Cellular Phone Forum / Providers / T-Mobile / January 2005
Yikes! T-Mobile got hacked
|
|
Thread rating:  |
Rig - 12 Jan 2005 16:36 GMT http://www.securityfocus.com/news/10271
Sarah Tanembaum - 12 Jan 2005 17:07 GMT > http://www.securityfocus.com/news/10271 Oh my, ...
Even without this incident, I have a lot of problem with T-Mobile text messaging spam. More SPAM? And worst, some one get a hold of our identity.
nobody - 15 Jan 2005 22:19 GMT Log on to my-tmobile, then set a filter yourself to block xxx-xxx-xxxx@tmomail.net the x`s being your phone number. Then 99% of the spam will not get to your handset, nor will you be charged for it. Other wise have tmobile change your phone number incase you got someones old number that was receiving spam. If thats too hard for you, then just pay the termination fee and go elsewhere. I think all you whining posts here are worst then most spam anyway:)
>> http://www.securityfocus.com/news/10271 > Oh my, ... > > Even without this incident, I have a lot of problem with T-Mobile text > messaging spam. More SPAM? And worst, some one get a hold of our identity. BruceR - 16 Jan 2005 01:01 GMT She's a troll. Told her to change her number a week ago but the danger is that she'd have nothing to complain about. She's commited to being a victim.
From:nobody nobody@wants-spam.a.s
> Log on to my-tmobile, then set a filter yourself to block > xxx-xxx-xxxx@tmomail.net the x`s being your phone number. Then 99% [quoted text clipped - 10 lines] >> text messaging spam. More SPAM? And worst, some one get a hold of >> our identity. J Figueredo - 13 Jan 2005 18:16 GMT And of course the company doesn't let anyone know, perhaps a nice email campaign to some the executives on this list would provide some answers.
http://www.t-mobile.com/company/about/quickfacts.asp
Jose
> http://www.securityfocus.com/news/10271 Joseph - 13 Jan 2005 23:11 GMT >And of course the company doesn't let anyone know, perhaps a nice email >campaign to some the executives on this list would provide some answers. > >http://www.t-mobile.com/company/about/quickfacts.asp You might try getting your facts straight before you start running off at the mouth.
"T-Mobile has stringent procedures in place where we monitor for suspicious activity so that limited his activities and we were able to take corrective action immediately," Dobrow said.
Jacobsen made at least two attempts to breach T-Mobile's system and eventually stole names and social security numbers for 400 T-Mobile customers before the company took steps to stop the incursion, Dobrow said.
The hacker was not able to access credit card data which is stored on a different system, he said.
T-Mobile notified the affected customers and asked the U.S. Secret Service to investigate the incidents, Dobrow said.
Dobrow would not comment on reports that first surfaced in the online SecurityFocus Web site that Jacobsen tried to sell the information in underground hacker chat rooms.
The company said the Secret Service was investigating whether Jacobsen also accessed photos that T-Mobile customers took with the camera function on their phones.
A Los Angeles grand jury indicted Jacobsen on charges of intentionally accessing a computer system without authorization and with the unauthorized impairment of a protected computer between March and October of 2004, the court documents showed.
A U.S. Attorney's Office spokesman said Jacobsen was free on bail and living with relatives in Oregon while awaiting trial.
- - - - - - - - - - - - - - - - - - - - - - - - - -
danny burstein - 13 Jan 2005 23:15 GMT >You might try getting your facts straight before you start running off >at the mouth. And you might think twice about believing the PR spin of a company that has its data hacked, and kept quiet about it until the news leaked out. ...
(OP quoting from the press release:)
>Jacobsen made at least two attempts to breach T-Mobile's system and >eventually stole names and social security numbers for 400 T-Mobile >customers before the company took steps to stop the incursion, Dobrow >said. Those are the 400 that t-mobile _knows about_ (or acknowledges). Paraphrasing the poetry of Donald Rumsfeld, it's the unknown breakins that are even more worrisome.
I'd sure as hell like to know if the data mining included the phone numbers called by (and calling to...) the customers.
double disclosure: I'm a subscriber, and also a shareholder.
