Vulnerabilities at AT&T, T-Mobile and Sprint Could Have Exposed Customer Data
Last week was not a good week for telecommunications companies.
- By Sydny Shepard
- Aug 28, 2018
Security researchers have uncovered security flaws with systems at AT&T, Sprint and T-Mobile that could have left customer data accessible to bad actors.
The flaws impacting AT&T and T-Mobile were first reported. In T-Mobile's case, an "engineer mistake" between Apple's online storefront and T-Mobile's account validation API allowed for an unlimited number of attempts on an online form, which would allow a hacker to use commonly-available tools to guess an account PIN or the last four digits in a customer's social security numbers, in what's called a brute-force attack. The vulnerability has since been fixed.
A similar problem occurred with phone insurance company Asurion and its AT&T customers. An online form would allow anyone with a customer's phone number to access a form that allowed them unlimited guesses to guess a customer's passcode, leaving it vulnerable to another brute-force attack. The vulnerability has since been fixed.
At Sprint, security researchers were able to access an internal portal because of a "weak, easy-to-use usernames and passwords," compounded with the lack of two-factor authentication. Once in, the researcher was reportedly able to access customer account information for Sprint, Boost Mobile, and Virgin Mobile. The researcher also reported that anyone who gained access could make changes to customer accounts and that customers PINs could be brute-forced.
A Sprint spokesperson confirmed the vulnerability to TechCrunch, and noted that it didn't believe that any customers were affected by the vulnerability. The spokesperson said they were working to fix the issue.
About the Author
Sydny Shepard is the Executive Editor of Campus Security & Life Safety.