Home › News ›

T-Mobile Bug Exposed Customer Account Details

Article Comments

May 25, 2018, 9:57 AM by Eric M. Zeman

The personal account details of T-Mobile customers were easily accessible for an unknown time thanks to a bug in T-Mobile's web site. The site in question was a subdomain used by T-Mobile staff to access customer account information when performing customer service tasks. The subdomain, however, was not protected by a password and could be used by anyone who knew how to find it. Using T-Mobile customer phone numbers, anyone could have quickly discovered names, account numbers, addresses, tax information, account payment status, PINs, and more. Security researcher Ryan Stevenson discovered the vulnerability in April and alerted T-Mobile. T-Mobile pulled the API in question and fixed the bug. "The bug bounty program exists so that researchers can alert us to vulnerabilities, which is what happened here, and we support this type of responsible and coordinated disclosure," said T-Mobile in a statement provided to ZDNet. "The bug was patched as soon as possible and we have no evidence that any customer information was accessed." A similar bug was discovered on a different T-Mobile subdomain last year.

Related

Google Brings Calendar App to WearOS

Oct 12, 2023
Google has finally released a proper Google Calendar app for its WearOS smartwatch platform. The app brings a detailed view of your upcoming events and tasks.

Apple Refines Anti-Stalking Features of AirTags

Feb 10, 2022
Apple is making a number of tweaks to the Find My system that powers AirTags. Specifically, Apple is aiming to improve the various features designed to prevent AirTags from being used to stalk people or track other people's belongings without their permission.

Tile Launches Anti-Stalking Tools

Mar 18, 2022
Tile has launched a new feature that lets anyone with a smartphone check if they are being tracked surreptitiously with a Tile tracker. This mirrors a similar set of features offered by Apple for its competing AirTags and Find My service.

Google Launches New "Find My Device" Network

Apr 8, 2024
Google has launched its new Find My Device app and service, which mimics the capabilities of Apple's Find My app and service, and works in a similar way. Both systems tap into the Bluetooth functions of billions of smartphones and other devices worldwide to help find lost devices and items via automatic crowdsourcing.

"Passkeys" are Apple's Replacement for Passwords

Jun 6, 2022
Apple has given a name to its password-free account security solution: Passkeys. With Passkeys, users can log in to web sites and apps without remembering or entering a password.

more news about:

Comments

This forum is closed.

This forum is closed.

No messages

Page 1 of 1