 Signature _____________________________________________________ Knowledge may be power, but communications is the key dannyb@panix.com [to foil spammers, my address has been double rot-13 encoded]
Jym L - 13 Jan 2005 23:46 GMT Once again, Mr Kvetch speaks from his lower "mouth" ... Jeesh...
There were legal steps in any investigation before anyone could release information. This included (Per the Indictments, NOT TMobile) that any and ALL accounts that were accessed were notifed in writing before the indictments were unsealed...
> >You might try getting your facts straight before you start running off > >at the mouth. [quoted text clipped - 23 lines] > dannyb@panix.com > [to foil spammers, my address has been double rot-13 encoded] Carl. - 14 Jan 2005 04:05 GMT > Once again, Mr Kvetch speaks from his lower "mouth" ... Jeesh... > > There were legal steps in any investigation before anyone could release > information. This included (Per the Indictments, NOT TMobile) that any and > ALL accounts that were accessed were notifed in writing before the > indictments were unsealed... And yet we STILL have not been given an official notification from T-Mobile.
John Richards - 14 Jan 2005 20:18 GMT >> Once again, Mr Kvetch speaks from his lower "mouth" ... Jeesh... >> [quoted text clipped - 4 lines] > > And yet we STILL have not been given an official notification from T-Mobile. You would have been notified if YOUR account had been accessed by the hacker. As I understand it, the hacker could have accessed ANY T-Mobile account, but the server logs show that he only accessed about 400.
 Signature John Richards
Sarah Tanembaum - 15 Jan 2005 17:15 GMT >>> Once again, Mr Kvetch speaks from his lower "mouth" ... Jeesh... >>> [quoted text clipped - 11 lines] > As I understand it, the hacker could have accessed ANY T-Mobile account, > but the server logs show that he only accessed about 400. Deception by T-Mobile. Unless they can exactly say what account are being accessed, they have to inform to the general public of what was happening so public can take an extra caution.
But NOOOOOOOOOOOOO! They keep it under wrap for their own selfish reason, but forgetting about the public. This is much the same as my complaint about the text messaging. They are just stonewalling the public, make as much profit as they can before it goes out of hand, and then perhaps change or apologize.
I just hope it will be too late and the public will punish them with their IGNORANCE.
Scott Stephenson - 15 Jan 2005 17:39 GMT > Deception by T-Mobile. Unless they can exactly say what account are > being accessed, they have to inform to the general public of what was > happening so public can take an extra caution. And they did, you moron. Quit whining and bitching about anything to do with T-Mobile. If your accout was compromised, you were contacted by T-Mo. If not, you weren't. What is so difficult to understand there?
> But NOOOOOOOOOOOOO! They keep it under wrap for their own selfish > reason, but forgetting about the public. This is much the same as my > complaint about the text messaging. They are just stonewalling the > public, make as much profit as they can before it goes out of hand, and > then perhaps change or apologize. No they aren't- you obviously either can't read the press about this, or are just out to bitch about T-Mo.
> I just hope it will be too late and the public will punish them with > their IGNORANCE. Doubtful, although we seemed to getting punished with your ignorance.
Jym L - 15 Jan 2005 19:53 GMT Buzz off Kvetch...
ALL of the reports state that T-Mobile knew exactly which accoutns were accessed and ALL of the effected account holders were notifed in writing before the indictments were released to public...
Oh, I forgot... If YOU didnt personally read it before the fact, then TMobile is being deceptive...
> >>> Once again, Mr Kvetch speaks from his lower "mouth" ... Jeesh... > >>> [quoted text clipped - 24 lines] > I just hope it will be too late and the public will punish them with > their IGNORANCE. John Richards - 16 Jan 2005 03:43 GMT >> You would have been notified if YOUR account had been accessed by the >> hacker. [quoted text clipped - 4 lines] > being accessed, they have to inform to the general public of what was > happening so public can take an extra caution. As any system admin worth his salt knows, a server keeps logs of all database accesses. So yes, T-Mobile knows exactly which accounts were accessed.
