The Nigeria Police Force’s official website has become unsafe for visitors and vulnerable to hackers, PulseNets has learnt.
Following a tipoff from sources, PulseNets visited the npf.gov.ng website on Wednesday and found an error message indicating safety lapses and no guarantees of privacy.
“Your connection is not private,” the site read. “Attackers might be trying to steal your information from npf.gov.ng (for example, passwords, messages, or credit cards).”
This, PulseNets gathered, happened because the website’s Secure Socket Layer (SSL) has expired and its administrators are yet to renew it. This layer makes all the difference between a secure Uniform Resource Locator (URL) and an insecure one.
“It did not expire today,” a source told PulseNets on condition of anonymity. “It expired sometime back, but if we complain, no one will do anything about it.”
Not having this certificate violates section 7.2 of the guidelines stipulated by the National Information Technology Development Agency (NITDA) for government websites.
“Government Institutions shall: i. ii. iii. Commit to a continuous process of maintaining the security of Web Servers to ensure continued security. Use authentication and cryptographic technologies as appropriate to protect certain types of sensitive data with differing access privileges. It is recommended that SSL be used for any cryptographic implementation,” the guidelines read in part.
Meanwhile, renewing an SSL could be free or cost anywhere between $5 and $59, Francis Ihejirijka, a software developer, told PulseNets.
Francis said the certificate should exist to encrypt messages between the browser and the server. Without it, the visitor’s browser would be transmitting vulnerable messages and activities to the website, making it possible for hackers to intercept them.
Also Read: Nigeria Police Force (NPL) arrests popular social media content creator, ZFancy
“If one is sending sensitive information via a form or any other means on the site, a bad actor can intercept that data and cause havoc with it,” Francis told PulseNets. “If they leave the site like that, everyone who visits will see the error and will be vulnerable to leaks.”
PulseNets called Muyiwa Adejobi, Force Public Relations Officer (FPRO), but he did not take our calls. At press time, he had yet to respond to a text message sent to him.
