back to article Verizon sprints to crush FiOS account exposure hole

Up to five million user accounts, including email inboxes and private messages of Verizon's FiOS application, were exposed thanks to a flaw reported today. XDA senior software developer Randy Westergren said the FiOS API flaw since fixed allowed any account to be accessed by manipulating user identification numbers in web …

  1. Anonymous Coward
    Anonymous Coward

    Just copy and paste.

    If "net neutrality" is a concern for billion dollar communication companies, then where is all their money going if they apparently just copy and paste server code? If someone took the time, someone might discover that Verizon's development team all have user accounts over at stackexchange.

    In all seriousness, it might just be a matter of time until your posted answer to a question winds up in a headline story, and not in a good way (especially considering what answers get "upvoted" these days).

  2. thomas k.

    5 million, hmm

    Good thing they stopped the FIOS roll-out years ago or a lot more people would've been affected.

    But, wait, does that mean there are *only* 5 million people connected to FIOS (out of ~115 million households)? If that's what Verizon means by claiming they "compete" against cable, I don't think cable has much to worry over.

    1. Anonymous Coward
      Anonymous Coward

      Re: 5 million, hmm

      I don't know how many FIOS users there are, but not everyone uses their ISP's email. I don't have an email account with my ISP, though I could have one free for the asking.

      1. thomas k.

        Re: 5 million, hmm

        @ Doug S

        Possible misunderstanding on my part, then, as the article seemed to indicate the FIOS application as the culprit. I was going on the assumption that all subscribers had the app installed but, thinking back to when I first got DSL, they tried to get me to install some desktop app that, as it wasn't required for the connection to work, I quickly uninstalled. I guess it's the same with FIOS.

  3. Kevin McMurtrie Silver badge
    FAIL

    Epic fail

    Verizon engineers, please write this 1000 times on the whiteboard:

    There must never be a user ID parameter in authenticated REST calls. That's what authentication is for.

  4. Cronus
    Thumb Up

    Lame that this vuln. existed but...

    This guy didn't threaten to go public he just discreetly disclosed the bug to Verizon and they fixed the vuln. in 2 days. That's a damn sight faster than most companies patch bugs.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like