Exposed T-Mobile Domain Could Have Leaked Private Customer Information

A security flaw was recently discovered hiding in T-Mobile domain that could have been exploited to gather customers’ private information.

According to reports, the vulnerability was found in one of T-Mobile’s subdomains intended for the company’s customer care staff. The flawed network, promotool.t-mobile.com, is exclusively being used by the company’s customer support staff and serves as their online portal to access T-Mobile internet services.

Though the said subdomain is not popularly known to the public, ZDNet noted that it was not actually hidden from search engines as well. So if an unauthorized element knows where to look, they can easily abuse the exploit and mine vital account information of T-Mobile customers.

The exploit was found in a hidden API within the domain. And requesting customer information from the website did not require any sort of password. According to the reports, a person using the domain can easily gather account details by simply affixing a customer’s mobile number at the end of the domain address due to the found vulnerability.

Once the exploit was successfully executed, the bugged subdomain returned an array of important customer information including their full name, address, account number.

The flawed domain was also found leaking other sensitive details. ZDNet added that, while account PINs were not released, the bugged domain returned data including “references” to security-related account information. This can then be provided to customer service agents if someone is motivated to manipulate the actual T-Mobile customer’s account.

Meanwhile, other sensitive details such as a T-Mobile customer’s tax identification number was also some of the data returned. The bug also allowed an unauthorized person to view whether a customer has suspended their T-Mobile subscription or if they have an outstanding bill.

Meanwhile, the bugged API has been taken down by T-Mobile after they were notified by security researcher Ryan Stevenson. And as of this writing, the bugged domain has been reportedly fixed. Stevenson was later rewarded with $1,000 under T-Mobile’s bug bounty program.

“The bug was patched as soon as possible and we have no evidence that any customer information was accessed,” a T-Mobile representative said.