Verizon security hole exposed millions to attack
Verizon patched a security flaw this week after learning the vulnerability on its system could have exposed the personal information of 9 million customers.
The loophole left open credit card and bank information, Social Security numbers and more to visitors with spoofed IP addresses, according to BuzzFeed, which was tipped off by a security expert at the payments company Cinder and reported the flaw to Verizon on May 12, before publishing an article revealing it Wednesday. Verizon says it fixed the problem within hours that day.
Verizon says it has “no reason to believe that any customers were impacted by this,” aside from those who gave the news organization permission to check their records ethically. “If we discover that any were, we will contact them directly.”
BuzzFeed found that using spoofed IP addresses, or the unique codes assigned to Internet-connected devices, hackers could gain full control over home accounts by gleaning enough information to reset account passwords and then take over.
The security issue was caused by a coding error in a software update on April 22. Verizon spokesman Les Kumagai told MarketWatch that given the short time window between the vulnerability’s birth and when it was patched “it’s a low probability of impact.”
Dillon Travers, CEO of Cinder, says his company searches for security vulnerabilities to report to organizations so they can close holes. He told MarketWatch that he thinks his company was the only entity to discover the Verizon flaw, and that it has not been exploited by criminals.
Still, the security problem at Verizon shows how companies sometimes don’t know they’re vulnerable until a third-party — be it a hacker or a security researcher — points it out. Programming errors accounted for 2.6% of data breaches last year, according to a Verizon report that analyzed nearly 80,000 security incidents across 61 countries.
Consumers already have plenty of good reasons to monitor their bank accounts regularly for suspicious or unrecognized charges, and the Verizon flaw adds to the list.
