Language Selection

English French German Italian Portuguese Spanish

Glitch on Verizon Wireless Web Site Left Data at Risk

Filed under
Security

Verizon Wireless said yesterday that computer programming flaws in its online billing system could have allowed customers to view account information belonging to other customers, possibly exposing limited personal information about millions of people.

A spokesman for the Bedminster, N.J., company, a joint venture between Verizon Communications Inc. and Vodafone Group PLC, declined to say how many of the company's 45 million subscriber accounts were at risk. Verizon Wireless said the problem appeared to be limited to accounts for customers in the eastern United States who had signed up for its "My Account" feature.

There was no indication that anyone took advantage of the flaws or that any customer financial information, such as Social Security or credit card account numbers, was disclosed, Verizon Wireless spokesman Tom Pica said. The flaws also did not allow access to phone numbers associated with customers' incoming and outgoing calls, and "no customer data could be manipulated and changed in any way," Pica said.

Verizon Wireless said it had corrected the problem as of 2 a.m. yesterday. Pica said the company was still assessing whether it would notify customers about the situation.

The "My Account" feature has been available on the Verizon Wireless Web site for five years. Pica said the company does not yet know how long the flawed coding had been in place.

Pica confirmed the Web site flaw could have allowed a user to view another subscriber's balance of remaining airtime minutes and the number of minutes that customer had used in the current billing cycle. Two other flaws could have exposed data about a customer's general location -- city and state -- and the make and model of phone the customer uses, Pica said.

The flaw that exposed account information was reported to Verizon Wireless by Jonathan Zdziarski, a software developer from Milledgeville, Ga., who said he discovered it while writing a computer program that would automatically query his account online and report the number of minutes he had used from his wireless plan.

Zdziarski found that by simply entering another subscriber's wireless phone number on a particular portion of the site, he could pull up some information about that person's account.
Pica said the flaws did not expose customer account balances or latest payment information. But Zdziarski provided washingtonpost.com with a screenshot showing that the vulnerabilities exposed account balances and the date of the most recent payment, a claim that Pica said the company could not confirm.

After Zdziarski's alert, Verizon Wireless technicians reviewed other portions of the company's billing system and fixed one flaw but disabled the feature that allowed viewing of customer location until technicians could figure out a way to secure it, according to Pica.
Zdziarski said he later conducted other tests and found that the problem he discovered also could be exploited to transfer one customer's account to another handset, a technique known as "cloning."

The user of a cloned phone can intercept all of the victim's incoming wireless calls and make calls that would be billed to the victim's account. Zdziarski said he was prevented from fully testing whether the flaw could be used to clone Verizon Wireless phones because the service that allows customers to map existing phone numbers to new handsets appeared to be offline when he reported the flaw.

"This was a very easy hack to do," Zdziarski said. "I'm sure if I've discovered it, then certainly your typical 'script kiddie' could figure it out."

Pica said company technicians were unable to reproduce the phone-cloning scenario described by Zdziarski.

One of Verizon Wireless's competitors, Bellevue, Wash.-based T-Mobile International, disclosed in January that a security hole in its Web site exposed data on at least 400 customers, including a Secret Service agent. This year, a group of hackers used other flaws in T-Mobile's site to break into the phones of dozens of celebrities in an incident that exposed racy photographs and personal notes and contacts for hotel heiress and socialite Paris Hilton.

By Brian Krebs
The Washington Post

More in Tux Machines

DragonBox Pyra

  • DragonBox Pyra Goes Up For Pre-Order
    It's been a while since last hearing anything about the DragonBox Pyra as an open-source gaming handheld system and successor to OpenPandora...
  • Bitcoin is Now Accepted For DragonBox Pyra Pre-orders
    It is always good to see new merchants accepting Bitcoin payments, as it goes to show businesses want to attract an international clientele. DragonBox, a ship based in Germany, recently started accepting Bitcoin payments for their Pyra computer. A neat little device, which packs quite the punch.
  • DragonBox Pyra pre-orders begin (open Source handheld gaming PC)
    The DragonBox Pyra is a portable computer that looks like a cross between a tiny laptop and a Nintendo DX game console… and it kind of works like a cross between those devices as well. It’s got a 5 inch display, a QWERTY keyboard, the Debian Linux operating system that can handle desktop apps as well as games, and physical gaming buttons.

DragonBox Pyra pre-orders begin (open Source handheld gaming PC)

The DragonBox Pyra is a portable computer that looks like a cross between a tiny laptop and a Nintendo DX game console… and it kind of works like a cross between those devices as well. It’s got a 5 inch display, a QWERTY keyboard, the Debian Linux operating system that can handle desktop apps as well as games, and physical gaming buttons. It’s been under development for several years, and it’s expected to be available for purchase soon for about 500 Euros (plus VAT). But if you want to help fund the developers you can now place a pre-order for 330 Euros and up. Read more

