of a national media personality who lives in Arlington. Through a spokeswoman, that individual declined to comment or be identified in this article.

Within a week of ARLnow.com notifying the county, the automated phone system had been taken offline — callers now only have the option of speaking to a customer service representative — and some account number fields were removed from online forms.

“Our approach is customer-focused and to make it convenient for residents to make service requests, order mulch and report problems through the County website or by telephone,” said Dept. of Environmental Services spokeswoman Jessica Baxter. “It is a philosophy our customers value based on their feedback.”

“To date, we have not had a problem with people misusing the system,” Baxter continued. “As with any system, we are always looking for ways to improve while balancing the needs of our customers. Thanks for bringing this matter to our attention.”

Alexander Chamandy, the founder of Arlington-based IT services firm Envescent, LLC, was the first to spot the vulnerability.

“I discovered this unauthorized information disclosure issue by accident when scheduling a curbside pickup with Arlington,” he said. “It was disconcerting that one’s account information, name, address and other details could be shared with an unauthorized party. Because identity theft and data breaches are on the rise I felt it was important to alert ARLnow.com and Arlington County.”

Recent Stories

Arlington County police are warning about some common scams that residents have been reporting. The scams involve calls to victims from people impersonating law enforcement personnel, attorneys or even a…

Both Loyal Companion pet stores in Arlington are closing within a few weeks. Parent company Independent Pet Partners announced it was filing for Chapter 11 bankruptcy earlier this week and…

Morning Notes

National Win for Local Girls — “Congratulations to the 10U Virginia Hurricanes for winning the organization’s FIFTH NFL Flag Football National Championship this weekend at the NFL Pro Bowl in…

A 3 BD/2 BA home with an oversized kitchen, renovated bathrooms and wrap around deck is included in Just Reduced.

Let the Arlingtones surprise your friend or sweetie this Valentine’s Day with a barbershop quartet singing love songs in four part a cappella harmony! Choose from a small selection of songs in our repertoire to surprise your special someone.

$75 for two songs delivered to a place of your choice by a live, in-person quartet. Includes a classy tin of chocolates, fresh red rose and personalized card. Small mileage surcharge for >5 miles outside Arlington VA.

$30 Facetime/Skype valentine- two songs delivered ‘live’ via Facetime or Skype at an agreed-on time.

$20 virtual valentine- two pre-recorded quartet songs delivered via email with a personalized message.

Read More

Submit your own Announcement here.

Have you noticed a striking sculpture at Monroe Street and Wilson Boulevard? It’s the Museum of Contemporary Art Arlington’s newest installation, Make Your Mark, by Arlington artist, Adam Henry. This sculpture celebrates MoCA Arlington’s rebranding and brings the museum’s energy outdoors.

On February 11, come inside when the museum’s galleries reopen with two new exhibitions: Rebecca Rivas Rogers: Grey View and Crisis of Image.

Grey View, in the Wyatt Resident Artist Gallery, is an homage to “gray” and a snapshot of the artist’s process. Consisting of photographs, collage, and a site-specific installation, this show is an outgrowth of Rivas-Rogers’ visual investigations into places you see on your way to somewhere else.

On the main level, Crisis of Image features artists who seek equity in today’s saturated visual world by developing new methods related to the production of images.

Read More

Submit your own Announcement here.

Valentine Pop-Up at George Mason University

Valentine gifts for someone special or for yourself are here at George Mason University from noon -4pm on February 14, 2023. Satisfy your sweet tooth with Kingsbury Chocolates, find a handmade bag from Karina Gaull, pick up treats from Village

Standup Comedy Showcase Starring Matt Ruby (Comedy Central)

Dead Horse Comedy Productions brings together top comedians from the DMV and beyond for a live standup comedy show!

Matt Ruby, Headliner

Matt Ruby is a comedian, writer, and filmmaker from New York City. His comedy has been filmed by

×

Subscribe to our mailing list