Skip to main content

Another T-Mobile website bug allowed anyone to access customer info using just a phone number

-

T-Mobile customers: Your data has been put at risk by your carrier, once again. In what seems like copypasta at this point, a security researcher recently found a bug in a publicly discoverable subdomain on T-Mobile's website that gave anyone access to customer data using just a phone number. It's almost like T-Mobile wants to award those bug bounties.

This time around, a not-hidden-enough API in promotool.t-mobile.com, apparently a "Customer Care Portal" for employees, allowed any enterprising individual to access T-Mobile customer data by appending the customer's phone number to the end of the URL — no password required. Doing this yielded the customer's full name, billing account number, account status information (e.g., past-due bills or account suspensions), and account PINs (used to initiate customer service interactions), according to ZDNet. In some cases, tax identification numbers were exposed.

Security researcher Ryan Stevenson spotted the bug and reported it to T-Mobile in early April, for which he received a $1,000 bug bounty and some swag. The carrier pulled the API a day after Stevenson alerted them to it.

"The bug was patched as soon as possible and we have no evidence that any customer information was accessed," a T-Mobile spokesperson told ZDNet.

This should sound familiar because a very similar bug was reported last fall. In that case, it appeared that hackers had a few weeks to take advantage of the vulnerability despite T-Mobile saying it made the correction within 24 hours of learning about it. Late last year, the carrier addressed another website bug that exposed records of user logins.

If you're a T-Mobile customer and think your personal info was stolen and used to set up a new account or make changes to your current account, you can work with the carrier to remedy the situation. Maybe Sprint can bring their web security team as part of its merger with T-Mobile?


#Google #Android #Smartphones #OS #News @ndrdnws #ndrdnws #AndroidNews

Popular Posts:

Do more from your inbox with Gmail Add-ons

-
Image
For many of us, email is mission control—the prompt to generate an invoice, prepare a presentation or follow up on a sales opportunity. With so many to-dos, imagine if you could complete these tasks directly from your inbox without interrupting your workflow. We believe email can do more, which is why we're launching Gmail Add-ons, a new way to work with your favorite business apps directly in Gmail. Gmail Add-ons, built for your workflows Rather than toggling between your inbox and other apps, use add-ons to complete actions right from Gmail. With Gmail Add-ons, your inbox can contextually surface your go-to app based on messages you receive to help you get things done faster. And because add-ons work the same across web and Android, you only need to install them once to access them on all of your devices. Click the settings wheel on the top right of your inbox and then "Get add-ons" to get started. We made Gmail Add-ons available in developer p
Continue Reading....

Apple is postponing new iOS features in favor of reliability and performance

-
Image
Apple has decided to postpone new features in iOS in favor of improving the reliability and performance of the operating system, as according to a report by Axios. According to the report, Craig Federighi, Senior Vice President, Software Engineering, announced the revised plan to employees at a meeting earlier this month. This pushes features like refresh of the homescreen and in-car user interface, improvements to core apps like Mail and camera experience to 2019. What we will get this year is improvements to AR, digital health and parental controls. Apart from that, the OS will largely feature improvements to performance and user experience. We have seen Apple do this with macOS in the past, where they dedicate one entire update cycle to just refining the OS and make existing features work better. However, we have never quite seen Apple do that on iOS. This is largely due to the hyper competitive nature of the mobile market where competition and customer demands push companies t
Continue Reading....

This is Samsung’s official spec sheet for the Galaxy S8 and S8+

-
Image
The Galaxy S8 and Galaxy S8+ have finally been unveiled, and our hands-on experience with the devices is available for everyone to see. Everyone has a pretty good idea about the devices’ specifications at this point, but for those wanting to see it, we have added the official spec sheet offered by Samsung below. Remember, detailed specs are also available from our devices page . Oh, and don’t remember to take a look at what we think about Samsung’s new flagships .
Continue Reading....

Jurassic VR - Google Cardboard

-
Image
Jurassic VR - Google Cardboard Rabbit Mountain Adventure VERSION/BUILD: 1.6.4 UPDATED: 28 January 2018 REQUIRES ANDROID: 4.4 and up FILE SIZE: 66.4 M Walking with the dinosaurs! Roam the earth and experience prehistoric times in Virtual Reality. Celebrating 4+ million downloads! Have you ever wanted to meet Dinosaurs in real life? Experience the ultimate dino ride with Jurassic VR - Google Cardboard Freely roam the open environment en poke round the beautiful cedar evergreen trees to see huge dinos come to life. You can go to any point and see the sites and dinos in VR. Players get to experience the site at their own pace and the mission is simple; enjoy and discover the world of prehistoric dinosaurs before the modern world cities were built. It's like a virtual reality attraction traveling you back to prehistoric times! The ultimate experience There is no need anymore to become an archaeologist and dig the earth
Continue Reading....

DJI Mavic Air: could this be the definitive drone?

-
Image
DJI showcased its new Mavic Air drone in New York. The third quadcopter in this series is of similar quality to its predecessors and can also fold its arms for better portability. For its size, no competitor offers so much in terms of photo quality. Release date and price The DJI Mavic Air can be ordered through the official DJI website  and is also available from other retailers. The drone is available in three colors: marengo grey, white and red. We can buy the Mavic Air in a basic pack with remote control, protections, charger, cover, propeller replacement and a battery from US$799 (£769 in the UK). Often, one battery is not enough so there is a more complete pack available with three batteries, charger for four batteries and two propeller replacements from $999 (£949 in the UK). The red model reminds me of a Porsche. / © AndroidPIT Design and build quality In essence, it is th
Continue Reading....