Simple Bug Exposed Verizon Users' SMS Histories

← Back to Stories (view on slashdot.org)

Simple Bug Exposed Verizon Users' SMS Histories

Posted by Soulskill on Monday October 21, 2013 @09:14PM from the nsa-never-needed-to-ask dept.

Trailrunner7 writes "A security researcher discovered a simple vulnerability in Verizon Wireless's Web-based customer portal that enabled anyone who knows a subscriber's phone number to download that user's SMS message history, including the numbers of the people he communicated with. The vulnerability, which has been resolved now, resulted from a failure of the Verizon Web app to check that a number entered into the app actually belonged to the user who was entering it. After entering the number, a user could then download a spreadsheet file of the SMS activity on a target account. Cody Collier, the researcher who discovered the vulnerability, said he decided right away to report it to Verizon because he is a Verizon customer and didn't want others to have access to his account information. 'I am a Verizon Wireless customer myself, so upon finding this, I immediately looked for a way to contact Verizon. I wouldn't want my account information to exposed in such way,' Collier said via email."

60 comments

Min score:

Reason:

Sort:

Hasn't been sued yet? by michelcolman · 2013-10-21 21:26 · Score: 5, Interesting

Most of the time, when somebody discloses a vulnerability like that in a responsible way, the result is a bunch of angry letters from lawyers accusing the reporter of hacking into the system, demanding damages to be paid, etcetera.
Apparently that didn't happen in this case, so this really is a news story!
1. Re:Hasn't been sued yet? by Anonymous Coward · 2013-10-21 21:29 · Score: 5, Funny
  
  The news is that the NSA complained that Verizon SMS went dark...
2. Re:Hasn't been sued yet? by kinarduk · 2013-10-21 21:32 · Score: 1
  
  I'd ask Weev his opinion on disclosure! http://en.wikipedia.org/wiki/Weev
3. Re:Hasn't been sued yet? by Bucky24 · 2013-10-21 21:49 · Score: 1
  
  I have a feeling that by now it's probably "illegal" (by which I mean they have it in their TOS and no one wants to find out if it will stand by challenging it) to bring Verizon into a class action suit.
  
  --
  All the world's a CPU, and all the men and women merely AI agents
4. Re:Hasn't been sued yet? by Anonymous Coward · 2013-10-21 22:37 · Score: 0
  
  It's not difficult to find cases where this has happened. It was honestly my first thought after reading the article.
  Since you obviously didn't bother trying to verify the statement for yourself before attacking the GP, I'm not going to bother finding these references for you. Do it yourself. Just know that you're wrong, and anyone who follows this sort of thing knows it.
5. Re:Hasn't been sued yet? by michelcolman · 2013-10-21 23:42 · Score: 1
  
  Just a quick Google search, but there's plenty of others:
  http://www.scmagazine.com.au/News/276780,security-researcher-threatened-with-vulnerability-repair-bill.aspx
  http://nakedsecurity.sophos.com/2012/02/20/jail-facebook-ethical-hacker/
6. Re:Hasn't been sued yet? by Joining+Yet+Again · 2013-10-21 23:45 · Score: 2
  
  The statement made by the OP was "most of the time".
  I can pull up hundreds of articles on murders, but "most people" aren't murdered.
  This is like critical analysis 101.
7. Re:Hasn't been sued yet? by cyberjock1980 · 2013-10-22 00:00 · Score: 1, Redundant
  
  This may be labeled as funny, but I saw this article just a few minutes before it popped up on Slashdot, and I thought the exact same thing.
  The truth is we really don't know how long this problem has existed for, nobody knows if this was an accident or an "accident", and there's no telling who may have used this and to what depth. The NSA could have used this to scrape the SMS messages of every Verizon customer for weeks, months, or years.
  Considering all the stuff about the NSA going around, I really don't consider it that unlikely to have been used by the NSA. They're so busy undermining all of our liberties(even people ourside our borders) that I'm just not surprised by it anymore.
  I really wonder if this whole NSA thing is going to cause a small revolution in IT leading to more secure systems not to keep out would-be hackers but to keep out our own governments. People seem to be far more concerned about government access to their data than anonymous hackers that gained access.
  I guess we'll see in 5 years if the atmosphere around computer security has changed...
8. Re:Hasn't been sued yet? by morgauxo · 2013-10-22 01:16 · Score: 2
  
  More likely it will just get forgotten and ignored. You can't keep the people interested in what their government is doing unless it has a direct and obvious effect on their bank accounts. Even then.. it can be difficult.
9. Re:Hasn't been sued yet? by antdude · 2013-10-22 17:24 · Score: 1
  
  Maybe it will happen later.
  