 Signature John Richards
BruceR - 16 Jan 2005 04:22 GMT Trust me, she's no sysadmin! ;))
From:John Richards jr70@blackhole.invalid
>>> You would have been notified if YOUR account had been accessed by >>> the hacker. [quoted text clipped - 11 lines] > -- > John Richards Carl. - 14 Jan 2005 04:03 GMT > You might try getting your facts straight before you start running off > at the mouth. [quoted text clipped - 7 lines] > customers before the company took steps to stop the incursion, Dobrow > said. Oh, only 400 of them. How comforting it is to know that my SSN, which they shouldn't even keep on file, is so well protected.
J Figueredo - 13 Jan 2005 18:22 GMT T-Mobile's Web site states the following about information security
Is information secure?
--------------------------------------------------------------------------------
T-Mobile maintains physical, electronic, and procedural safeguards for information collected through the use of its Web site that meet with industry standards and any applicable federal regulations. For example, we use Secure Socket Layer (SSL) software, which encrypts information you input, to enable you to securely view your account information on our Web site. You should be aware that we have no control over the security of other sites on the Internet you visit, interact with, or from which you buy products or services.
For information on T-Mobile HotSpot Security, please refer to the relevant links on the T-Mobile HotSpot sites.
We limit access to personal information about you to those employees who need to know that information to provide products or services to you. An important part of protecting the security of personal information is your efforts to protect against unauthorized access to your wireless device, user name and password and to your computer. Also, be sure to sign off when finished using a shared computer and always log out of any site when viewing personal account information.
T-Mobile makes no representations or warranties about the security of its wireless Web access services or that your use will be error-free, uninterrupted, or free of infection by viruses or other malicious codes or acts of third parties beyond our control
> http://www.securityfocus.com/news/10271 littlejoeflub@yahoo.com - 13 Jan 2005 19:14 GMT > T-Mobile's Web site states the following about information security > > Is information secure? --------------------------------------------------------------------------------
> T-Mobile maintains physical, electronic, and procedural safeguards for > information collected through the use of its Web site that meet with [quoted text clipped - 3 lines] > site. You should be aware that we have no control over the security of other > sites on the Internet you visit, interact with, or from which you buy
> products or services. > [quoted text clipped - 15 lines] > > > http://www.securityfocus.com/news/10271 Heard about this on abc news on the radio last night. I've only been a wireless internet customer for about a week and right after I heard it I considered cancelling service. I was on the phone with Tier 3 customer service earlier today discussing a problem I've been having getting IE and Firefox to load google without having to use voicestreams proxy, which they say is no longer in service. While I had the guy on the phone I casually mentioned hearing the story and related a few details in the hopes he had a few I didn't know. All he was able to tell me was it was a guy who hacked into T-Mobile back in 2003 and was being investigated by the CIA and since then they've upgraded their system to prevent another incident. I think this guy was getting his info through the "telephone game" as the news story on ABC News didn't mention the CIA but the FBI investigator who was looking into the case.
J Figueredo - 13 Jan 2005 19:18 GMT I called corporate and they're in panic mode, the order is to keep their mouth shut, another great blunder from a corporate giant, I left a VM in Tim Wong's number, he called me a couple years ago regarding an issue with DNS on their mobile email service, but who knows now this HUGE......
Jose
>> T-Mobile's Web site states the following about information security >> [quoted text clipped - 58 lines] > ABC News didn't mention the CIA but the FBI investigator who was > looking into the case. Sarah Tanembaum - 15 Jan 2005 17:28 GMT > I called corporate and they're in panic mode, the order is to keep their > mouth shut, another great blunder from a corporate giant, I left a VM in Tim [quoted text clipped - 93 lines] >>ABC News didn't mention the CIA but the FBI investigator who was >>looking into the case. It seems that I made a big mistake by not cancelling my T-Mobile service before the trial period ends. I have a big problem with their practice of billing text messaging, now with their mickey-mouse security.
I'm sure that there are many smart engineers work there perhaps the management are the idiots. Why can't they spend a little effort in satisfying the customer and give text messaging service ability to enable/disable incoming text message, why collecting the profit(5cents per message). Now, their security. What a moron company!
