Language Selection

English French German Italian Portuguese Spanish

Glitch on Verizon Wireless Web Site Left Data at Risk

Filed under
Security

Verizon Wireless said yesterday that computer programming flaws in its online billing system could have allowed customers to view account information belonging to other customers, possibly exposing limited personal information about millions of people.

A spokesman for the Bedminster, N.J., company, a joint venture between Verizon Communications Inc. and Vodafone Group PLC, declined to say how many of the company's 45 million subscriber accounts were at risk. Verizon Wireless said the problem appeared to be limited to accounts for customers in the eastern United States who had signed up for its "My Account" feature.

There was no indication that anyone took advantage of the flaws or that any customer financial information, such as Social Security or credit card account numbers, was disclosed, Verizon Wireless spokesman Tom Pica said. The flaws also did not allow access to phone numbers associated with customers' incoming and outgoing calls, and "no customer data could be manipulated and changed in any way," Pica said.

Verizon Wireless said it had corrected the problem as of 2 a.m. yesterday. Pica said the company was still assessing whether it would notify customers about the situation.

The "My Account" feature has been available on the Verizon Wireless Web site for five years. Pica said the company does not yet know how long the flawed coding had been in place.

Pica confirmed the Web site flaw could have allowed a user to view another subscriber's balance of remaining airtime minutes and the number of minutes that customer had used in the current billing cycle. Two other flaws could have exposed data about a customer's general location -- city and state -- and the make and model of phone the customer uses, Pica said.

The flaw that exposed account information was reported to Verizon Wireless by Jonathan Zdziarski, a software developer from Milledgeville, Ga., who said he discovered it while writing a computer program that would automatically query his account online and report the number of minutes he had used from his wireless plan.

Zdziarski found that by simply entering another subscriber's wireless phone number on a particular portion of the site, he could pull up some information about that person's account.
Pica said the flaws did not expose customer account balances or latest payment information. But Zdziarski provided washingtonpost.com with a screenshot showing that the vulnerabilities exposed account balances and the date of the most recent payment, a claim that Pica said the company could not confirm.

After Zdziarski's alert, Verizon Wireless technicians reviewed other portions of the company's billing system and fixed one flaw but disabled the feature that allowed viewing of customer location until technicians could figure out a way to secure it, according to Pica.
Zdziarski said he later conducted other tests and found that the problem he discovered also could be exploited to transfer one customer's account to another handset, a technique known as "cloning."

The user of a cloned phone can intercept all of the victim's incoming wireless calls and make calls that would be billed to the victim's account. Zdziarski said he was prevented from fully testing whether the flaw could be used to clone Verizon Wireless phones because the service that allows customers to map existing phone numbers to new handsets appeared to be offline when he reported the flaw.

"This was a very easy hack to do," Zdziarski said. "I'm sure if I've discovered it, then certainly your typical 'script kiddie' could figure it out."

Pica said company technicians were unable to reproduce the phone-cloning scenario described by Zdziarski.

One of Verizon Wireless's competitors, Bellevue, Wash.-based T-Mobile International, disclosed in January that a security hole in its Web site exposed data on at least 400 customers, including a Secret Service agent. This year, a group of hackers used other flaws in T-Mobile's site to break into the phones of dozens of celebrities in an incident that exposed racy photographs and personal notes and contacts for hotel heiress and socialite Paris Hilton.

By Brian Krebs
The Washington Post

More in Tux Machines

Ubuntu Server: The smart person's guide

Ubuntu Server is an open source platform that does more than you might think. With its ability to serve as an internal company server or to scale all the way up and out to meet enterprise-level needs, this operating system can do it all. This smart person's guide is an easy way to get up to speed on Ubuntu Server. We'll update this guide periodically when news and updates about Ubuntu Server are released. Read more

Rockstor 3.9.0 NAS Distro Adds Big Enhancements to the Disk Management Subsystem

Suman Chakravartula from the Rockstor project, an open-source NAS (Network-attached storage) solution using the Linux kernel and Btrfs file system, announced the general availability of Rockstor 3.9.0. Read more

Escuelas Linux 5.2 Officially Released with LibreOffice 5.3.1 & Google Chrome 57

Alejandro Diaz informs Softpedia today about the general availability of Escuelas Linux 5.2, the newest and most advanced version of his Bodhi/Ubuntu-based GNU/Linux distribution designed for educational purposes. Read more

today's leftovers

  • Linux Kernel Podcast for 2017/03/21
  • Announcing the Shim review process [Ed: accepting rather than fighting very malicious things]
    However, a legitimate criticism has been that there's very little transparency in Microsoft's signing process. Some people have waited for significant periods of time before being receiving a response. A large part of this is simply that demand has been greater than expected, and Microsoft aren't in the best position to review code that they didn't write in the first place.
  • rtop – A Nifty Tool to Monitor Remote Server Over SSH
    rtop is a simple, agent-less, remote server monitoring tool that works over SSH. It doesn’t required any other software to be installed on remote machine, except openSSH server package & remote server credentials.
  • Chakra GNU/Linux Users Get KDE Plasma 5.9.3 and KDE Applications 16.12.3, More
    Neofytos Kolokotronis from the Chakra GNU/Linux project, an open-source operating system originally based on Arch Linux and the KDE Plasma desktop environment, announced the availability of the latest KDE updates in the distro's repositories. Those of you using Chakra GNU/Linux as your daily drive will be happy to learn that the stable repos were filled with numerous up-to-date packages from the recently released KDE Plasma 5.9.3 desktop environment, KDE Applications 16.12.3 software suite, and KDE Frameworks 5.32.0 collection of over 70 add-on libraries for Qt 5.
  • YaST Team: Highlights of YaST development sprint 32
    One of the known limitations of the current installer is that it’s only able to automatically propose an encrypted schema if LVM is used. For historical reasons, if you want to encrypt your root and/or home partitions but not to use LVM, you would need to use the expert partitioner… and hope for the best from the bootloader proposal. But the new storage stack is here (well, almost here) to make all the old limitations vanish. With our testing ISO it’s already possible to set encryption with just one click for both partition-based and LVM-based proposals. The best possible partition schema is correctly created and everything is encrypted as the user would expect. We even have continuous tests in our internal openQA instance for it. The part of the installer managing the bootloader installation is still not adapted, which means the resulting system would need some manual fixing of Grub before being able to boot… but that’s something for an upcoming sprint (likely the very next one).
  • Debian stretch on the Raspberry Pi 3 (update) (2017-03-22)
    I previously wrote about my Debian stretch preview image for the Raspberry Pi 3.
  • Asus Tinker Board – Chromium YouTube Performance
    One of the many strengths of the Asus Tinker Board is its multimedia support. This 4K video capable machine is a mouthwatering prospect for the multimedia enthusiast. The machine has a respectable 1.8GHz ARM Cortex-A17 quad-core processor. It’s only 32-bit (unlike the Raspberry Pi 3) but has a higher clock speed. The Tinker Board also sports an integrated ARM-based Mali T764 graphics processor (GPU).