MobileSyrup is reporting that goes by the moniker NullHumanity has uncovered a vulnerability in Freedom Mobile’s customer login system. Meaning that Freedom Mobile customers could be at risk of hackers gaining access to some of their personal information.:
It’s CAPTCHA after 3, which is not unbreakable. Also there exists a method to forcibly reset the counter after one hour. This was a trivial discovery during my initial research period.
A skilled attacker would find this, and would be almost guaranteed to have a CAPTCHA bypass method at their disposal. 5 requests per hour is still going to result in a lot of account details being found.
I added very large delays in my script so as not to stress the login server and I was still seeing a new success every 30 or so seconds.
I would say a skilled attacker could breach an account and extract data 200 times per minute on a mid level machine.
In other words, it’s possible to brute force your way into the system. And once you’re in, you could have access to all that personal information.
Freedom Mobile said this:
For its part, Freedom Mobile’s vice-president of external affairs, Chethan Lakshman, stated over email: “The security measures we have in place cannot protect against guessing common passwords. We continue to strongly encourage our customers to use unique PIN numbers that are not easy to guess, and to change their PINs frequently to best protect their personal account information.”
Lakshman also said that Freedom continuously reviews its security practices and is “committed to making improvements and changes as appropriate to continue keeping our customers’ information secure.” Freedom’s security measures, said Lakshman, are designed to protect Freedom Mobile customers’ information from malicious activity while “meeting customer demands for a resonable login process.”
I guess that translates to “if you get pwned, it’s not our fault.” In terms of their advice of changing your PIN. That’s not going to make you any safer. What will make users safer is for Freedom Mobile to give their security a rethink. Because you’d think that Freedom Mobile would take the security of their user base seriously. But clearly they don’t based on the statement above.
#Fail
Microsoft Discovers Security Flaws In Android Apps Provided By Canadian Telcos Among Other Telcos
Posted in Commentary with tags Android, Bell, Freedom Mobile, Rogers, Security, Telus on May 30, 2022 by itnerdThis isn’t a good look for Rogers, Bell, Freedom Mobile, TELUS and a few other telcos. According to BleepingComputer, Microsoft has found some serious vulnerabilities in Android apps that they distribute:
The researchers found these vulnerabilities (tracked as CVE-2021-42598, CVE-2021-42599, CVE-2021-42600, and CVE-2021-42601) in a mobile framework owned by mce Systems exposing users to command injection and privilege escalation attacks.
The vulnerable apps have millions of downloads on Google’s Play Store and come pre-installed as system applications on devices bought from affected telecommunications operators, including AT&T, TELUS, Rogers Communications, Bell Canada, and Freedom Mobile.
“The apps were embedded in the devices’ system image, suggesting that they were default applications installed by phone providers,” according to security researchers Jonathan Bar Or, Sang Shin Jung, Michael Peck, Joe Mansour, and Apurva Kumar of the Microsoft 365 Defender Research Team.
“All of the apps are available on the Google Play Store where they go through Google Play Protect’s automatic safety checks, but these checks previously did not scan for these types of issues.
“As it is with many of pre-installed or default applications that most Android devices come with these days, some of the affected apps cannot be fully uninstalled or disabled without gaining root access to the device.”
Well, that’s not good. But these apps have been fixed. Sort of. Microsoft reached out to the relevant parties and these vulnerabilities were fixed. But the at-risk framework is likely used by numerous other service providers who may still have apps out there that aren’t fixed. Which means that threat actors can still launch attacks.
To protect yourself, search for the package name com.mce.mceiotraceagent on you Android device. If you find it, delete it ASAP if you can. I say that because you might need root access to delete it.
Leave a comment »