Slashdot Mirror
Millions of Verizon Customer Records Exposed in Security Lapse (zdnet.com)
Zack Whittaker, reporting for ZDNet: An Israeli technology company has exposed millions of Verizon customer records, ZDNet has learned. As many as 14 million records of subscribers who called the phone giant's customer services in the past six months were found on an unprotected Amazon S3 storage server controlled by an employee of Nice Systems, a Ra'anana, Israel-based company. The data was downloadable by anyone with the easy-to-guess web address. Nice, which counts 85 of the Fortune 100 as customers, plays in two main enterprise software markets: customer engagement and financial crime and compliance including tools that prevent fraud and money laundering. Nice's 2016 revenue was $1.01 billion, up from $926.9 million in the previous year. The financial services sector is Nice's biggest industry in terms of customers, with telecom companies such as Verizon a key vertical. The company has more than 25,000 customers in about 150 countries.
"The data was downloadable by anyone with the easy-to-guess web address"
And there's actually (security) people who go around doing this ?? Well, I realize there are, but it's still pretty freaking strange to do !
And I haven't changed my Yahoo! email password in 20+ years.
Don't worry. They'll purchase one year of useless identity theft protection to make it right.
As long as lax security doesn't have a significant negative financial impact on companies like Verizon nothing will happen.
sudo rm -r -f --no-preserve-root /
The customer records were contained in log files that were generated when Verizon customers in the last six months called customer service. These interactions are recorded, obtained, and analyzed by Nice, which says it can "realize intent, and extract and leverage insights to deliver impact in real time." Verizon uses that data to verify account holders and to improve customer service. Each record included a customer's name, a cell phone number, and their account PIN -- which if obtained would grant anyone access to a subscriber's account, according to a Verizon call center representative, who spoke on the condition of anonymity as they were not authorized to speak to the press.
Why would they record the pin in plain text in the log files? Irrespective of the leak to public domain, this would expose pins of all customers to all employees who can log in? Stupid to the core.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Nice Systems probably got the contract because they offered to do the work much faster and cheaper than what Verizon's own staff estimated. Now you know why it was so much cheaper, guys.
Hell, most IT work in general is a lot easier when you don't have little things like data security to worry about! Just throw it on "the cloud", problem solved!
Here's how these things often play out:
Tech grunt: "Boss, I've identified 7 areas here where our security is lax."
PHB: "How many hours will it take to plug them?"
Tech grunt: "About a month's worth of labor."
PHB: "That would mean project X wouldn't be ready by the deadline, and I wouldn't get my Christmas bonus. Let's fix the security gaps next year."
Table-ized A.I.
EOM
In my opinion: Almost all internet connected H/W, OS and applications have as-of-yet undiscovered vulnerabilities, even when supposedly patched. At least one major intelligence agency of a "some" State government, has been actively exploiting the above vulnerabilities for at least a decade and has developed a lovely little toolbox of goodies that has for reasons that allude me, been leaked to the hacking, et all., community at large. All entities that collect the most private of data from us have been or will be hacked eventually. Many of those hacked entities will never come clean about it unless publicly burned by someone. There will be little or no recourse or punishment for these entities, even in cases of extreme negligence. Unless maybe a bunch of folks die... With the amount of data that we are required to, encouraged to or coerced into providing various government, financial, medical and retail entities, it's only a matter of time as to when your most sensitive info becomes publicly available. If one is to accept that having your data exposed will be the norm, how do you operate on a day to day basis in that environment? It's not like we can all go off-grid or roll back to paper. Not that that would help anyway...
Press release here.
As a media outlet recently reported, an employee of one of our vendors put information into a cloud storage area and incorrectly set the storage to allow external access. We have been able to confirm that the only access to the cloud storage area by a person other than Verizon or its vendor was a researcher who brought this issue to our attention. In other words, there has been no loss or theft of Verizon or Verizon customer information.
And corporations are well-known for being honest and completely transparent.
Comment removed based on user account deletion
They may have been lucky. Is there any logs to prove? Folks should be advised of precautions just in case.
... the list.
World's Biggest Data Breaches
It little behooves the best of us to comment on the rest of us.
Bullshit.