Language Selection

English French German Italian Portuguese Spanish

Glitch on Verizon Wireless Web Site Left Data at Risk

Filed under
Security

Verizon Wireless said yesterday that computer programming flaws in its online billing system could have allowed customers to view account information belonging to other customers, possibly exposing limited personal information about millions of people.

A spokesman for the Bedminster, N.J., company, a joint venture between Verizon Communications Inc. and Vodafone Group PLC, declined to say how many of the company's 45 million subscriber accounts were at risk. Verizon Wireless said the problem appeared to be limited to accounts for customers in the eastern United States who had signed up for its "My Account" feature.

There was no indication that anyone took advantage of the flaws or that any customer financial information, such as Social Security or credit card account numbers, was disclosed, Verizon Wireless spokesman Tom Pica said. The flaws also did not allow access to phone numbers associated with customers' incoming and outgoing calls, and "no customer data could be manipulated and changed in any way," Pica said.

Verizon Wireless said it had corrected the problem as of 2 a.m. yesterday. Pica said the company was still assessing whether it would notify customers about the situation.

The "My Account" feature has been available on the Verizon Wireless Web site for five years. Pica said the company does not yet know how long the flawed coding had been in place.

Pica confirmed the Web site flaw could have allowed a user to view another subscriber's balance of remaining airtime minutes and the number of minutes that customer had used in the current billing cycle. Two other flaws could have exposed data about a customer's general location -- city and state -- and the make and model of phone the customer uses, Pica said.

The flaw that exposed account information was reported to Verizon Wireless by Jonathan Zdziarski, a software developer from Milledgeville, Ga., who said he discovered it while writing a computer program that would automatically query his account online and report the number of minutes he had used from his wireless plan.

Zdziarski found that by simply entering another subscriber's wireless phone number on a particular portion of the site, he could pull up some information about that person's account.
Pica said the flaws did not expose customer account balances or latest payment information. But Zdziarski provided washingtonpost.com with a screenshot showing that the vulnerabilities exposed account balances and the date of the most recent payment, a claim that Pica said the company could not confirm.

After Zdziarski's alert, Verizon Wireless technicians reviewed other portions of the company's billing system and fixed one flaw but disabled the feature that allowed viewing of customer location until technicians could figure out a way to secure it, according to Pica.
Zdziarski said he later conducted other tests and found that the problem he discovered also could be exploited to transfer one customer's account to another handset, a technique known as "cloning."

The user of a cloned phone can intercept all of the victim's incoming wireless calls and make calls that would be billed to the victim's account. Zdziarski said he was prevented from fully testing whether the flaw could be used to clone Verizon Wireless phones because the service that allows customers to map existing phone numbers to new handsets appeared to be offline when he reported the flaw.

"This was a very easy hack to do," Zdziarski said. "I'm sure if I've discovered it, then certainly your typical 'script kiddie' could figure it out."

Pica said company technicians were unable to reproduce the phone-cloning scenario described by Zdziarski.

One of Verizon Wireless's competitors, Bellevue, Wash.-based T-Mobile International, disclosed in January that a security hole in its Web site exposed data on at least 400 customers, including a Secret Service agent. This year, a group of hackers used other flaws in T-Mobile's site to break into the phones of dozens of celebrities in an incident that exposed racy photographs and personal notes and contacts for hotel heiress and socialite Paris Hilton.

By Brian Krebs
The Washington Post

More in Tux Machines

System76's Pop!_OS Linux to Get a Beta Release Next Week with HiDPI Improvements

System76 is getting ready to unleash the first Beta release of their upcoming Pop!_OS Linux distribution, which should be available to download next week based on the Ubuntu 17.10 Final Beta. It appears that System76's development team recently dropped focus on the Pop!_OS Installer, which they develop in collaboration with the elementary OS team, to concentrate on fixing critical bugs and add the final touches to the Beta release. They still need to add some patches to fix backlight brightness issues on Nvidia GPUs. Read more

Server: Red Hat, Security, Samba, Docker, Microsoft Canonical and MongoDB

PocketBeagle and Android

Desktop: AKiTiO Node, Ubuntu Podcast, Vivaldi, Chromium and HUION PenTablet

  • AKiTiO Node: Testing NVIDIA eGPU Support in Ubuntu 17.10
    Ever since the announcement of Intel’s Thunderbolt 3 technology there has been external graphics card (eGPU) support. Unfortunately for most of last year, including with Intel’s own Skull Canyon NUC, putting this solution to use was challenging at best. Most motherboards didn’t fully support the technology and those that did typically required a system that was far more expensive. For example, the Skull Canyon NUC at release was $700, unconfigured. Adding SSDs and RAM usually bumped that up well over $1000.
  • Ubuntu Podcast from the UK LoCo: S10E29 – Adamant Terrible Hammer
    It’s Season Ten Episode Twenty-Nine of the Ubuntu Podcast! Alan Pope, Martin Wimpress, Marius Quabeck, Max Kristen, Rudy and Tiago Carrondo are connected and speaking to your brain.
  • Vivaldi 1.12 Web Browser Debuts with Highly Requested Features, Improvements
    Vivaldi, the Chromium-based web browser designed with the power user in mind, has been recently updated to version 1.12, a release that introduces highly requested features and a whole lot of under-the-hood improvements. There are three big new features implemented in Vivaldi 1.12. The first is a built-in Image Properties feature that works when you right-click on an image on the Web, showing you a bunch of useful information, such as camera model, depth of field, ISO sensitivity, focal length, exposure, histogram, time and date, and white balance.
  • Chromium Will Soon Let You Browse the Web in VR with a Daydream View Headset
    Chromium evangelist François Beaufort posted today on his Google+ profile information regarding the VR (Virtual Reality) capabilities of the open-source web browser, which is the base of Chrome OS and Google Chrome. It would appear that the Chromium team is working on a set of new virtual reality features for the web browser, which means that more VR goodies are coming to popular Chromium-based web browsers like Opera, Vivaldi, and Google Chrome.
  • libinput and the HUION PenTablet devices
    HUION PenTablet devices are graphics tablet devices aimed at artists. These tablets tend to aim for the lower end of the market, driver support is often somewhere between meh and disappointing. The DIGImend project used to take care of them, but with that out of the picture, the bugs bubble up to userspace more often.