today's leftovers

  • How Linux Frustrated Me Into Loving It
    I have been very interested in Linux since my entry into the Wonderful World of Unix in 2006. I found Ubuntu and installed it on a crappy Dell desktop computer I was given when I was doing online schooling. The computer originally came with Windows, and one day while I was browsing, I decided to search for “alternative to Windows.” Linux popped up right away. I had never heard of Linux before, but after voraciously reading article after article, I decided Linux was the path for my future.
  • HP Chromebook 13 is a business-focused Chrome OS laptop with USB-C
    In the grand scheme of things, Chrome OS is hardly a major player from a desktop market share perspective -- for now. With that said, the Linux-based operating system has captured the hearts and minds of many consumers. It has matured quite a bit too, becoming a viable Windows alternative for home users. Actually, it is a great choice for some businesses too -- depending on needs, of course.
  • Summary: Linux Scheduler: A decade of wasted cores - Part 1 - What is NUMA ?
    Last month, a research paper with title 'The Linux Scheduler: a Decade of Wasted Cores' was trending on the front page of HN. As an individual who is interested in Systems, I thought it would be good idea to read this 16 page research paper. I spent a good amount of time learning about different topics which were involved in it. This is the first post in the series in which I will try to summarize the paper.
  • Vulkan 1.0.12 Specification Update Adds VK_AMD_rasterization_order
  • GTK+ 3.22 Is Working On An OpenGL Renderer & Scene Graph
    Matthias Clasen of Red Hat has written an update about changes to GNOME's GTK+ tool-kit for the 3.20 cycle but he also mentions some of the exciting work that's brewing for GNOME/GTK+ 3.22. Clasen's latest blog post covers some of the recent internal changes to GTK+ CSS, theme changes, various changes facing application developers, and more. Those interested about the GTK+ tooling changes can read the blog post.
  • Bunsenlabs Rc2
  • April is almost gone
    The second one was the release of pre-release isos of Mageia 6 and OpenMandriva Lx 3. I must say that both distros are doing a great job; the systems performed so well that they did not seem beta versions to me. I did not like Plasma 5, though... I am sure the KDE team is doing a great work, but I truly do not see what the point of this tablet-ready interface is. After all, KDE missed the tablet train (the Vivaldi tablet never saw the light of the day) and tablets are already in decline...
  • New BlackArch Linux version released, now provides 1400 pentesting tools
    BlackArch Linux version 2016.04.28 released for ethical hackers and security researchers with 1400 pentesting tools
  • Manjaro 16.06 - third preview released
    It took us almost another month to prepare this third preview of our upcoming stable release we call Daniella. The Xfce edition remains our flagship offering and has received the attention it deserves. Few can claim to offer such a polished, integrated and leading-edge Xfce experience. We ship Xfce 4.12 with this release of Manjaro. We mainly focused on polishing the user experience on the desktop and window manager, and on updating some components to take advantage of newly available technologies such as switching to a new theme called Maia, we already using for our KDE edition.
  • IoT Past and Present: The History of IoT, and Where It's Headed Today [Ed: just devices with a network stack. Nothing new.]
  • 1btn – an Open Source Dash
    The availability of cheap radios, omni-present WiFi and powerful web services means the IoT wave is here to stay. Amazon got into the act with its “do only one thing” Dash button. But a more interesting solution would be an IoT “do it all” button.
  • No Time to Panic as One Quarter Shows Minor Dip in Smartphone Sales - Total Smartphone Market Will Grow This Year (and here's why)
    We now have the Q1 numbers from Strategy Analytics and IDC, the two last remaining of the classic four big smartphone industry analyst houses we used on this blog to calculate the industry average of the total market size, back when the 'smartphone bloodbath' started six years ago. And both SA and IDC are in exceptional, near-perfect agreement on the exact size of the market, we get a total smartphone market for Q1 at 334.8 Million units. That is down 18% from the Christmas sales Quarter (normal that Q1 is down) but for the first time ever in this industry, the YEAR-ON-YEAR comparison of Q1, so the January-March quarter last year 2015 vs now, is down. This has not happened in the smartphone industry in any YoY period. And some are now talking about 'peak smartphone'. That number COULD be a signal that smartphone industry growth has stalled and now peaked and smartphone sales will either plateau flat, or decline into the next year(s).
  • GhostBSD 10.3 Alpha Released With ZFS File-System Support, MATE 1.12
    The first alpha release was made available this weekend of GhostBSD 10.3 Alpha 1, a desktop focused operating system built atop FreeBSD 10.3.
  • 3D Printer Crowdfunding projects
    Like every Kickstarter project, there is a risk. But I think that Trinus appears to be a good project, we need to wait to the launch and review a real machine to know if it worth it. Also, the Youtube Channel Maker’s Muse, made a review of the project and the company Konama, creators of Trinus, sent him a the 3d printer and he currently makes the review of this printer that pledged more then 1 million dollars on KickStarter.
  • Refactoring the open-source photography community
    Generally speaking, most free-software communities tend to form around specific projects: a distribution, an application, a tightly linked suite of applications, and so on. Those are the functional units in which developers work, so it is a natural extension from there to focused mailing lists, web sites, IRC channels, and other forms of interaction with each other and users. But there are alternatives. At Libre Graphics Meeting 2016 in London, Pat David spoke about his recent experience bringing together a new online community centered around photographers who use open-source software. That community crosses over between several applications and libraries, and it has been successful enough that multiple photography-related projects have shut down their independent user forums and migrated to the new site, PIXLS.US.
  • DIY recycling, UCONN's open source chemistry book, and more news

Leftovers: Software