CVE-2018-14990

CVE-2018-14990 affects multiple Android devices (Coolpad Defiant, ZTE ZMAX Pro, T-Mobile Revvl Plus) due to a pre-installed Rich Communication Services (RCS) app. The vulnerable components include a package named com.suntek.mway.rcs.app.service (with a TestReceiver broadcast receiver) and a refac...

CVE-2018-14990

The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro with a build fingerprint of ZTE/P895T20/urd:6.0.1/MMB29M/20170418.114928:user/release-keys, and the T-Mobile Revvl Plus with a build fingerprint of...

The Promise and Peril of 5G

The next generation of mobile cellular technology known as fifth-generation wireless 5G is hitting a peak in the hype cycle, emerging as a major theme/5G.aspx at the Consumer Electronics Show CES this week. Wireless carriers are investing billions of dollars into the technology, which requires a...

Busting SIM Swappers and SIM Swap Myths

KrebsOnSecurity recently had a chance to interview members of the REACT Task Force, a team of law enforcement officers and prosecutors based in Santa Clara, Calif. that has been tracking down individuals engaged in unauthorized "SIM swaps" -- a complex form of mobile phone fraud that is often use...

T-Mobile data breach: Personal data of 2 million users stolen

By Waqas The stolen data also includes "encrypted" passwords. Another day, another T-Mobile data breach. This time, the telecommunication giant T-Mobile has announced that it has suffered a data breach in which unknown hackers have stolen personal data of 2 million customers. According to the...

T-Mobile Alerts 2.3 Million Customers of Data Breach Tied to Leaky API

Wireless carrier T-Mobile notified its 2.3 million subscribers via text message earlier this week that their personal account information may have been exposed. The warnings accompanied a customer advisory posted to the T-Mobile website alerting all its 77 million customers of the breach. Affecte...

T-Mobile Hacked — 2 Million Customers' Personal Data Stolen

T-Mobile today confirmed that the telecom giant suffered a security breach on its US servers on August 20 that may have resulted in the leak of "some" personal information of up to 2 million T-Mobile customers. The leaked information includes customers' name, billing zip code, phone number, email...

T-Mobile Hacked — 2 Million Customers' Personal Data Stolen

T-Mobile today confirmed that the telecom giant suffered a security breach on its US servers on August 20 that may have resulted in the leak of "some" personal information of up to 2 million T-Mobile customers. The leaked information includes customers' name, billing zip code, phone number, email...

Samsung Investigates Claims of Spontaneous Texting of Images to Contacts

Samsung says it isn’t seeing any software or hardware issues after a slew of Samsung phone users reported that their devices are randomly sending camera roll photos to their contacts without permission. Users took to Reddit and Samsung’s official forums over the past week to complain that their...

Supreme Court: Police Need Warrant for Mobile Location Data

The U.S. Supreme Court today ruled that the government needs to obtain a court-ordered warrant to gather location data on mobile device users. The decision is a major development for privacy rights, but experts say it may have limited bearing on the selling of real-time customer location data by...

bsp.t-mobile.de XSS vulnerability

Open Bug Bounty ID: OBB-633287 Description| Value ---|--- Affected Website:| bsp.t-mobile.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

lookup.t-mobile.com XSS vulnerability

Open Bug Bounty ID: OBB-626522 Description| Value ---|--- Affected Website:| lookup.t-mobile.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

T-Mobile Employee Made Unauthorized ‘SIM Swap’ to Steal Instagram Account

T-Mobile is investigating a retail store employee who allegedly made unauthorized changes to a subscriber's account in an elaborate scheme to steal the customer's three-letter Instagram username. The modifications, which could have let the rogue employee empty bank accounts associated with the...

Tracking Firm LocationSmart Leaked Location Data for Customers of All Major U.S. Mobile Carriers Without Consent in Real Time Via Its Web Site

LocationSmart, a U.S. based company that acts as an aggregator of real-time data about the precise location of mobile phone devices, has been leaking this information to anyone via a buggy component of its Web site -- without the need for any password or other form of authentication or...

business.t-mobile.at XSS vulnerability

Open Bug Bounty ID: OBB-609020 Description| Value ---|--- Affected Website:| business.t-mobile.at Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

t-mobile.pl XSS vulnerability

Open Bug Bounty ID: OBB-572260 Description| Value ---|--- Affected Website:| t-mobile.pl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Teen Exposes T-Mobile Flaw Allowing Mass Hijacking of User Accounts

By Waqas Users of popular cell phone carrier T-Mobile could have been This is a post from HackRead.com Read the original post: Teen Exposes T-Mobile Flaw Allowing Mass Hijacking of User Accounts...

U.K. Man Avoids Jail Time in vDOS Case

A U.K. man who pleaded guilty to launching more than 2,000 cyberattacks against some of the world's largest companies has avoided jail time for his role in the attacks. The judge in the case reportedly was moved by pleas for leniency that cited the man's youth at the time of the attacks and a...

Gas Pump Skimmer Sends Card Data Via Text

Skimming devices that crooks install inside fuel station gas pumps frequently rely on an embedded Bluetooth component allowing thieves to collect stolen credit card data from the pumps wirelessly with any mobile device. The downside of this approach is that Bluetooth-based skimmers can be detecte...

dealer.invoice.t-mobile.com XSS vulnerability

Vulnerable URL: https://dealer.invoice.t-mobile.com/bd/public/framesettophtml.jsp?x=test%22%27--!%3E%3CHtml%20Onmouseenter=confirmOPENBUGBOUNTY%20%3C!--//%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 02.08.2017 Vulnerability type:| XSS Vulnerability status:| Public...