T-Mobile Bug Revealed Email Address, Name, and More
T-Mobile has fixed a bug that let hackers get sensitive personal data just by using a phone number. In theory, it could have been possible to collect details on all the company's customers, though T-Mobile denies this.
The problem was discovered by Karan Saini, a security researcher who discussed the problem with the Motherboard Vice website. The site then approached T-Mobile about the problem. It said "we were alerted to an issue that we investigated and fully resolved in less than 24 hours. There is no indication that it was shared more broadly." (Source: vice.com)
The bug had to do with T-Mobile's database being used alongside a service called "My Digits", which lets T-Mobile customers use the same number for multiple handsets and devices. It's not clear if the database covered only My Digits users, or all T-Mobile customers.
SIM Card Number Revealed
Normally, someone using the site would provide their login details and the site would then query the database using their T-Mobile ID. However, Saini discovered that anyone visiting the site could instead query the database themselves using a phone number rather than an ID.
If this phone number was for a T-Mobile account, the database would return details including the user's first name, email address and the IMSI number that identifies the SIM card in the phone - which in turn links the SIM card to the account.
The good news is that there's no easy way to make money using stolen IMSI data. However, it could theoretically be used to track a user's location or intercept messages, thanks to other bugs in cellphone networks. That means the T-Mobile bug could be useful for people trying to carry out specifically targeted attacks on individuals.
Saini tested the bug with eight genuine T-Mobile phone numbers, with the permission of the phone owners concerned. However, he believes it would have been possible to automate the process and simply try every possible phone number and thus retrieve the data for every user. (Source: secure7.com)
Hackers 'Exploited Bug'
Saini adds that since T-Mobile fixed the problem, it's now become clear that some hackers were actively exploiting the bug. He says it appears hackers were also able to get additional details including the customer's password (in encrypted form) and security question answers.
Saini says the most likely explanation is that these hackers were able to exploit the same problem with a different section of the database. One concern there is that it might provide enough information to effectively steal a user's phone number by falsely reporting a handset as lost or stolen, then requesting a replacement SIM.
What's Your Opinion?
Are you surprised that such a basic bug existed? Should companies protect public databases by limiting how often a particular user can query them? Would you change companies over a security breach and if so, how serious would the breach have to be?
Most popular articles
- Which Processor is Better: Intel or AMD? - Explained
- How to Prevent Ransomware in 2018 - 10 Steps
- 5 Best Anti Ransomware Software Free
- How to Fix: Computer / Network Infected with Ransomware (10 Steps)
- How to Fix: Your Computer is Infected, Call This Number (Scam)
- Scammed by Informatico Experts? Here's What to Do
- Scammed by Smart PC Experts? Here's What to Do
- Scammed by Right PC Experts? Here's What to Do
- Scammed by PC / Web Network Experts? Here's What to Do
- How to Fix: Windows Update Won't Update
- Explained: Do I need a VPN? Are VPNs Safe for Online Banking?
- Explained: VPN vs Proxy; What's the Difference?
- Explained: Difference Between VPN Server and VPN (Service)
- Forgot Password? How to: Reset Any Password: Windows Vista, 7, 8, 10
- How to: Use a Firewall to Block Full Screen Ads on Android
- Explained: Absolute Best way to Limit Data on Android
- Explained: Difference Between Dark Web, Deep Net, Darknet and More
- Explained: If I Reset Windows 10 will it Remove Malware?
![](/graphics/dennisfaas.jpg)
My name is Dennis Faas and I am a senior systems administrator and IT technical analyst specializing in cyber crimes (sextortion / blackmail / tech support scams) with over 20 years experience; I also run this website! If you need technical assistance , I can help. Click here to email me now; optionally, you can review my resume here. You can also read how I can fix your computer over the Internet (also includes user reviews).
We are BBB Accredited
![](https://www.infopackets.com/graphics/bbb.png)
We are BBB accredited (A+ rating), celebrating 21 years of excellence! Click to view our rating on the BBB.
Comments
Preventing brute force attacks
To have a company display that much information based on entering a phone number is crazy. The data should have at least been partially redacted to make it much more difficult for 'hackers' to make heads or tails of the data they were receiving.
That said, it is easy enough to prevent brute force / automated attacks from occurring in the first place. As long as the logins are logged, companies can use something like 'fail2ban' to scan logs for successive tries and failures, depending on IP address and ban offending IPs. We already have something like this in place on this website.
Another idea is to use a CAPTCHA at the login page, as this would also prevent attacks from hundreds of IPs requesting data (similar to a denial of service attack). If that CAPTCHA is incorrect, the login attempt fails.