Scott Stephenson - 15 Jan 2005 17:41 GMT > It seems that I made a big mistake by not cancelling my T-Mobile service > before the trial period ends. I have a big problem with their practice [quoted text clipped - 5 lines] > enable/disable incoming text message, why collecting the profit(5cents > per message). Now, their security. What a moron company! And far from the first company to have information compromised like this. Is it your contention that this is the first instance of this in Corporate America?
Jym L - 15 Jan 2005 19:56 GMT Yeah your problem is idiot itis... Becsue they didnt hold your little fat fingers and read every single word to you and have you sign ecah with an initial to make sure you were not the idiot you appear to be... They are being deceptive...
I guess if you bought a car and the salesperson didnt show you how to open your gas tank and read gas guage, then it is the dealers fault you run out of gas. And whell dang it, they owe you for inconvienence and towing..
Get a real life and talk about things you KNOW about...
> > I called corporate and they're in panic mode, the order is to keep their > > mouth shut, another great blunder from a corporate giant, I left a VM in Tim [quoted text clipped - 103 lines] > enable/disable incoming text message, why collecting the profit(5cents > per message). Now, their security. What a moron company! nobody - 15 Jan 2005 22:13 GMT > It seems that I made a big mistake by not cancelling my T-Mobile service > before the trial period ends. Maybe we can take up a collection and help you along
littlejoeflub@yahoo.com - 13 Jan 2005 20:04 GMT After reading the story on the link posted by the OP now I feel stupid. The guy at T-Mobile I was talking to "claimed" the hacker only had access to customer names, not all the other stuff mentioned in the article. Even though I have high doubts in how truthful that customer service rep was being with me it does make you wonder with all the "word of mouths" exactly what details are the truth and what are exagerated.
J Figueredo - 13 Jan 2005 20:38 GMT Securityfocus.com, it's a very credible source, that fact that T-Mobile sping doctors (my sister is in PR) are keeping their mouth shut makes me think that the issue is a lot bigger than what the article says.
Jose
> After reading the story on the link posted by the OP now I feel stupid. > The guy at T-Mobile I was talking to "claimed" the hacker only had [quoted text clipped - 3 lines] > "word of mouths" exactly what details are the truth and what are > exagerated. RWM - 13 Jan 2005 20:42 GMT Any sense if this was consumer data only, or included business customer data as well?
> Securityfocus.com, it's a very credible source, that fact that T-Mobile > sping doctors (my sister is in PR) are keeping their mouth shut makes me [quoted text clipped - 9 lines] >>"word of mouths" exactly what details are the truth and what are >>exagerated. Sarah Tanembaum - 15 Jan 2005 17:33 GMT > Any sense if this was consumer data only, or included business customer > data as well? [quoted text clipped - 13 lines] >>> "word of mouths" exactly what details are the truth and what are >>> exagerated. You will never know, won't you? I think the customers/public should demand full disclosure. I bet that 99.9999% they are concealing something important that might jeopardize customers data privacy.
They need to disclose of what was happened, and they also has to fully disclose what they are going to do to prevent that from happening again.
Scott Stephenson - 15 Jan 2005 17:43 GMT > You will never know, won't you? I think the customers/public should > demand full disclosure. I bet that 99.9999% they are concealing > something important that might jeopardize customers data privacy. Wow- that would make sense. Let's tell all of America exactly how the information was compromised. I'm sure the hackers of the world would ignore the information.
> They need to disclose of what was happened, and they also has to fully > disclose what they are going to do to prevent that from happening again. No they don't- I would never want them discussing anything about an account I held with them in public.
Jym L - 15 Jan 2005 19:58 GMT They did do full disclosure... They brought in Secret Service, they notifed all account holders who may have been accessed...
They had chanegs already to put in place, that were as soon as Secret Service completed investigation and gathering evidence...
But, as above, poor little kvetch Sarah can't read what has been reported...
> You will never know, won't you? I think the customers/public should > demand full disclosure. I bet that 99.9999% they are concealing > something important that might jeopardize customers data privacy. > > They need to disclose of what was happened, and they also has to fully > disclose what they are going to do to prevent that from happening again. Joseph - 13 Jan 2005 23:13 GMT >Securityfocus.com, it's a very credible source, that fact that T-Mobile >sping doctors (my sister is in PR) are keeping their mouth shut makes me >think that the issue is a lot bigger than what the article says. Jose what's a "sping" doctor?
