Bug reportedly exposed T-Mobile customers' personal data

From CNET: A vulnerability on T-Mobile's website allowed access to millions of customers' personal data, including email addresses and account numbers, Motherboard reported Tuesday.

The flaw, which Motherboard said was discovered by security researcher Karan Saini, could have allowed hackers who knew -- or guessed -- a customer's phone number to obtain data valuable in social engineering attacks, or perhaps even hijacking victim's numbers. The bug was repaired Friday after Motherboard asked the wireless carrier about the issue.

Saini told Motherboard that an attacker could leverage the vulnerability by writing a script to siphon data from T-Mobile's 76 million customer accounts to create a searchable database of up-to-date information on its users. He classified it as "a very critical data breach."

T-Mobile disputed those findings in a statement late Tuesday.

"We resolved the vulnerability that was reported to us by the researcher in less than 24 hours, and we have confirmed that we have shut down all known ways to exploit it," the company said in a statement. "As of this time we've found no evidence of customer accounts affected as a result of this vulnerability."

View: Article @ Source Site