Windows 10: T-Mobile bug let anyone see any customer's account details

Brink · May 24, 2018

A bug in T-Mobile's website let anyone access the personal account details of any customer with just their cell phone number.

The flaw, since fixed, could have been exploited by anyone who knew where to look -- a little-known T-Mobile subdomain that staff use as a customer care portal to access the company's internal tools. The subdomain -- promotool.t-mobile.com, which can be easily found on search engines -- contained a hidden API that would return T-Mobile customer data simply by adding the customer's cell phone number to the end of the web address.

Although the API is understood to be used by T-Mobile staff to look up account details, it wasn't protected with a password and could be easily used by anyone.

The returned data included a customer's full name, postal address, billing account number, and in some cases information about tax identification numbers. The data also included customers' account information, such as if a bill is past-due or if the customer had their service suspended.

The data also included references to account PINs used by customers as a security question when contacting phone support. Anyone could use that information to hijack accounts.

T-Mobile pulled the API offline a day after it was reported in early April by security researcher Ryan Stevenson, who was later awarded $1,000 in a bug bounty.

Stevenson sent ZDNet several screenshots of customer data returned from the working API.

A T-Mobile spokesperson said: "The bug bounty program exists so that researchers can alert us to vulnerabilities, which is what happened here, and we support this type of responsible and coordinated disclosure."

"The bug was patched as soon as possible and we have no evidence that any customer information was accessed," the spokesperson added...
Click to expand...

Read more: T-Mobile bug let anyone see any customer's account details | ZDNet

:)

LynneBonner · May 25, 2018

Windows 10 Mobile isn't picking up Outlook.com account

I upgraded my husband's Lumia 640 from Windows 8.1 to Windows 10 Mobile. His Outlook.com account isn't listed in Accounts under Settings in People and Calendar. I've been through all the steps to add an account, but the Outlook.com account still isn't
listed. Can anyone suggest a workaround for this problem?

Moved from Mobile Devices

steve928 · May 25, 2018

MMSC URL with colon T-Mobile UK

Hi,

I have a Lumia 928 I got from Verizon. I am in the UK and put a T-Mobile UK SIM into it. I set the APN for internet data and it is working fine. However, the T-Mobile APN for MMS (the MMSC URL) specifies a port at the end.

http://mmsc-t-mobile.co.uk:8002/

The phone will not save the url in that form, it cuts off the ":8002"

Does anyone have any suggestions?

Is this just a bug in the APN settings menu?

Windows 10: T-Mobile bug let anyone see any customer's account details

T-Mobile bug let anyone see any customer's account details

T-Mobile bug let anyone see any customer's account details

T-Mobile bug let anyone see any customer's account details - Similar Threads - Mobile bug let

Are there any recent answers for issues with bitlocker? See details below.

Please see details

Please see details

Please see details

Any programs to see folder size in the details column?

never let anyone my account details without confirming the account details

never let anyone my account details without confirming the account details

Hackers help themselves to data of 2 million T-Mobile customers

Customizing Details Pane for folders.