- - - - - - - - - - - - - - - - - - - - - - - - - -
J Figueredo - 14 Jan 2005 00:55 GMT Typo, spin doctor.....and you must be another corporate a.shole like the many that work for this companies.
Get a life!
Jose
>>Securityfocus.com, it's a very credible source, that fact that T-Mobile >>sping doctors (my sister is in PR) are keeping their mouth shut makes me [quoted text clipped - 3 lines] > > - - - - - - - - - - - - - - - - - - - - - - - - - - Joseph - 14 Jan 2005 13:36 GMT >Typo, spin doctor.....and you must be another corporate a.shole like the >many that work for this companies. > >Get a life! Ah I see. You don't have anything genuine so you think it's just easier to ASSume that I work for the company. Do you use this line of reasoning in your work? You must work for the city sanitation office, eh?
And by the way thanks for playing Jeopardy!
>Jose > [quoted text clipped - 5 lines] >> >> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
BruceR - 14 Jan 2005 19:56 GMT And pointing out his obvious typo falls under your definition of "anything genuine?"
From:Joseph JoeOfSeattle@yahoo.com
>> Typo, spin doctor.....and you must be another corporate a.shole like >> the many that work for this companies. [quoted text clipped - 20 lines] > > - - - - - - - - - - - - - - - - - - - - - - - - - - Sarah Tanembaum - 15 Jan 2005 17:34 GMT > Typo, spin doctor.....and you must be another corporate a.shole like the > many that work for this companies. [quoted text clipped - 10 lines] >> >>- - - - - - - - - - - - - - - - - - - - - - - - - - Swear the management under oath! Make sure they are liable for their action if they lied!
Scott Stephenson - 15 Jan 2005 17:43 GMT > Swear the management under oath! Make sure they are liable for their > action if they lied! Damn- you are a whiney moron- clueless, too.
BruceR - 14 Jan 2005 02:21 GMT Couldn't make the leap to figure out he made a typo and it should be "spin" huh?
From:Joseph JoeOfSeattle@yahoo.com
>> Securityfocus.com, it's a very credible source, that fact that >> T-Mobile sping doctors (my sister is in PR) are keeping their mouth [quoted text clipped - 4 lines] > > - - - - - - - - - - - - - - - - - - - - - - - - - - Jym L - 13 Jan 2005 23:48 GMT Tmobile is not keeping its mouth shut... Call Customer Service and ask them about this...
> Securityfocus.com, it's a very credible source, that fact that T-Mobile > sping doctors (my sister is in PR) are keeping their mouth shut makes me [quoted text clipped - 9 lines] > > "word of mouths" exactly what details are the truth and what are > > exagerated. BruceR - 14 Jan 2005 02:24 GMT Under California Law, T-Mobile has an affirmative duty to contact all of its California customers and advise them of the possibility of identity theft. It will be interesting to see if the CA Attorney General goes after them for not having done that.
From:Jym L ff1089@hotmail.com
> Tmobile is not keeping its mouth shut... Call Customer Service and > ask them about this... [quoted text clipped - 13 lines] >>> you wonder with all the "word of mouths" exactly what details are >>> the truth and what are exagerated. danny burstein - 14 Jan 2005 02:28 GMT >Under California Law, T-Mobile has an affirmative duty to contact all of >its California customers and advise them of the possibility of identity >theft. It will be interesting to see if the CA Attorney General goes >after them for not having done that. It's barely possible that t-mobile can claim federal preemption over this sort of stuff, just like they can often do when they prefer FCC regulations over local folk.
(Emphasize here that it ain't just t-mobile that shops for jurisdiction).
I'm sure the lawyers at both t-mobile and the Calif AG are cracking about the lawbooks. T-mobile, of course, doesn't want to get cited. The Cal AG doesn't want to lose the case...