  --
  Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
How can it be? by scsirob · 2013-10-21 21:37 · Score: 4, Interesting

How is it possible that large organizations such as Verizon fail to include or test even the most trivial security checks before they bring their websites online? If I were any more cynical I'd suspect they are sloppy on purpose so they do not have to be bothered by our friends of the NSA. "It's self-service, fetch whatever you need!"

--
To Terminate, or not to Terminate, that's the question - SCSIROB
1. Re:How can it be? by Rosco+P.+Coltrane · 2013-10-21 21:49 · Score: 4
  
  How is it possible that large organizations such as Verizon fail to include or test even the most trivial security checks before they bring their websites online?
  Because you think the size of an organization or the level of sensitivity of the data it handles are a guarantee of professionalism? How quaint.
  Newsflash: big corps, health care providers, governments... have 1 competent and responsible employee for 100 hacks in their employ. That's if they don't outsource their services god knows where, where they have no visibility on who does what and how. If you think your data is safe with big concerns, you're deluding yourself.
  
  --
  "A door is what a dog is perpetually on the wrong side of" - Ogden Nash
2. Re:How can it be? by Anonymous Coward · 2013-10-21 21:55 · Score: 2, Insightful
  
  Users don't care about security. Everybody uses Whatsapp, that pile of shit with more holes than Swiss cheese. Functionality is more important than security. Time-to-market is more important than security. You can tell people that every call they make is recorded, every SMS datamined, every location tracked. They do not care, because it never hurts them. The privacy apocalypse just doesn't happen. If more than a very small number of people are ever negatively affected by a privacy breach, then the laws will be changed and remedies will be found. It simply does not pay to do it right. Most software never leaves prototype stadium. If it works, ship it. You know the saying: "There's never time to do it right, but there's always time to do it over."
3. Re:How can it be? by jamesh · 2013-10-21 22:10 · Score: 1
  
  How is it possible that large organizations such as Verizon fail to include or test even the most trivial security checks before they bring their websites online?
  What did you just see?
4. Re:How can it be? by Thanshin · 2013-10-21 22:15 · Score: 2
  
  Newsflash: big corps, health care providers, governments... have 1 competent and responsible employee for 100 hacks in their employ.
  At first I was scared of being one of the hacks. Then I was scared I might be the one competent employee. Then I understood that was just an estimation and that the real ratio in a specific corporation could be +-1/100.
5. Re:How can it be? by Joining+Yet+Again · 2013-10-21 22:20 · Score: 5, Insightful
  
  Newsflash: big corps, health care providers, governments... have 1 competent and responsible employee for 100 hacks in their employ.
  
  And you know what the worst thing is? Everybody thinks they're the 1 competent employee.
6. Re:How can it be? by l3v1 · 2013-10-21 22:22 · Score: 4, Insightful
  
  "Functionality is more important than security."
  
  For average users, quite true. Non-average users, or ones that really want to keep their communications secret, also know that, and they don't use those services. That's why it makes so many people angry that the communications of masses of people are watched, probably 99.999% of the time totally unnecessarily. of course, there's the good old catch-22 as well, since if they wouldn't watch the common channels, criminals wouldn't need to find better ways to communicate. So, as always, the majority of innocent people get hassled for the hope that the lives of the few criminals become harder. Well, a false hope (you all know Newton's 3rd law, right?), but still a hope.
  
