Slashdot Mirror
T-Mobile Bug Let Anyone See Any Customer's Account Details (zdnet.com)
An anonymous reader writes: A bug in T-Mobile's website let anyone access the personal account details of any customer with just their cell phone number, ZDNet reported Thursday. The flaw, since fixed, could have been exploited by anyone who knew where to look -- a little-known T-Mobile subdomain that staff use as a customer care portal to access the company's internal tools. The subdomain -- promotool.t-mobile.com, which can be easily found on search engines -- contained a hidden API that would return T-Mobile customer data simply by adding the customer's cell phone number to the end of the web address.
Although the API is understood to be used by T-Mobile staff to look up account details, it wasn't protected with a password and could be easily used by anyone. The returned data included a customer's full name, postal address, billing account number, and in some cases information about tax identification numbers. The data also included customers' account information, such as if a bill is past-due or if the customer had their service suspended.
Although the API is understood to be used by T-Mobile staff to look up account details, it wasn't protected with a password and could be easily used by anyone. The returned data included a customer's full name, postal address, billing account number, and in some cases information about tax identification numbers. The data also included customers' account information, such as if a bill is past-due or if the customer had their service suspended.
In death context
For security reasons, I always use pre-paid "plans" with my cell phones. They're cheaper, simpler, and there's no personal information stored outside of payment information (which can be made with any kind of card).
I don't respond to AC's.
I'll bet $100 that there's a "spec" written by a guy with two years development experience that looks like this:
GET https://api.corpsite.com/customer/ID - returns the customer data (in JSON or XML) for the provided ID
I'll bet another $100 that there's no mention of any authenticated roles needed to access that call and an extra $100 that there were never any tests designed to try to access a customer's data while signed on as a different customer.
Play stupid games...
I can hear the Europeans sharpening their knives to make use of the new regulations about keeping data safe to fine T mobile serious money. At least let's hope so; mistakes like this should result in serious damage - in the hundreds of millions - to organisations profits.
Lets create an un-advertised domain that is connected to the internet and allows full access to account information!
Even better, lets make sure there's no authentication required!
Seriously, why isn't this only on some T-Mobile intranet that is locked down to only those people with appropriate need-to-know and signed agreements?
Most list-reader monkeys don't need access to anything more than my name and zip code. Billing may need stuff like bank accounts, but nobody really needs to maintain tax information. They aren't sending me a 1099 come January - mark a credit check as approved and a date, no need for more.
This is a TOTALY amateur mistake. Did they have high school script kiddies write their website?
I use T-Mobile's. Though the service works well, pretty much all of their client software is a train wreck, all their apps are unusable, and their customer service is like an episode of the twilight zone. If anything goes wrong, you're better off just creating a new account than trying to get it fixed.
Could have included account passwords. Hello Comcast.
I would be willing to bet LDAP directories accessible publically of many universities are not much better.
These are not bugs or oversights. People doing it must have known implications of their decision and yet they chose to go there anyway. They don't deserve mercy or a second chance.
Let's face it, security through obscurity is cheaper. Also, there's virtually no real, permanent or painful consequences for a large corporation that doesn't secure their customers data. More than likely, they're the only provider of a service that you need or the other guys do the same thing anyway. Perhaps you'll get a public mea culpa , a "we're sorry" add campaign in public media and one years worth of BS identity protection services. The truth is, they just don't care about your data, except for the money they can make off of it or the problems their lack of due diligence will cause you. BTW the Federal and State agencies are just as bad. In their case though it's largely because they don't have the money to fix the problems or they just don't want to spend it. In reality, it's buyer beware. Know who and what data you're giving away.
Really? By no evidence do you mean that no activity log files were created or stored? Because elsewhere in TFA it says:
This is not a bug. This is gross negligence of some kind and should be called that. A bug implies (to me, and most devs I know) a non-obvious defect in implementation. A mistake.
This is like building a records office and putting it in the lobby of city hall in card board boxes. No one would call that a simple "mistake".
This was not a "bug", this was just craptastic coding by some jackass developer.
Just cruising through this digital world at 33 1/3 rpm...
Why jump to conclusion this is a bug? Something like this seems a bit more on purpose then a accident.