Bug on T-Mobile website allowed hackers to access account info

By Christian de Looper Published October 10, 2017

Another day, another privacy issue. Until last week, a T-Mobile website allowed hackers to gain access to personal information like email addresses, T-Mobile account numbers, and more, using only the customer’s phone number. The story was first reported by Motherboard, which said that T-Mobile fixed the issue one day after Motherboard asked the company about it.

Discovered by security researcher Karan Saini, the flaw basically allowed hackers who knew or guessed your phone number to gain valuable information that could then be used in a social engineering attack or even to gain access to other personal information elsewhere online. That put 76 million T-Mobile customers in danger of having their data compromised.

Recommended Videos

Even more concerning is the fact that, according to Saini, it would have been pretty easy for an attacker to write a script that automatically retrieved all account details through this bug. As part of the bug, hackers could also access a user’s IMSI number, which is basically a unique identifying number for customers. Using that, hackers could do things like track a user’s location, intercept texts and calls, and more. On top of that, the number could theoretically be used to conduct fraud through taking advantage of the notoriously insecure SS7 network, which is a backbone communications standard.

T-Mobile, for its part, disputes some of the claims made by Saini. Instead of affecting all 76 million customers, T-Mobile says that the bug only affects a small portion of customers. The company also said that it fixed the bug within 24 hours of it being discovered and according to Saini, the company gave him $1,000 for being a part of the T-Mobile bug bounty program, which rewards people who find and report bugs and flaws.

The report comes at a time when it’s looking more and more like Sprint and T-Mobile will announce a merger in the next few weeks. It’s unlikely this report will have an affect on talks about the merger.

There does not seem to be any evidence that any malicious hackers knew about or exploited the bug, but that doesn’t mean it didn’t happen. Either way, we reached out to T-Mobile and will update this story if we hear back.

Christian de Looper

Former Digital Trends Contributor

Christian de Looper is a long-time freelance writer who has covered every facet of the consumer tech and electric vehicle…

Topics

Phones

I picked four wireless chargers so you can stop making your iPhone, AirPods, and Apple Watch fight over one dorm outlet

The best back-to-school wireless chargers for dorm desks, study spaces, and travel

Computer, Electronics, Laptop

A dorm-room desk can disappear surprisingly quickly beneath a laptop charger, phone cable, Apple Watch puck, and the growing collection of adapters required to power them all. Add textbooks and other academic materials, and finding enough room to study becomes the first assignment of the semester.

A wireless charging stand can consolidate several of those cables into one station. It also gives your phone a dedicated place to sit, which helps when you are checking the time or watching a lecture. Every charger here still needs one connection to the wall. So finding a peripheral that works with all of your gadgets isn't just convenient, it's smart. I picked four models ranging from an inexpensive two-device stand to a fast 25W wireless charger capable of powering an entire Apple setup.

Phones

Your backpack needs one of these power banks before classes start

I picked 4 power banks that can survive your longest day on campus

Anker Nano 3-in-1 10,000mAh portable power bank for iPhone.

Finding an empty outlet on campus can require more patience than registering for a popular class. Common spaces like libraries or lecture halls rarely have sockets in the right places. So a good power bank gives you far more freedom. It gives you the option to choose the quiet corner of the library, work outside between classes, or even finish an assignment without worrying about your laptop's battery.

The right model depends on what you carry, since a phone needs far less power than a MacBook or gaming laptop. I picked four Anker power banks that cover everything from everyday phone charging to running several demanding devices at once.

Phones

The Minimal Phone 2 looks dramatically better than the original, and I’m genuinely here for it

Plastic is out, metal is in, and Minimal Phone 2's renders suggest the digital detox phone concept finally has the hardware to match its ambition.

Electronics, Mobile Phone, Phone

I've been following the Minimal Phone since its initial crowdfunding days. The first iteration had the right idea trapped inside the wrong body, I’d say. Plastic build, no 5G, an underwhelming camera, and e-paper ghosting that frustrated early adopters; all these issues kept the phone from reaching a wider audience.

Now, founder Armen Youssefian has posted what appears to be a 360-degree render of the Minimal Phone 2 on X, and from what I can see, the team has done its homework.