It has been reported that American telecommunications provider Sprint has suffered a data breach, telling customers that hackers broke into their accounts through a Samsung website. The number of customer accounts breached isn’t yet known. The hack occurred June 22, Sprint told its customers in a letter, and included details like first and last name, billing address, phone number, subscriber ID, account number, device type, device ID, monthly charges, account creation date, upgrade eligibility and any add-on services. It occurred via the Samsung “add a line” website.
- The company said it re-secured all compromised accounts by resetting PIN codes, three days later, on June 25
- The Sprint account breach notification lacks a few important details, such as the number of breached accounts, the date when hackers first started accessing Sprint accounts via the Samsung.com website, and if hackers modified any customer account details
- This is the second account breach notification letter Sprint is sending this year. The company also suffered another breach via Boost Mobile, a virtual mobile network and Sprint subsidiary
Hackers used #Samsung website to access #Sprint's customer data
More: https://t.co/yih9FjIf5X#Security #Hacking #Breach #Telco
— Hackread.com (@HackRead) July 16, 2019
Experts Comments:
Felix Rosbach, Product Manager at comforte AG:
Protecting data is more important than just preventing breaches. The best thing organizations can do is to focus on a data-centric security strategy to make sure that data is protected and access to it is restricted all the time.”
Boris Cipot, Senior Security Engineer at Synopsys:
In addition to changing PIN numbers, as recommended by Sprint, I would also advise users to change their account credentials for the Sprint portal. As we know, many people use the same username and password for many different accounts, so it would be advisable to change those also. In any case, it would be advisable for everyone to change their password every now and then and not use the same credentials for different services.”
Saryu Nayyar, CEO at Gurucul:
When attackers manage to hijack legitimate access rights, they can remain undetected for extended periods of time. Many organisations don’t have the ability to identify subtle behavioral anomalies that are indicators of cyber threats. But with advanced machine learning algorithms it’s possible to spot behaviors that are outside the range of normal activities and intervene before the damage is done.”
Javvad Malik, Security Awareness Advocate at KnowBe4:
It’s unfortunate that Sprint didn’t provide more details around the number of accounts breached and whether attackers had modified any account details. It could be possible that Sprint is still collating the information, but transparency and clarity of impact is vitally important for companies in the aftermath of an incident. Delays to sharing information can undermine customer confidence.”
Jonathan Bensen, CISO at Balbix:
This breach adds to a growing list of recent, unfortunate events suffered by Sprint. The company announced that it lost 189,000 customers and admitted a loss of four cents per share in its fiscal fourth quarter. Sprint’s subsidiary, Boost Mobile, also suffered a breach in May after hackers obtained unauthorized access via a brute force credential stuffing attack.
It would not be surprising if T-Mobile reconsiders its merger with Sprint after this latest breach. Companies must remain ever vigilant during merger and acquisition (M&A) activity to avoid suffering the same fate as Marriott that was fined $123 million last week under GDPR for its 2018 data breach.”
Ben Goodman, CISSP and SVP at ForgeRock:
Even if Sprint’s website was secure, the intruders gained unauthorized access via Samsung.com. The attack landscape is constantly expanding and organizations must be prepared to secure customer data by implementing security strategies and tools that respect customer privacy and prescribe real-time, contextual and continuous security that detect unusual behavior and prompt further action, such as identity verification via MFA.
Unfortunately, even adhering to best practices still does not guarantee an individual’s account’s safety. Organizations across all industries continue to use knowledge-based answers for account recovery purposes, and this method represent another highly susceptible attack vector for hackers to target to gain access to accounts. Questions such as “where did you go to high school/college” and “what city were you born in” are two commonly asked questions for password resets, and a threat actor can use previously pilfered personally identifiable information (PII) from other breaches to correctly answer them and obtain access. Companies must begin to stray away from this type of account recovery method in order to best secure their customers’ profiles.”
Robert Prigge, President at Jumio:
Monique Becenti, Product and Channel Specialist at SiteLock:
Mike Bittner, Associate Director of Digital Security and Operations at The Media Trust:
“A poorly secured web app infrastructure likely contributed to this breach. Samsung’s site was probably compromised through a user input field provided by a third-party code supplier who designed their app without security and privacy in mind. Ten years ago, relying on third-parties was cost-effective. But with new data privacy laws like GDPR and regulators eager to flex their new authority, a third-party’s data breach or misuse will hit the company’s top and bottom lines. All businesses must have a firm grasp of all their third parties’ security posture and minimize the impact that a compromised third party might have on customers.”
Sam Bakken, Senior Product Marketing Manager at OneSpan:
Craig Young, Principal Security Researcher at Tripwire:
Information systems which connect disparate organizations, run the high risk of inadvertently exposing sensitive data or introducing a backdoor. This is something we have seen in the past including with phone operators. For example, back in 2010, a flaw on the AT&T web site had enabled attackers to dump email addresses of iPad users registered on the network.”
Tim Mackey, Principal Security Strategist at Synopsys:
For Sprint customers, its important that they go in and manually change their PIN rather than relying on the PIN generated by Sprint. The PIN is part of the process Sprint uses to validate the legitimacy of any port requests. Importantly, the replacement PIN shouldn’t be the same as the original!
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.