Slashdot Mirror
Millions of Verizon Customer Records Exposed in Security Lapse (zdnet.com)
Zack Whittaker, reporting for ZDNet: An Israeli technology company has exposed millions of Verizon customer records, ZDNet has learned. As many as 14 million records of subscribers who called the phone giant's customer services in the past six months were found on an unprotected Amazon S3 storage server controlled by an employee of Nice Systems, a Ra'anana, Israel-based company. The data was downloadable by anyone with the easy-to-guess web address. Nice, which counts 85 of the Fortune 100 as customers, plays in two main enterprise software markets: customer engagement and financial crime and compliance including tools that prevent fraud and money laundering. Nice's 2016 revenue was $1.01 billion, up from $926.9 million in the previous year. The financial services sector is Nice's biggest industry in terms of customers, with telecom companies such as Verizon a key vertical. The company has more than 25,000 customers in about 150 countries.
but, really, it's not funny. Verizon is huge. They can afford to, and should, pay for people who can figure out rudimentary security policies and practices.
"The data was downloadable by anyone with the easy-to-guess web address"
And there's actually (security) people who go around doing this ?? Well, I realize there are, but it's still pretty freaking strange to do !
And I haven't changed my Yahoo! email password in 20+ years.
As long as lax security doesn't have a significant negative financial impact on companies like Verizon nothing will happen.
sudo rm -r -f --no-preserve-root /
The manufacturing industry has standards and certifications to help ensure the quality of the materials that originate from downstream suppliers. This also helps to assign liability.
There needs to be something similar for privacy since so much is outsourced there seems to be no control at all. And, of course, there needs to be serious civil and criminal liabilities for every breach.
Yahoo!
Verizon
Anthem
MORE Incompetent, unethical moronic assholes.
There is ZERO excuse.
And the shitty part is that it is up to the victim to clean up the mess and be on the lookout. WE have to deal with it when someone files income tax in our name. We have to deal with the ramification. We have to deal the debt - the debt collections calls for assholes (ALL debt collectors are crooked assholes and deserve to get sued. Every single one of them.)
So, Verizon is now on the list of stupid unethical companies.
The customer records were contained in log files that were generated when Verizon customers in the last six months called customer service. These interactions are recorded, obtained, and analyzed by Nice, which says it can "realize intent, and extract and leverage insights to deliver impact in real time." Verizon uses that data to verify account holders and to improve customer service. Each record included a customer's name, a cell phone number, and their account PIN -- which if obtained would grant anyone access to a subscriber's account, according to a Verizon call center representative, who spoke on the condition of anonymity as they were not authorized to speak to the press.
Why would they record the pin in plain text in the log files? Irrespective of the leak to public domain, this would expose pins of all customers to all employees who can log in? Stupid to the core.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Nice Systems probably got the contract because they offered to do the work much faster and cheaper than what Verizon's own staff estimated. Now you know why it was so much cheaper, guys.
Hell, most IT work in general is a lot easier when you don't have little things like data security to worry about! Just throw it on "the cloud", problem solved!
NICE Systems was also exposed as a reseller for Hacking Team's software: https://motherboard.vice.com/en_us/article/kbzj4z/meet-the-companies-that-helped-hacking-team-sell-tools-to-repressive-governments
EOM
I'm not sucking anything that's been in your mom's mouth.
In my opinion: Almost all internet connected H/W, OS and applications have as-of-yet undiscovered vulnerabilities, even when supposedly patched. At least one major intelligence agency of a "some" State government, has been actively exploiting the above vulnerabilities for at least a decade and has developed a lovely little toolbox of goodies that has for reasons that allude me, been leaked to the hacking, et all., community at large. All entities that collect the most private of data from us have been or will be hacked eventually. Many of those hacked entities will never come clean about it unless publicly burned by someone. There will be little or no recourse or punishment for these entities, even in cases of extreme negligence. Unless maybe a bunch of folks die... With the amount of data that we are required to, encouraged to or coerced into providing various government, financial, medical and retail entities, it's only a matter of time as to when your most sensitive info becomes publicly available. If one is to accept that having your data exposed will be the norm, how do you operate on a day to day basis in that environment? It's not like we can all go off-grid or roll back to paper. Not that that would help anyway...
Press release here.
As a media outlet recently reported, an employee of one of our vendors put information into a cloud storage area and incorrectly set the storage to allow external access. We have been able to confirm that the only access to the cloud storage area by a person other than Verizon or its vendor was a researcher who brought this issue to our attention. In other words, there has been no loss or theft of Verizon or Verizon customer information.
And corporations are well-known for being honest and completely transparent.
And corporations are well-known for being honest and completely transparent.
And customers are well-known for refusing to do business with companies that fumble their data onto the internet.
Nothing to see here, move along...
Comment removed based on user account deletion
They may have been lucky. Is there any logs to prove? Folks should be advised of precautions just in case.
... the list.
World's Biggest Data Breaches
It little behooves the best of us to comment on the rest of us.
NICE is also tied in to the Next Gen 911 contracts. When you hear 911 recordings played on the news or in court chances are they came from NICE
Why is an Israeli company handling domestic communications related data? Why are so many Israelis in Washington? Why are so many Israelis in Hollywood? Why are so many Israelis in the financial sector? Why are so many Israelis running the news media?
any time I want to find something like a pay PDF, i just google it and usually turn up an aws share with it
Bullshit.