  --
  I am putting myself to the fullest possible use, which is all I can think that any conscious entity can ever hope to do.
7. Re:How can it be? by parkinglot777 · 2013-10-21 23:26 · Score: 1
  
  since if they wouldn't watch the common channels, criminals wouldn't need to find better ways to communicate
  Depends on how you define "better ways" to communicate for criminals. It may be a simple solution, but have you ever heard of the old say "if you want to hide a leaf hide it in a forest"? In other words, they do not need to use other ways of communication but rather disguise their communication in the 99.999% you are talking about.
8. Re:How can it be? by herve_masson · 2013-10-21 23:27 · Score: 1
  
  Backdoors are complex to setup and hide; frontdoors are easyer and can remain unnoticed for very long sometimes.
9. Re:How can it be? by Anonymous Coward · 2013-10-21 23:47 · Score: 0
  
  How is it possible that large organizations such as Verizon fail to include or test even the most trivial security checks before they bring their websites online?
  
  The same way specialist application and OS software houses, e.g. Microsoft, have the worst security record on the planet and cost individuals and business billions per year fighting and attempting to prevent exploits in their products.
10. Re:How can it be? by gstoddart · 2013-10-22 00:42 · Score: 1
  
  How is it possible that large organizations such as Verizon fail to include or test even the most trivial security checks before they bring their websites online?
  Because security takes time and costs money, and because there's absolutely no real laws compelling corporations to make any effort to do this properly.
  How is it possible there isn't a law requiring them to safeguard your personal information and large penalties if they fail to do so? They can mostly just say "oops, sorry" with no penalty so why bother?
  
  If I were any more cynical I'd suspect
  You don't need to be more cynical. They do a half assed job of security because they only need to, and because there's no real penalties for being incompetent at implementing security.
  So companies let some summer student write the stuff which secures your data, and don't actually give a damn if it works or not. The bottom line is, it's simply more cost effective to do a bad job of this, and there's no real privacy laws with any teeth to make them try harder.
  
  --
  Lost at C:>. Found at C.
11. Re:How can it be? by fulldecent · 2013-10-22 00:45 · Score: 1
  
  Trust me, the banks are just as bad.
  
  --
  -- I was raised on the command line, bitch
12. Re:How can it be? by fatphil · 2013-10-22 00:55 · Score: 1
  
  But how could it possibly be hacked, they put client-side javascript code in to ensure that the hidden field containing the account number couldn't be modified!?!?!?
  
  --
  Also FatPhil on SoylentNews, id 863
13. Re:How can it be? by VortexCortex · 2013-10-22 02:14 · Score: 2
  
  Not me! I'm one of the hacks! I don't know how to fix computers, and I'm also alergic to WIFI so I have to work from home, and can only use a smartphone during business hours -- Doctor's orders.
  That's my story, and I'm sticking to it!
14. Re:How can it be? by Anonymous Coward · 2013-10-22 06:31 · Score: 0
  
  Easier, not easyer.
15. Re:How can it be? by tibman · 2013-10-23 05:46 · Score: 1
  
  Yikes. It sounds like you are saying criminals (the smart ones) are the ones using secret comms. I would argue that it's the smart non-criminals using secret comms to protect themselves from criminals. For example, do you feel comfortable putting your credit-card info into a form on a non-ssl site? I doubt it. You use secret communication to protect yourself from criminals, because you are not stupid.
  
  --
  http://soylentnews.org/~tibman
relief by harvey+the+nerd · 2013-10-21 21:50 · Score: 0, Flamebait

I am so relieved that an experienced organization like Verizon is riding to the rescue on Obamacare.
1. Re:relief by Cwix · 2013-10-22 00:24 · Score: 1
  
  Harvey the nerd, or Harvey the partisan troll. It is up to the reader to decide.
  What exactly does this story have to do with obamacare?
  Please do the world a favor and grow up.
  
  --
  You are entitled to your own opinions, not your own facts.
2. Re:relief by fatphil · 2013-10-22 01:04 · Score: 1
  
  The story is to do with Verizon and their compentencies.
  
  One of the things Verizon's competence has just been specifically sought after for is Obamacare - that's in the news, at least here in Europe. Do you not have newspapers where you're from?
  
  --
  Also FatPhil on SoylentNews, id 863
3. Re:relief by tibman · 2013-10-23 05:49 · Score: 1
  
  You still have newspapers? We have billionaire's blogs that are distributed as hard-copies.
  
  --
  http://soylentnews.org/~tibman
What allows them to store your entire SMS history? by flowerp · 2013-10-21 21:50 · Score: 2

The customer pays Verizon to offer a communication service, not a data retention and wiretap service. Thanks.

--
--- Eat my sig.
Re:What allows them to store your entire SMS histo by Anonymous Coward · 2013-10-21 21:54 · Score: 4, Funny

They tried advertising it as a data retention and wiretap service, but it didn't do so well in focus groups.
Noted in the message area.... by Anonymous Coward · 2013-10-21 22:04 · Score: 0

...anyone who knows a subscriber's phone number to download that user's SMS message history, including the numbers of the people he communicated with. The vulnerability, which has been resolved now...
DAMN!!!
NSA
1. Re:Noted in the message area.... by Pieroxy · 2013-10-22 00:44 · Score: 1
  
  Now it checks that it's either the owner of the number or an NSA employee.
  
  --
  Write boring code, not shiny code!
Re:What allows them to store your entire SMS histo by gl4ss · 2013-10-21 22:28 · Score: 1

probably billing.
would make more sense to only keep the content of premium sms's though.

--
world was created 5 seconds before this post as it is.
Good to know... by EmTeedee · 2013-10-21 22:40 · Score: 1

...he reported it Verizon because he is a customer himself.
Not like, you know, because it is the right thing to do.
1. Re:Good to know... by Anonymous Coward · 2013-10-21 23:11 · Score: 0
  
  Making sure that deploying appalling software quality remains without consequence, thus encouraging more of the same, is the right thing to do?
Title sounds like a web ad by Dave+Emami · 2013-10-21 22:54 · Score: 5, Funny

"Learn about this one weird bug that Verizon doesn't want you to know!"

--

"The Greens lynched a hacker in Chicago. Last month, but I think the body's still hanging from the old Water Tower."
1. Re:Title sounds like a web ad by VortexCortex · 2013-10-22 02:17 · Score: 1
  
  "TelCo's Hate this one easy trick."
Suuuuuure it's a bug by EmagGeek · 2013-10-21 22:55 · Score: 0

Or a "feature" for the NSA.
Philosophical question by Overzeetop · 2013-10-21 22:59 · Score: 1

This definitely rates the I word for Verizon's implementation of the feature - especially since, when I went over my quota of data with AT&T one night at 2am while I slept, both CS and TS said they couldn't give me even header data so I knew who/what was sucking my B/W dry. Too much or too little information, never the right amount.
You threw in this line:

the majority of innocent people get hassled
I think the word you're looking for is a very small minority, not majority. Verizon has nearly 100 million users of their network. Your sentence implies that more than 50 million people will be harassed or, at the least, inconvenienced in some non-trivial way by this. I would be rather surprised if the number actually made it passed 10,000, or 1 in 10,000 users. That's equivalent to changing phone carriers and having them assign you the SAME last four digits of your old phone number in the new exchange/area code. A pretty amazingly rare occurrence.
This isn't meant to defend Verizon's absolutely slipshod implementation of their system, just to point out that, for all the moaning and handwaving, the chance of this actually affecting you is diminishingly small.

--
Is it just my observation, or are there way too many stupid people in the world?
Redundancy warning by Anonymous Coward · 2013-10-21 22:59 · Score: 0

said he decided right away to report it to Verizon because he is a Verizon customer and didn't want others to have access to his account information. 'I am a Verizon Wireless customer myself, so upon finding this, I immediately looked for a way to contact Verizon. I wouldn't want my account information to exposed in such way,' Collier said via email."
What's the point of a word-by-word transcription when you're going to insert the actual quote anyway?
Class action law suit? by Anonymous Coward · 2013-10-21 23:04 · Score: 0

This is not a bug, it's criminal negligence.
The best and brightest? by Anonymous Coward · 2013-10-21 23:05 · Score: 0

This is the same company that is going to fix healthcare.gov?
Not a bug, but a feature by transporter_ii · 2013-10-21 23:13 · Score: 2

Not a bug, but a feature. It was added to make it easier for the NSA to put all of its "metadata" to easy use.

