Glitch in Verizon's online billing web site

[Fire14]

Verizon Web site flaw allowed mobile phone customers to see part of others' accounts
Associated Press
Friday, August 12, 2005

NEW YORK - Verizon Wireless customers who signed up for online billing services were able to peek at some details of others' accounts due to a Web site programming error that was caught by a customer and fixed this week, a company spokesman said Thursday.

The flaw allowed customers who punched in another user's phone number to see how many airtime minutes that person had used, as well as the number of free minutes they had remaining for the month, spokesman Tom Pica said. Snoopers could also learn what cell phone model a customer used.

All users who registered to use the "My Account" system were affected by the glitch, which could have been in place for as long as five years, Pica told The Associated Press. It did not appear that anyone had taken advantage of the error to pry into individual accounts, he said.

Pica said there was no indication that "sensitive customer information" such as financial information, call records and addresses, had been at risk.

But Jonathan Zdziarski, the software developer who notified the phone company of the problem, said that the programming flaw exposed account balances and the date of the most recent payment, the Washington Post reported in Friday's editions. The company would not confirm the claim.

The Georgia-based developer discovered the problem while writing a computer program that would automatically access his online account and report the number of cell phone minutes he had used, the Post said.

[wgray8231]

I think jones already posted this....

[Fire14]

Originally Posted by wgray8231

I think jones already posted this....

If he did, I am sorry for posting this, i didn't see anything on it in the boards & may have missed it. Again sorry to repost an article already posted.

[wgray8231]

Originally Posted by Fire14

If he did, I am sorry for posting this, i didn't see anything on it in the boards & may have missed it. Again sorry to repost an article already posted.

No prob.

It may have been in the Verizon Users forum. I couldn't find it after a quick search but do remember the thread b/c someone beat me to it.

[Charlyee]

Originally Posted by Fire14

If he did, I am sorry for posting this, i didn't see anything on it in the boards & may have missed it. Again sorry to repost an article already posted.

It is under a different tittle Verizon Wireless Fixes Website Vulnerabilities (Verizon Wireless Fixes Web Site Vulnerabilities) and it is in the Wireless Technologies Forum, so it wasn't that obvious that it was the same news but I also did remember reading about it somewhere. .

[Fire14]

I remember reading it now, thanks for the link & accepting the apology.

[bobolito]

This is the reason news articles should always be posted in the news forum, not in the regional or carrier forums. Jones has a bad habit of posting news all over the place regardless of my telling him about it in the past. If anyone sees news posted in other than the news forum, please report it so we can move it here.

[jones]

this issue can belong to both news and wireless network
technology (there's just 2 network technology now w/
Nextel/sprint.)

vzw fans/salesmen don't like this topic but competition works
for consumers, regardless of what works for you.

[Fathead]

Originally Posted by jones

this issue can belong to both news and wireless network
technology (there's just 2 network technology now w/
Nextel/sprint.)

vzw fans/salesmen don't like this topic but competition works
for consumers, regardless of what works for you.

How the hell does a glitch in the online bill system have anything to do with CDMA or GSM? Your post makes no sense.

[jimbo]

Originally Posted by Fathead

How the hell does a glitch in the online bill system have anything to do with CDMA or GSM? Your post makes no sense.

I was wondering the same thing. And note that I am not a "vzn fan or salesman" and have no problem with someone posting this article...it just has nothing to do with "Wireless Network Technologies."

[jones]

it's cdma billing

[wgray8231]

It has more to do with Information Technology (separate from wireless), which there is no forum for.

The website developers may not even use cell phones, much less know anything about the technology.

[Fathead]

What does cdma have to do with the online account access system? It's a website security issue, it wouldn't make any difference if it was gsm, cdma, analog, wi-fi, or whatever they come up with tomorrow.

[jones]

when you use your phone it is connected to the billing
system for the Number of Minutes or if you are roaming.

[Fathead]

Originally Posted by jones

when you use your phone it is connected to the billing
system for the Number of Minutes or if you are roaming.

Answer one question for me, please.



Is this issue Verizon had a CDMA issue, or is it a website security issue?

[WirelessBeachBum]

Originally Posted by Fathead

Answer one question for me, please.



Is this issue Verizon had a CDMA issue, or is it a website security issue?

Didn't you know...instead of tcp/ip the internet is going to be converted to an all CDMA network...

[jones]

fire14 just wanted to alert you guys,
he does'nt want others to see your minutes
when they are log on.
All they have to do is type in
your phone number and see the calling activity.
Who knows if others are already looking at your
account, since this has been going on for 5 years.

i know you're not the
same guys making bad remarks when
it was posted here that T-Mobile
had a security hole on their online account.

[Fathead]

Originally Posted by jones

fire14 just wanted to alert you guys,
he does'nt want others to see your minutes
when they are log on.
All they have to do is type in
your phone number and see the calling activity.
Who knows if others are already looking at your
account, since this has been going on for 5 years.

i know you're not the
same guys making bad remarks when
it was posted here that T-Mobile
had a security hole on their online account.

Thanks for not answering my question.






Anyway, that sucks about the glitch, but at least they've got it fixed.

[wgray8231]

It's been fixed for a week or more.

This is also less of a risk than TMO's problem. I could care less if someone knows how many minutes I have left and what phone I use. Heck, I've got my phone model posted all over the Internet in my WA profile.

[jones]

the flaw was there for 5 years, had it
not for one of the customer they would not know.