Flaws in Apple & Asurion websites expose PINs of millions of iPhone users

 

By Roger Fingas
Friday, August 24, 2018, 05:22 pm PT (08:22 pm ET)

Although already fixed, security vulnerabilites at Apple's online store and the website for Asurion, a phone insurance firm, recently exposed the PINs of millions of mobile accounts, a report revealed on Friday.

The Apple vulnerability exposed the PINs of "over 72 million" T-Mobile subscribers, BuzzFeed News claimed. Asurion is noted to have had a separate flaw, affecting the PINs of AT&T customers.

Both Apple and Asurion remedied the situation after BuzzFeed shared findings from security researchers "Phobia" and Nicholas "Convict" Ceraolo. In Apple's case, an account validation page that asked for a T-Mobile cell number and a PIN or Social Security number would potentially let hackers try an infinite amount of attempts — unlike forms for the other three major U.S. carriers, which were already protected by rate limiters.

The problem may have been an engineering mistake made when linking a T-Mobile API to Apple's website, Ceraolo said.

The Asurion vulnerability let people who knew an AT&T user's phone number obtain access to another form asking for their PIN, which like Apple's page lacked a rate limiter.

The Apple flaw is unrelated to a T-Mobile server breach which exposed some of the personal information of about 3 percent of the carrier's subscribers. That attack took place on Aug. 20.

!function(f,b,e,v,n,t,s)
if(f.fbq)return;n=f.fbq=function()n.callMethod?
n.callMethod.apply(n,arguments):n.queue.push(arguments);
if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';
n.queue=;t=b.createElement(e);t.async=!0;
t.src=v;s=b.getElementsByTagName(e);
s.parentNode.insertBefore(t,s)(window,document,'script',
'https://connect.facebook.net/en_US/fbevents.js');
fbq('init', '303691330110002');
fbq('track', 'PageView');
(function(d, s, id)
var js, fjs = d.getElementsByTagName(s);
if (d.getElementById(id)) return;
js = d.createElement(s); js.id = id;
js.src = "http://connect.facebook.net/en_US/all.js#xfbml=1";
fjs.parentNode.insertBefore(js, fjs);
(document, 'script', 'facebook-jssdk'));


Source link

Read the full article