Vulnerabilities Exposed 2 Million Verizon Customer Contracts

guest · Sep 10, 2019

Vulnerabilities Exposed 2 Million Verizon Customer Contracts
September 10, 2019
https://www.securityweek.com/vulnerabilities-exposed-2-million-verizon-customer-contracts

UK-based researcher Daley Bee was analyzing Verizon Wireless systems when he came across a subdomain that appeared to be used by the company’s employees to access internal point-of-sale tools and view customer information.
Further analysis led to the discovery of a URL pointing to PDF format contracts for Verizon Wireless customers who used the company’s monthly installment program to pay for their devices.

“As usual, it’s the small & stupid things that are overlooked that lead to the biggest issue,” the researcher said in a blog post.

The hacker reported his findings to Verizon in mid-June and a patch was rolled out roughly one month later. The researcher told SecurityWeek that Verizon Wireless services are not covered by a bug bounty program — Verizon provides an email address for responsibly disclosing vulnerabilities but it does not offer rewards.
Click to expand...

UPDATE. Verizon provided SecurityWeek the following statement:

“We were made aware of this issue in June. When the issue was brought to our attention, our cyber security team worked quickly with our application team to resolve it.
We have no reason to believe that any customer information was accessed by anyone other than the security researcher who reported it.”
Click to expand...

Log in or Sign up

Vulnerabilities Exposed 2 Million Verizon Customer Contracts

guest Guest

Log in or Sign up

Vulnerabilities Exposed 2 Million Verizon Customer Contracts

guest Guest

Useful Searches