Verizon FiOS app flaw exposes 5 Million Customers’ accounts

Security expert discovered a critical flaw in Verizon’s FiOS mobile app that could be exploited to access the email account of any Verizon customer.

A new critical vulnerability in exposing million accounts to cyber threats, this time the flaw affects the Verizon FiOS mobile app and could be exploited by attackers to access the email account of any Verizon customer. It has been estimated that almost five million user accounts of Verizon FiOS application at risk.

The FiOS API vulnerability  was discovered by the XDA senior software developer Randy Westergren on January 14, 2015, the expert has discovered that he was able to gain complete control of the account to access its data, including inboxes, and also acting on the owner behalf.

Westergren analyzed the traffic generated by the Android version of My FiOS, which gives customers the whole lot of control their account and email, in this way he demonstrated a possible hack on the account and reported the flaw to Verizon.

The FiOS API vulnerability allows an attacker to access any account by simple manipulating user identification numbers in the web requests, the attack could give attackers the ability to read customers’ messages from a their Verizon inbox.

The expert noticed two direct references to his username, particularly this parameter:  getEmail?format=json&uid=RWESTERGREN05

“Altering the uid parameter and specifying another username shouldn’t have an effect, since I’m logged in and my session is maintained through my cookies,” Westergren wrote in an advisory. “Amazingly, this was not the case. Substituting the uid with the username of another email account indeed returned the contents of their inbox.” “Using the returned header list, one can read individual inbox messages by substituting the corresponding mid and uid in the following GET request:”

http://www.verizon.com/mobilesvc/messagecenter/members/service/reademail?format=json&uid=RWESTERGREN05&mid=28&fid=INBOX

The vulnerability could be also exploited to send email messages from victims’ accounts.

“It was my suspicion that all of the API methods for this widget within the app were vulnerable. My last test was sending an outgoing message as another user [which was] also successful,” Westergren added.

Westergren has also written a proof-of-concept to demonstrate the vulnerability to the Verizon team. The security experts at the Verizon admitted the presence of the critical flaw and promptly issued a fix just a couple of day the vulnerability was disclosed.

“Version’s (corporate) security group seemed to immediately realize the impact of this vulnerability and took it very seriously,” Westergren said. 

Verizon rewarded Westergren with a year’s worth of free internet.