Simple Bug Exposed Verizon Users' SMS Histories

Trailrunner7 writes "A security researcher discovered a simple vulnerability in Verizon Wireless's Web-based customer portal that enabled anyone who knows a subscriber's phone number to download that user's SMS message history, including the numbers of the people he communicated with. The vulnerability, which has been resolved now, resulted from a failure of the Verizon Web app to check that a number entered into the app actually belonged to the user who was entering it. After entering the number, a user could then download a spreadsheet file of the SMS activity on a target account. Cody Collier, the researcher who discovered the vulnerability, said he decided right away to report it to Verizon because he is a Verizon customer and didn't want others to have access to his account information. 'I am a Verizon Wireless customer myself, so upon finding this, I immediately looked for a way to contact Verizon. I wouldn't want my account information to exposed in such way,' Collier said via email."

Comments

Hasn't been sued yet?

[michelcolman]

Most of the time, when somebody discloses a vulnerability like that in a responsible way, the result is a bunch of angry letters from lawyers accusing the reporter of hacking into the system, demanding damages to be paid, etcetera.

Apparently that didn't happen in this case, so this really is a news story!

Re:Hasn't been sued yet?

[Anonymous Coward]

The news is that the NSA complained that Verizon SMS went dark...

How can it be?

[scsirob]

How is it possible that large organizations such as Verizon fail to include or test even the most trivial security checks before they bring their websites online? If I were any more cynical I'd suspect they are sloppy on purpose so they do not have to be bothered by our friends of the NSA. "It's self-service, fetch whatever you need!"

Re:How can it be?

[Rosco P. Coltrane]

How is it possible that large organizations such as Verizon fail to include or test even the most trivial security checks before they bring their websites online?

Because you think the size of an organization or the level of sensitivity of the data it handles are a guarantee of professionalism? How quaint.

Newsflash: big corps, health care providers, governments... have 1 competent and responsible employee for 100 hacks in their employ. That's if they don't outsource their services god knows where, where they have no visibility on who does what and how. If you think your data is safe with big concerns, you're deluding yourself.

Re:How can it be?

[Joining Yet Again]

Newsflash: big corps, health care providers, governments... have 1 competent and responsible employee for 100 hacks in their employ.

And you know what the worst thing is? Everybody thinks they're the 1 competent employee.

Re:How can it be?

[l3v1]

"Functionality is more important than security."

For average users, quite true. Non-average users, or ones that really want to keep their communications secret, also know that, and they don't use those services. That's why it makes so many people angry that the communications of masses of people are watched, probably 99.999% of the time totally unnecessarily. of course, there's the good old catch-22 as well, since if they wouldn't watch the common channels, criminals wouldn't need to find better ways to communicate. So, as always, the majority of innocent people get hassled for the hope that the lives of the few criminals become harder. Well, a false hope (you all know Newton's 3rd law, right?), but still a hope.

Re:What allows them to store your entire SMS histo

[Anonymous Coward]

They tried advertising it as a data retention and wiretap service, but it didn't do so well in focus groups.

Title sounds like a web ad

[Dave Emami]

"Learn about this one weird bug that Verizon doesn't want you to know!"