 Signature _____________________________________________________ Knowledge may be power, but communications is the key dannyb@panix.com [to foil spammers, my address has been double rot-13 encoded]
Jym L - 14 Jan 2005 03:41 GMT > >Under California Law, T-Mobile has an affirmative duty to contact all of > >its California customers and advise them of the possibility of identity [quoted text clipped - 16 lines] > dannyb@panix.com > [to foil spammers, my address has been double rot-13 encoded] Jym L - 14 Jan 2005 03:46 GMT As in the text messaging thread, you obviously read only what you wish to read, adn are back to trolling and ketching...
TMobile annouced all accounts that were indicated to have possibly been accessed were notified by mail in advance of the public release of the indictments...
And before it goes off on the other tangent, less then 400 accounts out of 15.6 active accounts (plus how ever many supended, canceled, written off, ported out, etc accounts) is an extremely minute amount ... If he had as broad an access as folks are making this out to be (without READING the offical reports) he shoudl have been able to access all 15.6 million +... But no, he accessed approx 1/40,000 of the accounts at most...
> >Under California Law, T-Mobile has an affirmative duty to contact all of > >its California customers and advise them of the possibility of identity [quoted text clipped - 16 lines] > dannyb@panix.com > [to foil spammers, my address has been double rot-13 encoded] danny burstein - 14 Jan 2005 03:54 GMT >As in the text messaging thread, you obviously read only what you wish to >read, adn are back to trolling and ketching... You really have no clue, do you. Well, it's been fun watching you make a fool of yourself, but I'm going to move back in with the adults now. Bye.
 Signature _____________________________________________________ Knowledge may be power, but communications is the key dannyb@panix.com [to foil spammers, my address has been double rot-13 encoded]
Jym L - 14 Jan 2005 03:55 GMT No, Im th eone who read the posts, as well as read reputable news sources, not just rumor mills...
Have fun in the padded room...
> >As in the text messaging thread, you obviously read only what you wish to > >read, adn are back to trolling and ketching... [quoted text clipped - 7 lines] > dannyb@panix.com > [to foil spammers, my address has been double rot-13 encoded] Carl. - 14 Jan 2005 04:12 GMT > As in the text messaging thread, you obviously read only what you wish to > read, adn are back to trolling and ketching... > > TMobile annouced all accounts that were indicated to have possibly been > accessed were notified by mail in advance of the public release of the > indictments... Great if you trust them to be right about that.
> And before it goes off on the other tangent, less then 400 accounts out of > 15.6 active accounts (plus how ever many supended, canceled, written off, > ported out, etc accounts) is an extremely minute amount ... If he had as > broad an access as folks are making this out to be (without READING the > offical reports) he shoudl have been able to access all 15.6 million +... > But no, he accessed approx 1/40,000 of the accounts at most... OK, good point.
Jym L - 14 Jan 2005 04:19 GMT Considering the accounts that were accessed were documented by the US Secret Service, NOT T-Mobile alone...
> > As in the text messaging thread, you obviously read only what you wish to > > read, adn are back to trolling and ketching... [quoted text clipped - 13 lines] > > OK, good point. Sarah Tanembaum - 15 Jan 2005 17:38 GMT > As in the text messaging thread, you obviously read only what you wish to > read, adn are back to trolling and ketching... [quoted text clipped - 34 lines] >> dannyb@panix.com >>[to foil spammers, my address has been double rot-13 encoded] Can they tell their customers with straight face and perhaps under oath, that only those 400 account got hacked? If not, they have to tell ALL their customers of this problem.
Jym L - 14 Jan 2005 03:41 GMT READ THE POSTINGS
TMobile Corporate anouncement stated that all accounts that were indicated to have been accessed were notifed in writing before the indictment was unsealed and annouced... Whether they were in California or not...
> Under California Law, T-Mobile has an affirmative duty to contact all of > its California customers and advise them of the possibility of identity [quoted text clipped - 21 lines] > >>> you wonder with all the "word of mouths" exactly what details are > >>> the truth and what are exagerated. danny burstein - 14 Jan 2005 03:50 GMT >READ THE POSTINGS
>TMobile Corporate anouncement stated that all accounts that were indicated >to have been accessed were notifed in writing before the indictment was >unsealed and annouced... Whether they were in California or not... And next you'll tell us who really killed JFK.
