Language Selection

English French German Italian Portuguese Spanish

Glitch on Verizon Wireless Web Site Left Data at Risk

Filed under
Security

Verizon Wireless said yesterday that computer programming flaws in its online billing system could have allowed customers to view account information belonging to other customers, possibly exposing limited personal information about millions of people.

A spokesman for the Bedminster, N.J., company, a joint venture between Verizon Communications Inc. and Vodafone Group PLC, declined to say how many of the company's 45 million subscriber accounts were at risk. Verizon Wireless said the problem appeared to be limited to accounts for customers in the eastern United States who had signed up for its "My Account" feature.

There was no indication that anyone took advantage of the flaws or that any customer financial information, such as Social Security or credit card account numbers, was disclosed, Verizon Wireless spokesman Tom Pica said. The flaws also did not allow access to phone numbers associated with customers' incoming and outgoing calls, and "no customer data could be manipulated and changed in any way," Pica said.

Verizon Wireless said it had corrected the problem as of 2 a.m. yesterday. Pica said the company was still assessing whether it would notify customers about the situation.

The "My Account" feature has been available on the Verizon Wireless Web site for five years. Pica said the company does not yet know how long the flawed coding had been in place.

Pica confirmed the Web site flaw could have allowed a user to view another subscriber's balance of remaining airtime minutes and the number of minutes that customer had used in the current billing cycle. Two other flaws could have exposed data about a customer's general location -- city and state -- and the make and model of phone the customer uses, Pica said.

The flaw that exposed account information was reported to Verizon Wireless by Jonathan Zdziarski, a software developer from Milledgeville, Ga., who said he discovered it while writing a computer program that would automatically query his account online and report the number of minutes he had used from his wireless plan.

Zdziarski found that by simply entering another subscriber's wireless phone number on a particular portion of the site, he could pull up some information about that person's account.
Pica said the flaws did not expose customer account balances or latest payment information. But Zdziarski provided washingtonpost.com with a screenshot showing that the vulnerabilities exposed account balances and the date of the most recent payment, a claim that Pica said the company could not confirm.

After Zdziarski's alert, Verizon Wireless technicians reviewed other portions of the company's billing system and fixed one flaw but disabled the feature that allowed viewing of customer location until technicians could figure out a way to secure it, according to Pica.
Zdziarski said he later conducted other tests and found that the problem he discovered also could be exploited to transfer one customer's account to another handset, a technique known as "cloning."

The user of a cloned phone can intercept all of the victim's incoming wireless calls and make calls that would be billed to the victim's account. Zdziarski said he was prevented from fully testing whether the flaw could be used to clone Verizon Wireless phones because the service that allows customers to map existing phone numbers to new handsets appeared to be offline when he reported the flaw.

"This was a very easy hack to do," Zdziarski said. "I'm sure if I've discovered it, then certainly your typical 'script kiddie' could figure it out."

Pica said company technicians were unable to reproduce the phone-cloning scenario described by Zdziarski.

One of Verizon Wireless's competitors, Bellevue, Wash.-based T-Mobile International, disclosed in January that a security hole in its Web site exposed data on at least 400 customers, including a Secret Service agent. This year, a group of hackers used other flaws in T-Mobile's site to break into the phones of dozens of celebrities in an incident that exposed racy photographs and personal notes and contacts for hotel heiress and socialite Paris Hilton.

By Brian Krebs
The Washington Post

More in Tux Machines

Android Leftovers

Leftovers: OSS

  • Open-source oriented RISELab emerges at UC Berkeley to make apps smarter & more secure
    UC Berkeley on Monday launched a five-year research collaborative dubbed RISELab that will focus on enabling apps and machines that can interact with the environment around them securely and in real-time. The RISELab (Real-time Intelligence with Secure Execution) is backed by a slew of big name tech and financial firms: Amazon Web Services, Ant Financial, Capital One, Ericsson, GE Digital, Google, Huawei, Intel, IBM, Microsoft and VMWare.
  • Telecom organizations boosting support for open source
    Organizational support for open source initiatives is easing the integration of platforms into the telecom world. One key challenge for growing the support of open source into the telecommunications space is through various organizations that are looking to either bolster the use of open source or build platforms based on open source specifications. These efforts are seen as beneficial to operators and vendors looking to take advantage of open source platforms.
  • Google's Draco: Another Open Source Tool That Can Boost Virtual Reality Apps
    With 2017 ramping up, there is no doubt that cloud computing and Big Data analytics would probably come to mind if you had to consider the hot technology categories that will spread out this year. However, Google is on an absolute tear as it open sources a series of 3D graphics and virtual reality toolsets. Last week, we covered the arrival of Google's Tilt Brush apps and virtual reality toolsets. Now, Google has delivered a set of open source libraries that boost the storage and transmission of 3D graphics, which can help deliver more detailed 3D apps. "Draco" is an open source compression library, and here are more details.
  • Unpicking the community leader
    Today is Community Manager Appreciation Day. Now, I have to admit, I don't usually partake in the day all that much. The skeptic in me thinks doing so could be a little self-indulgent and the optimist thinks that we should appreciate great community leaders every day, not merely one day a year. Regardless, in respect of the occasion, I want to delve a little into why I think this work is so important, particularly in the way it empowers people from all walks of life. In 2006 I joined Canonical as the Ubuntu Community Manager. A few months into my new role I got an email from a kid based in Africa. He shared with me that he loved Ubuntu and the traditional African philosophy of Ubuntu, which translated to "humanity towards others," and this made his interest in the nascent Linux operating system particularly meaningful.
  • Open Source Mahara Opens Moodle Further Into Social Learning
    Designers, managers and other professionals are fond of Open Source, digital portfolio solution Mahara. Even students are incorporating their progress on specific competency frameworks, to show learning evidence. Mahara and Moodle have a long and durable relationship spanning years, ―so much so that the internet has nicknamed the super couple as “Mahoodle“―. A recent post on Moodlerooms’ E-Learn Magazine documents the fruitful partnership as it adds value to New Zealander Catalyst IT’s offerings.
  • U.S. policy on open source software carries IP risks [Ed: Latest FUD from law firm against Free software as if proprietary software is risk-free licensing-wise?]

Openwashing and EEE

Q&A with Arpit Joshipura, Head of Networking for The Linux Foundation

Arpit Joshipura became the Linux Foundation’s new general manager for networking and orchestration in December 2016. He’s tasked with a pretty tall order. He needs to harmonize all the different Linux Foundation open source groups that are working on aspects of network virtualization. Joshipura may be the right person for the job as his 30 years of experience is broad — ranging from engineering, to management, to chief marketing officer (CMO) roles. Most recently he was VP of marketing with Prevoty, an application security company. Prior to that he served as VP of marketing at Dell after the company acquired Force10 Networks, where he had been CMO. Read more