Language Selection

English French German Italian Portuguese Spanish

Glitch on Verizon Wireless Web Site Left Data at Risk

Filed under
Security

Verizon Wireless said yesterday that computer programming flaws in its online billing system could have allowed customers to view account information belonging to other customers, possibly exposing limited personal information about millions of people.

A spokesman for the Bedminster, N.J., company, a joint venture between Verizon Communications Inc. and Vodafone Group PLC, declined to say how many of the company's 45 million subscriber accounts were at risk. Verizon Wireless said the problem appeared to be limited to accounts for customers in the eastern United States who had signed up for its "My Account" feature.

There was no indication that anyone took advantage of the flaws or that any customer financial information, such as Social Security or credit card account numbers, was disclosed, Verizon Wireless spokesman Tom Pica said. The flaws also did not allow access to phone numbers associated with customers' incoming and outgoing calls, and "no customer data could be manipulated and changed in any way," Pica said.

Verizon Wireless said it had corrected the problem as of 2 a.m. yesterday. Pica said the company was still assessing whether it would notify customers about the situation.

The "My Account" feature has been available on the Verizon Wireless Web site for five years. Pica said the company does not yet know how long the flawed coding had been in place.

Pica confirmed the Web site flaw could have allowed a user to view another subscriber's balance of remaining airtime minutes and the number of minutes that customer had used in the current billing cycle. Two other flaws could have exposed data about a customer's general location -- city and state -- and the make and model of phone the customer uses, Pica said.

The flaw that exposed account information was reported to Verizon Wireless by Jonathan Zdziarski, a software developer from Milledgeville, Ga., who said he discovered it while writing a computer program that would automatically query his account online and report the number of minutes he had used from his wireless plan.

Zdziarski found that by simply entering another subscriber's wireless phone number on a particular portion of the site, he could pull up some information about that person's account.
Pica said the flaws did not expose customer account balances or latest payment information. But Zdziarski provided washingtonpost.com with a screenshot showing that the vulnerabilities exposed account balances and the date of the most recent payment, a claim that Pica said the company could not confirm.

After Zdziarski's alert, Verizon Wireless technicians reviewed other portions of the company's billing system and fixed one flaw but disabled the feature that allowed viewing of customer location until technicians could figure out a way to secure it, according to Pica.
Zdziarski said he later conducted other tests and found that the problem he discovered also could be exploited to transfer one customer's account to another handset, a technique known as "cloning."

The user of a cloned phone can intercept all of the victim's incoming wireless calls and make calls that would be billed to the victim's account. Zdziarski said he was prevented from fully testing whether the flaw could be used to clone Verizon Wireless phones because the service that allows customers to map existing phone numbers to new handsets appeared to be offline when he reported the flaw.

"This was a very easy hack to do," Zdziarski said. "I'm sure if I've discovered it, then certainly your typical 'script kiddie' could figure it out."

Pica said company technicians were unable to reproduce the phone-cloning scenario described by Zdziarski.

One of Verizon Wireless's competitors, Bellevue, Wash.-based T-Mobile International, disclosed in January that a security hole in its Web site exposed data on at least 400 customers, including a Secret Service agent. This year, a group of hackers used other flaws in T-Mobile's site to break into the phones of dozens of celebrities in an incident that exposed racy photographs and personal notes and contacts for hotel heiress and socialite Paris Hilton.

By Brian Krebs
The Washington Post

More in Tux Machines

Leftovers: KDE

  • KDE-5_15.09 – september release for Slackware-current
  • Kontact and GnuPG under Windows
    Kontact has, in contrast to Thunderbird, integrated crypto support (OpenPGP and S/MIME) out-of-the-box. That means on Linux you can simply start Kontact and read crypted mails (if you have already created keys). After you select your crypto keys, you can immediately start writing encrypted mails. With that great user experince I never needed to dig further in the crypto stack.
  • Randa – KDE sprints 2015
  • KDE 5 Application Dashboard: A fullscreen app launcher that beats the competition
    Fullscreen applications launchers are my favorite kind of application menus, of which there are several to choose from on the K Desktop Environment, or KDE. On KDE 4, available options are the Takeoff Launcher, Simple Welcome, and Homerun.
  • Krita 2.9.7 Released!
    Two months of bug fixing, feature implementing, Google-Summer-of-Code-sweating, it’s time for a new release! Krita 2.9.7 is special, because it’s the last 2.9 release that will have new features. We’ll be releasing regular bug fix releases, but from now on, all feature development focuses on Krita 3.0. But 2.9.7 is packed! There are new features, a host of bug fixes, the Windows builds have been updated with OpenEXR 2.2. New icons give Krita a fresh new look, updated brushes improve performance, memory handling is improved… Let’s first look at some highlights:
  • Last Krita 2.9 Release Adds New Features, Fixes 150 Bugs, Krita 3.0 Coming Next
    The development team of the popular, open-source, and cross-platform digital painting software Krita, acclaimed by numerous artists from all over the world, have announced the release of the last maintenance version of the 2.9 branch.

GIMP and GNOME Foundation

Red Hat Results, Beta Release

Fedora: The Latest

  • Flock Rochester
    I’m not going to do a day by day outline of what I did at flock, if I did it would basically be “blah blah blah I talked a lot to a lot of people about a lot of tech topics” and anyone that’s ever met me would have guessed that! It was, as in the past, a great conference. A big shout out to the organisers for an excellent event with two excellent evening events! So I’m going to give a brief summary to my talks and link to slides and video recordings.
  • Day 4 of Flock 2015
  • Write the Docs 2015
    Writing documentation is not only about writing, but actually a lot about layout, accessibility, UX and UI, too. So I actually enjoyed listening to Beth Aitman, for example (here are here slides). Among the most memorable were Elijah Caine with his talk about writing emails, which I really really hope more people could listen to, and Christina Elmore talking about creative problem solving. One of my personal favorites was a lightning talk by Marcin Warpechowski about laptop stickers! TL;DR – stickers are a great way to engage employees and the community! Got me (and actually everybody) excited about stickers even more and willing to create some. GitHub’s octocat also contributed to my feelings about stickers. They actually produce a special version for all conferences they attend! Also I think it was ladies from GitHub taking most the notes (or maybe I just happened to seat behind them ;) ).
  • F23 Cloud Base Test Day September 8th!
    For this test day we are going to concentrate on the base image. We will have vagrant boxes (see this page for how to set up your machine), qcow images, raw images, and AWS EC2 images. In a later test day we will focus on the Atomic images and Docker images.
  • Impostor syndrome talk: FAQs and follow-ups
  • More Fedora 22 scrollbar annoyances (fixed)