 Signature _____________________________________________________ Knowledge may be power, but communications is the key dannyb@panix.com [to foil spammers, my address has been double rot-13 encoded]
Jym L - 14 Jan 2005 03:52 GMT Im not the one that sees conspriacies under every rock, that every corporation is out ot rip off an violate every single individual...
> >READ THE POSTINGS > [quoted text clipped - 9 lines] > dannyb@panix.com > [to foil spammers, my address has been double rot-13 encoded] ^'^BatAttaK^'^ - 15 Jan 2005 02:08 GMT >Under California Law, T-Mobile has an affirmative duty to contact all of >its California customers and advise them of the possibility of identity >theft. It will be interesting to see if the CA Attorney General goes >after them for not having done that. From here http://www.securityfocus.com/news/10271
"T-Mobile, which apparently knew of the intrusions by July of last year, has not issued any public warning. Under California's anti-identity theft law "SB1386," the company is obliged to notify any California customers of a security breach in which their personally identifiable information is "reasonably believed to have been" compromised. That notification must be made in "the most expedient time possible and without unreasonable delay," but may be postponed if a law enforcement agency determines that the disclosure would compromise an investigation."
*******************
www.batattak-records.com
Jym L - 15 Jan 2005 04:26 GMT And the offical statements have stated, T-Mobile did exactly that for ANY customer, not just Claifornia customers (if any) AFTER receiving clearance from teh Secret Service which was the government agency in charge of the investigation...
> >Under California Law, T-Mobile has an affirmative duty to contact all of > >its California customers and advise them of the possibility of identity [quoted text clipped - 16 lines] > > www.batattak-records.com J Haggerty - 15 Jan 2005 04:58 GMT > From here http://www.securityfocus.com/news/10271 > > "T-Mobile, which apparently knew of the intrusions by July of last > year, has not issued any public warning. Why would they need to issue a public warning? They notified those that were likely to have been affected, which is all the following statement requires.
> Under California's > anti-identity theft law "SB1386," the company is obliged to notify any [quoted text clipped - 8 lines] > > www.batattak-records.com Sarah Tanembaum - 15 Jan 2005 17:41 GMT >> From here http://www.securityfocus.com/news/10271 >> [quoted text clipped - 17 lines] >> >> www.batattak-records.com
> Why would they need to issue a public warning? They notified those that > were likely to have been affected, which is all the following statement > requires. Again, can they be sure that ONLY those people are affected? If not, it is their responsibility to warn others of this incident and perhaps some way of preventions.
Sarah Tanembaum - 15 Jan 2005 17:36 GMT > Under California Law, T-Mobile has an affirmative duty to contact all of > its California customers and advise them of the possibility of identity [quoted text clipped - 21 lines] >>>>you wonder with all the "word of mouths" exactly what details are >>>>the truth and what are exagerated. I have not heard anything from them yet! I doubt I'll hear anything in the near term.
Carl. - 14 Jan 2005 04:09 GMT > Tmobile is not keeping its mouth shut... Call Customer Service and ask > them > about this... Call customer service? You mean the same people that don't give out the same answer for simple questions? Yes, a very reliable way of getting information. And how were customers supposed to know if they don't read security news all day?
Sarah Tanembaum - 15 Jan 2005 17:42 GMT >>Tmobile is not keeping its mouth shut... Call Customer Service and ask >>them [quoted text clipped - 4 lines] > information. And how were customers supposed to know if they don't read > security news all day? Well, when lying, no one can give the same answer for the same question.
Sarah Tanembaum - 15 Jan 2005 17:31 GMT > Securityfocus.com, it's a very credible source, that fact that T-Mobile > sping doctors (my sister is in PR) are keeping their mouth shut makes me [quoted text clipped - 9 lines] >>"word of mouths" exactly what details are the truth and what are >>exagerated. Perhaps if anyone can find out if they are hiding something. This is a criminal action since it will affect their customer privacy. This is scary!
Scott Stephenson - 15 Jan 2005 17:44 GMT > Perhaps if anyone can find out if they are hiding something. This is a > criminal action since it will affect their customer privacy. This is scary! And it happens all the time with other companies. Quit trying to portray this as the first instance of database compromise in the history of the world.
