On his blog, software developer Randy Westergren details how he recently discovered a vulnerability in the request the app makes to the Verizon servers when populating the app’s inbox preview. By going into that request and simply changing the user ID to another user’s account name, he could access their inbox. Further mucking around allowed him to send messages as that user.
“The next step was to reach out to Verizon,” writes Westergren. “Being such a large company, I thought it was probably going to be difficult to get in contact with the right people.”
Twitter was no use, so he tried contacting Verizon’s corporate security team directly and ended up getting a timely response.
Within two days, Verizon had patched the exploit, which is good news. But as Thomas Fox-Brewster points out on Forbes.com, there is still the issue that Verizon doesn’t provide end-to-end encryption of its e-mails.
by Chris Morran via Consumerist
No comments:
Post a Comment