Tag Archive for: Carriers

FCC Eyes Shrinking Mobile Phone Carriers’ Breach Report Window


Companies such as AT&T Inc., Verizon Communications Inc., and T-Mobile US Inc. would have to notify regulators and law enforcement as soon as practicable after discovering a breach of customers’ data under a proposal from the Federal Communications Commission.

Telecommunications providers also would be required to notify customers without unreasonable delay, as part of proposed updates to the FCC’s existing data breach rules released Friday. The agency is asking for public comment on whether to set a specific timeframe— like within 24 or 72 hours of discovery of a breach—or if the deadline for disclosures should vary based …

Source…

Unified API Protection for Telcos and Mobile Carriers – Time to Value


Largest Mobile Carrier Identified 4,600 APIs
in Days, not Weeks, or Months

The security team at the nation’s largest mobile carrier had a problem trying to obtain a consistent and complete inventory of the company’s sprawling API footprint. Business critical API-based applications were driving the mobile carrier’s day-to-day business of managing their mobile network, but the number of APIs were quickly outstripping their ability to keep track of them all.

Key Objectives: A Complete API Catalog

A 2021 security team objective was to obtain a complete running inventory of all their APIs within their organization to ensure that they understood their entire API footprint. Across the organization, they had software groups that supported API application development but worked independently of each other. What resulted was shadow APIs that were not cataloged and were without the oversight of the security team. However, because so many teams were associated with API development, and in the absence of API protection solutions, the cataloging process for both managed and unmanaged APIs was difficult, time-consuming, and lacked accuracy.

AppSec/API Security 2022

Scratching the Surface

When asked how many APIs they had, the security team replied that they had roughly 100 APIs that had been documented manually. They intuitively knew that they were only scratching the surface as there were (likely) hundreds if not thousands of APIs still unaccounted for and not within their existing API catalog.

API Sentinel Automates API Discovery

Cequence introduced API Sentinel to the security team and a proof of concept (PoC) was kicked off. By deploying API Sentinel, in just a matter of days, they were able to discover over 4,600 API endpoints that were active across their infrastructure – a 98% increase in API visibility and inventory over what the security team had just days prior to the introduction of Cequence. Moreover, they were able to obtain deep security insights that included the following:

  • 6 sensitive data exposure incidents where customer ID, account number and other related business sensitive data was exposed.
  • 5 instances of user authentication issues where username and passwords were exposed in cleartext,…

Source…

T-Mobile hacker calls the carrier’s security ‘awful’ in new interview


It’s been over a week since T-Mobile confirmed a hack of its servers affecting tens of millions of customers. The carrier closed the access point quickly, but the hacker had already started selling stolen data by then. This week, as T-Mobile deals with the fallout of the breach, a hacker claiming responsibility for the attack sat down with The Wall Street Journal for an interview. In the interview, the hacker, John Binns, rakes T-Mobile over the coals for its poor security.

The T-Mobile hacker speaks out

Binns told the WSJ that he first discovered an unprotected router of T-Mobile’s in July. He said he had been scanning T-Mobile’s known internet addresses for vulnerabilities using a tool that anyone could download. He wouldn’t say whether or not he had actually sold any of the data he stole, although the initial Motherboard report made it clear that the data was up for sale.

After infiltrating T-Mobile’s data center in Washington, Binns had access to over 100 servers. It then took him about a week to dig through the servers containing personal information from current and former subscribers. On August 4th, he lifted the data that he would later try to sell.

“Their security is awful,” Binns told the WSJ over Telegram in the interview.

The story only gets stranger

Beyond profiting off of stolen data, Binns also wants to bring attention to his alleged persecution by the US government. Binns says he grew up in the US, but moved to Turkey three years ago. A relative in the US tells the Journal that Binns called last year claiming to be a computer expert that had been kidnapped and taken to a hospital against his will.

“He gushed about how he could do anything with a computer,” his relative explained.

Binns apparently repeated these claims in Telegram messages with the Journal. He says that he was abducted in Germany and put into a fake mental hospital.

“I have no reason to make up a fake kidnapping story and I’m hoping that someone within the FBI leaks information about that,” he explained to the Journal, revealing that this was the reason that he wanted to come forward and speak publicly about the hack.

Following the hack, T-Mobile announced that it would…

Source…

T-Mobile hacker says wireless carrier’s security “awful” – WSJ | WTVB | 1590 AM · 95.5 FM


T-Mobile hacker says wireless carrier’s security “awful” – WSJ | WTVB | 1590 AM · 95.5 FM | The Voice of Branch County

Source…