--
Doctors destroy health, lawyers destroy justice, universities destroy knowledge, religion destroys spirituality
Verizon Health Care by sw_crafter · 2013-10-21 23:15 · Score: 1

Verizon brought in to "fix" the health care exchange at healthcare.gov HHS brings in Verizon to help HealthCare.gov. Their record does not seem to bode well.
They were too busy fixing ObamaCare by thesandbender · 2013-10-21 23:15 · Score: 1

They've been asked to help fix ObamaCare.
Planned feature by Anonymous Coward · 2013-10-22 00:55 · Score: 0

Simple vulnerability, or simple feature? This way requires no warrants. Don't mean to be 'that' guy, but every other day we see a story like this tied to the NSA.
Like pounding 0 on a help line by Impy+the+Impiuos+Imp · 2013-10-22 00:55 · Score: 2

By far the fastest way to talk with a real person on Verizon's phone site is to start liiking at phone models. A little box will appear asking of you want to talk to a sales representative. Click yes and they can then help you for other stuff, or at least know what to do.

--
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
LERT out of business? by Yebyen · 2013-10-22 01:50 · Score: 3, Interesting

When I called Verizon customer service to see if they could send me a log of my text messages, I was informed it would cost me $50 and a letter from my lawyer to their Law Enforcement Response Team (LERT). I am glad to see that just anyone could get that information without any lawyer, $50, or even proving who they are.
Is this facility still available for paying customers of Verizon Wireless, to view their own text message history without the need for a team of lawyers?
I've just tried it on my account, it looks like it is available to the person who is paying my bill but not to myself (the Account Member gets basically no special privileges other than using the phone and viewing aggregate usage statistics to avoid going over the account limits.)
It would have been nice if Verizon had advised me of this service, rather than stonewalling me and telling me to get a lawyer

--
Restating the obvious since nineteen aught five.
Re:What allows them to store your entire SMS histo by Anonymous Coward · 2013-10-22 02:17 · Score: 0

The customer pays Verizon to offer a communication service, not a data retention and wiretap service. Thanks.
So what should Verizon do if you get an SMS (or a hundred) while your phone is off, or out of range? What if your're in Europe for the week? For the month?
nope...it's a bug. by mschaffer · 2013-10-22 02:28 · Score: 1

The NSA already has the metadata. It's a bug.
Unless, of course, it is a documented feature.
I thougth Obama said... by mschaffer · 2013-10-22 02:32 · Score: 1

I thought Obama said they brought in "top IT talent" to fix the problem? Is Verizon know for their websites working flawlessly under high load?
It also makes me think that, why did Obama only now bring in the "top IT talent". He should have started with them to begin with.
Oh, well.
Is this the first story you read this month? by Anonymous Coward · 2013-10-22 02:34 · Score: 0

Some people can think beyond the story. Perhaps you should, too.
Amazing technical incompetence by mabu · 2013-10-22 04:31 · Score: 1

This really is security 101. Actually it's not even security 101, it's programming 101. You always assume the information fed to you is potentially invalid and qualify it.
How in their right mind could anyone at Verizon not check to see if the account id was legit? This is not a simple oversight. This is gross incompetence, or else it was intentionally left this way.
Don't these companies do security audits?
Compare to Weev case by SpaceLifeForm · 2013-10-22 04:58 · Score: 2

Both involved access via web where the web app failed to do proper validation. Apparently Verizon actually handled this well.

--
You are being MICROattacked, from various angles, in a SOFT manner.
Acity024 by Acity024 · 2013-10-22 22:06 · Score: 1

Criminals
Re:What allows them to store your entire SMS histo by tibman · 2013-10-23 06:27 · Score: 1

Hold it in a delivery queue, just like email and other messaging services.

--
http://soylentnews.org/~tibman