ATT Security Flaw...

[wbarnhill]

So I found out that there's a slight (read: LARGE) security issue with ATT and new accounts. After getting my iPhone, I logged into my own account and used the passcode they gave me, after which it made me update my code. No big deal right?

Well the other day I went to log back into my account and accidentally typed in the wrong phone number. It didn't recognize my code, so I used the original code (which I remembered was the last four digits of the phone number). The system asked for an updated code, then sent me to verify the user's information... problem is, it wasn't MY information. Crap.

I called ATT customer service and told them I accidentally changed someone else's passcode, and they changed it back, but didn't mention anything about passing it along or whatever. Just surprises me.

So now I'm wondering... Since iPhone activation and usage is all via iTunes, the users don't have to log into their accounts, so it just sits there with the default password, which just happens to be the last four of the phone number. Why would ANY company issue non-random initial passcodes like that?

I wish I could make ATT change the way they handle new accounts and passcodes for their online site, but I doubt a single person would get their attention unless they started changing user info, which I'm not about to do.

Should I just not worry about it?

 

[KennyFlys]

Contact their legal and/or security departments. I'm sure there general counsel would like to know about the vulnerability.

 

[SkyHog]

Should I just not worry about it?

No, you should worry about it a lot. This is a pretty big deal, and could lead to some serious stuff. Here:

Fox News:
Todd Ciganek, National News Editor
Phone: 212-301-3352
Email:todd.ciganek@foxnews.com

I'd offer other contacts, but it appears CNN and MSNBC try to hide their contact information from the public....

 

[wbarnhill]

No, you should worry about it a lot. This is a pretty big deal, and could lead to some serious stuff. Here:

Fox News:
Todd Ciganek, National News Editor
Phone: 212-301-3352
Email:todd.ciganek@foxnews.com

I'd offer other contacts, but it appears CNN and MSNBC try to hide their contact information from the public....

Pretty much copy/pasted and sent off an email to Mr. Ciganek, so if there is a story, then at least it'll be addressed.

 

[wbarnhill]

Contact their legal and/or security departments. I'm sure there general counsel would like to know about the vulnerability.

I just don't get it. It'd be like Chuck creating a "random password" for every new user that just so happened to be the last few letters of their username.

 

[SkyHog]

Pretty much copy/pasted and sent off an email to Mr. Ciganek, so if there is a story, then at least it'll be addressed.

Good on ya'. Check out Dan Corjulo too. I don't know what he does, but it has something to do with the media of some sort.

BTW - security flaws like this drive me batty insane. From AIM's truncating password encryption to AOL's leak of confidential search records to this to many other things, I find nothing more aggravating than hearing about internet security issues and them being swept aside as if they're nothing.

And, FWIW, I think Apple shares some blame here....

 

[wsuffa]

Contact their legal and/or security departments. I'm sure there general counsel would like to know about the vulnerability.

I'd send it to the Corporate Compliance department instead. Under SarbOx, they have to maintain a compliance department, and part of "compliance" is IT Security. I believe this will fall into that category.

If that doesn't provide results, there are a variety of other avenues, including going to the SEC, that I'd use before going to the media. Once it hits the media, then you have aided folks in breaking into accounts. Handle it the same way that the "ethical" Windows hackers handle bugs they find - go to the company first.

 

[KennyFlys]

I'd send it to the Corporate Compliance department instead. Under SarbOx, they have to maintain a compliance department, and part of "compliance" is IT Security. I believe this will fall into that category.

Oh yes... Sarbanes Oxley... such wonderful legislation! Bernie Marcus has said it would be one of those lovely terms would make building Home Depot these days near impossible.