Paris Hilton may be victim of T-Mobile Web holes
The hacking may have exploited the company's Web site
IDG News Service - The hackers who stole information from hotel heiress Paris Hilton's mobile phone account and those of other T-Mobile customers may have taken advantage of a hole in T-Mobile's Web site, according to security experts and those familiar with the incident.
A flaw in a Web site feature to reset T-Mobile account passwords is believed to have played a role in the hack of Hilton's T-Mobile Sidekick account, which resulted in her star-studded address book, photos, e-mail messages and voice mail being posted for public consumption on the Internet (see story). The password-reset hole is just one of hundreds or even thousands of similar flaws in the mobile provider's Web page that could give malicious hackers easy access to customer information, according to an analysis by a security expert.
A spokesman for T-Mobile USA Inc., a division of T-Mobile International AG, declined to comment specifically on the password-reset exploit or on the security of the company's Web site, despite repeated requests. In an e-mail statement attributed to Sue Swenson, chief operating officer of T-Mobile USA, the company said that it cares about protecting the security and privacy of its customers and that the company is "aggressively investigating the illegal dissemination of information over the Internet of T-Mobile customers' personal data."
Rumors about how Hilton's Sidekick was hacked have been in abundance since her account was posted on Web sites Feb. 20. One leading theory suggests that it may have been linked to a 2003 hack by Nicolas Jacobsen, the 22-year-old who pleaded guilty Feb. 15 to compromising the accounts of 400 T-Mobile customers. Another attributes it to an easy-to-guess password on Hilton's account.
But the hack may in fact be fallout from a technical analysis of the company's Web site based on information in an affidavit filed in the Jacobsen case by U.S. Secret Service agent Matthew Ferrante.
In a Feb. 17 blog posting, Jack Koziol, a senior instructor at InfoSec Institute, used information in the affidavit and publicly available information on T-Mobile's site to discuss how Jacobsen compromised T-Mobile's servers in 2003.
Koziol speculated that Jacobsen used a SQL injection attack to compromise T-Mobile's servers and noted that, as of his posting, there were "literally hundreds of injection vulnerabilities littered throughout the T-Mobile website," according to his blog, "Ethical Hacking and Computer Forensics."
In a SQL injection attack, attackers use a SQL database query to send, or "inject," unexpected commands into a SQL database, allowing them to manipulate the database's contents.
Early on Feb. 19, Koziol received an e-mail from a reader complimenting him on his blog. The
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts