T-Mobile Online Tool Let Anyone Get Customer Info With a Phone Number

T-Mobile Online Tool Let Anyone Get Customer Info With a Phone Number

For many of us, our smartphones are not just a way of communicating with the world. They contain sensitive data and can serve as a key to important online accounts. According to security researcher Ryan Stevenson, T-Mobile wasn’t taking account security very seriously. It left a subdomain accessible on the open internet that would provide customer details to anyone who had your phone number. The hole has been patched now, but the site may have been used to hijack accounts.

The domain in question is promotool.t-mobile.com, which is not listed anyplace on the T-Mobile website. However, it’s easy to dredge up in a Google search. The page used to host an unrestricted API that provided access to user account information. You could enter a phone number and get back almost all of the account details associated with it.

The returned data included the customer’s full name, mailing address, account number, and in some instances even part of the tax ID or social security number. The account status was also reported on this page, including notes on past due payments and account suspensions. In some instances, the data also had account PINs and security questions that customers would need to verify their identities with support. With all this data, it would be trivially easy for someone to hijack accounts. There was so much information, someone could even use it to gain access to other online accounts. Think about how often you are asked to verify with an address or the last few digits of your social security number.

The updated page now asks for a login.
The updated page now asks for a login.

Why would something like this even exist? The promotool site is supposed to be for internal customer support rep use only. But the site didn’t require an account login, and it was accessible from outside of T-Mobile’s corporate network. After Stevenson reported the issue, T-Mobile took steps to close down the rogue API and lock down the web page. If you visit the promotool page now, it demands login credentials.

Stevenson was paid a $1,000 bug bounty for reporting the error, and that’s a deal for T-Mobile. The carrier has struggled to address SIM hijacking and port out scams that allow attackers to steal subscriber phone numbers. This can allow the attackers to retrieve two-factor authentication codes via SMS and break into important online accounts. This web portal may well have helped make those attacks more common. You should still take security measures like adding number porting restrictions to your account, though. There could be more vulnerabilities lurking in T-Mobile’s system.

Continue reading

AMD May Allow Custom RX 6900 XT Cards, Launch Stock May Be Limited
AMD May Allow Custom RX 6900 XT Cards, Launch Stock May Be Limited

There are rumors that Nvidia may not be the only company facing production shortages this holiday season. High-end GPUs might just be very hard to find in general.

Newegg Changes Return Policy to Combat Scammers, Harm Customers
Newegg Changes Return Policy to Combat Scammers, Harm Customers

Newegg is trying to crack down on scammers, but it's catching regular users in the same net.

Qualcomm to Acquire Nuvia, Head Back Into Custom CPU Development
Qualcomm to Acquire Nuvia, Head Back Into Custom CPU Development

Qualcomm will buy Nuvia for $1.4B. The ARM CPU developer has been working on a server chip to challenge x86, but we don't know yet if Qualcomm will continue those plans.

Man Builds Custom 8-Bit CPU From Scratch
Man Builds Custom 8-Bit CPU From Scratch

One enterprising individual has built his own 8-bit CPU from scratch, on solderless breadboards — and learned to program it, too.