7-Eleven Japanese customers lose $500,000 due to mobile app flaw

guest · Jul 4, 2019

7-Eleven Japanese customers lose $500,000 due to mobile app flaw
Hackers exploit 7-Eleven's poorly designed password reset function to make unwanted charges on 900 customers' accounts
July 4, 2019
https://www.zdnet.com/article/7-eleven-japanese-customers-lose-500000-due-to-mobile-app-flaw/

Approximately 900 customers of 7-Eleven Japan have lost a collective of ¥55 million ($510,000) after hackers hijacked their 7pay app accounts and made illegal charges in their names.
The incident was caused by an appalling security lapse in the design of the company's 7pay mobile payment app, which 7-Eleven Japan launched in the country on Monday, July 1.

However, in a mind-boggling turn of events, the app contained a password reset function that was incredibly poorly designed. It allowed anyone to request a password reset for other people's accounts, but have the password reset link sent to their email address, instead of the legitimate account owner.
A hacker only needed to know a 7pay user's email address, date of birth, and phone number.

Furthermore, if the user didn't enter their date of birth, the app would use a default of January 1, 2019, making some attacks even easier, according to a report in Yahoo Japan.
Click to expand...

7-ELEVEN PROMISES TO COMPENSATE HACKED 7PAY USERS
7-Eleven users began complaining about being locked out of their 7pay accounts a day after the app launched, with many airing their grievances on Twitter [1, 2, 3].

7-Eleven Japan reacted a day later and shut down the 7pay service on July 3.
Click to expand...

Log in or Sign up

7-Eleven Japanese customers lose $500,000 due to mobile app flaw

guest Guest

Log in or Sign up

7-Eleven Japanese customers lose $500,000 due to mobile app flaw

guest Guest

Useful Searches