Filed Under Geek Misc
Here’s the basic run down. Sprint has an online place where account holders can go to pay bills, update account info, or even purchase things. In order to partake, account holders must register. Its during the registration process one can easily access accounts. Sprint has partnered with some company that “specializes in identity theft” (obviously they suck) and provides you three security questions to verify proper identity. So far so good, right? Not really. By the numbers:
- Questions are based off of public records: Meaning, the answers can be found very easily. There are plenty of online websites that offer cheap public record searches on individuals. Think about that, why would you base security questions off information that’s freely available to the public?
- Multiple Choice: Lets just narrow done the options for everyone. Seriously, why are multiple choice tests so loved by students? Because its easier to guess an answer when you only have 4 options as opposed to open ended questions where the answers are almost limitless.
- Easy Answers: How can you make a multiple choice question even easier? Give ridiculously easy answers. In the Consumerist linked article, one of the questions asks ”which of the following cars have been registered under said address – Lotus, Honda, Lamborghini, or Fiat”. Are you f***ing kicking me!?!? I can count the number of Lotus and Lamborghini’s I’ve seen in my life on one hand. And Fiats? Are they even in America? There’s definitely no U.S. page for their website.
- Only Need 2 Out of 3: Yup thats right. Have 1 really tough question, no problem because you only need to answer 2 easily guessable multiple choice questions based off public records. So really that third question, its just a bonus to even further improve your chances in guessing the correct answers. Yeah!
Now oddly, Sprint gives you three choices. You can answer the user generated security question, have the pin texted to you, or answer identity questions. Sprint’s description for the latter:
Sounds impressive doesn’t it. Keyword being here is “sounds”. The three questions I was asked were the following:
- Which of the following vehicle models has been registered at the following address [Said Address]?
- Which of the following people have NEVER resided with you or shared the same address as you?
- In which of the following cities have you NEVER lived or used in your address?
First thought that comes to mind, Sprint has access to this information? Oh yeah its public records stuff. But it only took 1 second (if that) to load. Is it that easy to search for? Or do they pre-assemble this information upon becoming a customer? Either way, its a pretty scary thought.
Second thought that comes to mind, the “Said Address” was supplied freely. Up until this point, I didn’t have to guess any answers or go through any security check points. So I established with only a phone number, I can get a current address. Worse, when I plugged the “Said Address” into Google Maps, it dropped me right on top of Abbey’s house. I tested this out with other addresses and apparently Google can land you with great accuracy to the intended addressee even if you leave out the city and state.
The only question I knew for sure was #1. Abbey only drove a Saturn and only one of the answers was a Saturn model number. Had I not known, they already provided the correct address so I could go to her house and find out. #3 was another obvious question. Abbey lives in PA and all the addresses given were from PA except one. That one exception was some bumble fuck town on the other side of the country. How many people come from towns of 200? Exactly, my obvious answer. #2 was my non-obvious question and gave a random answer.
I clicked submit and BOOM! Full access. It literally had only taken me 60 seconds. The first screen shown gave Abbey’s account number, plus reminded me what the answer to her security question was. How thoughtful. Once in, I could have totally made Abbey’s life a living nightmare. Track history of calls, full access to billing information, make some store purchases online, and even enable GPS tracking. What’s worse, what proof is there that I even got in? What proof will show that anything I charge or change was done by anyone other then Abbey?
I was so freaked out I immediately told Abbey. Of course Abbey was upset with me (who wouldn’t) and I tried to explain. I’m a computer guru and I’m sure Abbey initially thought I did some computer mastery hack to break Sprint’s security system. Far from the truth. A quote direct from the Consumerist article:
I couldn’t have said it better. A pin number is even better then the user generated security. Though both are still better then this new form of identification. Simply knowing a little about someone is all it takes. At least the user generated question requires a case sensitive typed answer. No multiple choice. Apparently Sprint knows about this little security failure. The consumerist has repetitively told them about but it and seems Sprint doesn’t want to do anything. Even claiming the system is not easy to break. I’m sure Sprint channeled a lot of money into getting that system up and going. Last thing they want to do is terminate it. The consumerist posted to help raise awareness and get Sprint to action. I’m reposting to help with that effort. Ironically Abbey’s account was hacked a year ago and several thousands dollars was charged to it. I wouldn’t be surprised if the method they used was this one.
This post currently has 2 Comments
