Until a few months ago, Verizon’s Messages service was affected by a vulnerability that could have easily been exploited to launch cross-site scripting (XSS) attacks using SMS messages.
Verizon Messages (Message+) is a text and multimedia messaging service that allows users to send and receive messages across multiple types of devices, including mobile and desktop, without interruption.
According to the expert, an attacker simply had to send a specially crafted SMS to the targeted user and they could have taken complete control of the victim’s session. Once the user clicked on the malicious message, the attacker could have taken over any functionality, including to send SMSs on behalf of the victim or intercept messages.
The researcher sent his proof-of-concept (PoC) code along with a video and screenshots to Verizon in mid-November 2016. The flaw was resolved by the telecoms giant within a few weeks, but its details were disclosed only on Sunday.
The vendor addressed the vulnerability using the DOM API, which is the fix suggested by Westergren.
This was not the first time the researcher had found a potentially serious flaw in a Verizon service. In January 2015, Westergren disclosed a vulnerability in Verizon’s FiOS web service that could have been exploited to hijack email accounts.
Last year, the expert discovered a critical security hole in Verizon’s webmail service that could have been leveraged by hackers to silently forward a user’s emails to an arbitrary address.
from Information Security Newspaper http://ift.tt/2qNkBwn