A vulnerability found in a Verizon mobile application could have been exploited to harvest the call records of millions of Americans, according to the researcher who found the flaw.
The vulnerability was discovered by cybersecurity researcher Evan Connelly in Verizon Call Filter, an iPhone application that allows users to identify suspected spam calls and automatically block such calls.
The issue was reported to Verizon on February 22. It was patched by the third-party owner of the application in mid-March, Verizon told SecurityWeek.
Connelly discovered that when the app displayed the user’s incoming call history, it made a request to a server which provided the information. That request contained the user’s phone number and the timeframe for which the call records were requested.
However, the endpoint the requests were sent to failed to check that the phone number specified in the request actually belonged to the user. This could have enabled an attacker to send a request to the vulnerable endpoint with an arbitrary phone number to obtain incoming call records for that number.
No other information beyond phone numbers and timestamps associated with incoming calls appears to have been exposed.
Connelly did not determine whether the flaw could have been exploited against any Verizon customer or just users who have the Verizon Call Filter service enabled.
“I believe this service may be on by default for many/all Verizon Wireless customers, so in either case, it does seem this issue impacted either nearly all, or all customers,” the researcher said in a blog post.
Verizon has over 140 million subscribers and its statement does not indicate that the company is disputing the researcher’s claims about millions of users potentially being impacted by the vulnerability.
“Call metadata might seem harmless, but in the wrong hands, it becomes a powerful surveillance tool. With unrestricted access to another user’s call history, an attacker could reconstruct daily routines, identify frequent contacts, and infer personal relationships,” the researcher said.
“Timestamps can be cross-referenced with social media or public sightings to map physical movements. Repeated numbers expose private or burner lines, compromising whistleblowers, journalists, or abuse survivors,” he added.
A recent China-linked hacking campaign targeting several telecom companies has shown that call data may be valuable to threat actors.
“While there was no indication that the flaw was exploited, the issue was resolved and only impacted iOS devices. Verizon appreciates the responsible disclosure of the finding by the researcher and takes the security very seriously,” Verizon said in a statement.
As for Verizon mentioning that the vulnerable application is developed by a third party, Connelly’s research indeed indicates that the Verizon Call Filter app is made by Cequint, a company focusing on caller ID services.
Connelly previously discovered a vulnerability in a Tesla tool that could have been exploited to take over accounts of former employees.
Related: Halo ITSM Vulnerability Exposed Organizations to Remote Hacking
Related: Abandoned Amazon S3 Buckets Could Have Enabled Attacks Against Governments, Big Firms
Related: Critical Apache Parquet Vulnerability Leads to Remote Code Execution
