{"id":42402,"date":"2018-08-25T00:22:40","date_gmt":"2018-08-25T00:22:40","guid":{"rendered":"https:\/\/appleinsider.com\/articles\/18\/08\/24\/flaws-in-apple-asurion-websites-expose-pins-of-millions-of-iphone-users"},"modified":"2018-08-25T00:22:40","modified_gmt":"2018-08-25T00:22:40","slug":"flaws-in-apple-asurion-websites-expose-pins-of-millions-of-iphone-users","status":"publish","type":"post","link":"https:\/\/sickgaming.net\/blog\/2018\/08\/25\/flaws-in-apple-asurion-websites-expose-pins-of-millions-of-iphone-users\/","title":{"rendered":"Flaws in Apple & Asurion websites expose PINs of millions of iPhone users"},"content":{"rendered":"

\u00a0<\/span> <\/p>\n

By Roger Fingas<\/a>
Friday, August 24, 2018, 05:22 pm PT (08:22 pm ET)<\/span> <\/p>\n

Although already fixed, security vulnerabilites at Apple’s online store and the website for Asurion, a phone insurance firm, recently exposed the PINs of millions of mobile accounts, a report revealed on Friday.
<\/span><\/p>\n

\n
\"Hacked\"<\/div>\n

<\/span><\/div>\n

The Apple vulnerability exposed the PINs of “over 72 million” T-Mobile subscribers, BuzzFeed News<\/em> claimed<\/a>. Asurion is noted to have had a separate flaw, affecting the PINs of AT&T customers.<\/p>\n

Both Apple and Asurion remedied the situation after BuzzFeed<\/em> shared findings from security researchers “Phobia” and Nicholas “Convict” Ceraolo. In Apple’s case, an account validation page that asked for a T-Mobile cell number and a PIN or Social Security number would potentially let hackers try an infinite amount of attempts \u2014 unlike forms for the other three major U.S. carriers, which were already protected by rate limiters.<\/p>\n

The problem may have been an engineering mistake made when linking a T-Mobile API to Apple’s website, Ceraolo said. <\/p>\n

The Asurion vulnerability let people who knew an AT&T user’s phone number obtain access to another form asking for their PIN, which like Apple’s page lacked a rate limiter.<\/p>\n

The Apple flaw is unrelated to a T-Mobile server breach<\/a> which exposed some of the personal information of about 3 percent of the carrier’s subscribers. That attack took place on Aug. 20.<\/p>\n

<\/span> <\/p>\n","protected":false},"excerpt":{"rendered":"

\u00a0 By Roger Fingas Friday, August 24, 2018, 05:22 pm PT (08:22 pm ET) Although already fixed, security vulnerabilites at Apple’s online store and the website for Asurion, a phone insurance firm, recently exposed the PINs of millions of mobile accounts, a report revealed on Friday. The Apple vulnerability exposed the PINs of “over 72 […]<\/p>\n","protected":false},"author":2,"featured_media":42403,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[57],"tags":[155],"class_list":["post-42402","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-apple-insider","tag-iphone"],"_links":{"self":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/posts\/42402","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/comments?post=42402"}],"version-history":[{"count":0,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/posts\/42402\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/media\/42403"}],"wp:attachment":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/media?parent=42402"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/categories?post=42402"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/tags?post=42402"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}