Sarah Tanembaum - 15 Jan 2005 17:52 GMT >>Perhaps if anyone can find out if they are hiding something. This is a >>criminal action since it will affect their customer privacy. This is [quoted text clipped - 4 lines] > this as the first instance of database compromise in the history of the > world. Does this make it okay for T-Mobile to conceal the magnitude of this problems? You are like a child saying ... "..he/she did it too..."
DOn't be a child, be responsible!
Scott Stephenson - 15 Jan 2005 18:26 GMT > >>Perhaps if anyone can find out if they are hiding something. This is a > >>criminal action since it will affect their customer privacy. This is [quoted text clipped - 7 lines] > Does this make it okay for T-Mobile to conceal the magnitude of this > problems? You are like a child saying ... "..he/she did it too..." You have no evidence that anything was concealed. T-Mo came out with a statement that the database had been compromised, about 400 accounts had been affected and those customers had been contacted. What has been concealed? All you are doing is fabricating some conspiracy theory and acting like it has a direct impact on you. My statement that it happens all of the time was to point out that any company that has your information is just as capable of losing it.
> DOn't be a child, be responsible! Don't be paranoid, be responsible.
steve - 13 Jan 2005 23:17 GMT > > T-Mobile's Web site states the following about information security [...]
> > > http://www.securityfocus.com/news/10271 > [quoted text clipped - 12 lines] > ABC News didn't mention the CIA but the FBI investigator who was > looking into the case. Amazing how the story gets changed depending on who's telling it. It's the Secret Service, not the FBI or CIA.
Here is a link to news stories containing facts.
http://news.google.com/news?hl=en&q=t-mobile
s
J Figueredo - 14 Jan 2005 00:59 GMT The fact is that he was able to enter the network at will and we would never know the facts, T-Mobile deceived all of its customers by not alerting them right away, time to look at other carrier.
CS was clueless they were told to read a script, I have it on tape.
Jose
>> > T-Mobile's Web site states the following about information security > [...] [quoted text clipped - 24 lines] > > s Joseph - 14 Jan 2005 13:38 GMT >The fact is that he was able to enter the network at will and we would never >know the facts, T-Mobile deceived all of its customers by not alerting them >right away, time to look at other carrier. > >CS was clueless they were told to read a script, I have it on tape. Josey why don't you do the right thing and find a secure network and then bring suit against T-Mobile or are you just all talk and hot air?
>Jose > [quoted text clipped - 26 lines] >> >> s - - - - - - - - - - - - - - - - - - - - - - - - - -
Sarah Tanembaum - 15 Jan 2005 17:44 GMT > The fact is that he was able to enter the network at will and we would never > know the facts, T-Mobile deceived all of its customers by not alerting them [quoted text clipped - 33 lines] >> >>s Right-o! How can we make a case so the customers don't get penalize for early termination? Anyway, their service sucks! I hardly get any signal from my own home and many areas where I stay.
JohnF - 13 Jan 2005 23:59 GMT Why would the CIA be involved? They're not an investigative entity and are not legally allowed to operate with the United States. Their charter is to gather intelligence outside of the U.S. not to solve crimes. That should tell you the guy is clueless.
> > > http://www.securityfocus.com/news/10271 > [quoted text clipped - 12 lines] > ABC News didn't mention the CIA but the FBI investigator who was > looking into the case. Sarah Tanembaum - 15 Jan 2005 17:20 GMT > T-Mobile makes no representations or warranties about the security > of its wireless Web access services or that your use will be > error-free, uninterrupted, or free of infection by viruses or other > malicious codes or acts of third parties beyond our control It is precisely of the above reason - they can't be sure of the incident, therefore, it is absolutely important to notify all their customer about the incident.
> T-Mobile's Web site states the following about information security > [quoted text clipped - 28 lines] > >>http://www.securityfocus.com/news/10271 Scott Stephenson - 15 Jan 2005 17:45 GMT > > T-Mobile makes no representations or warranties about the security > > of its wireless Web access services or that your use will be [quoted text clipped - 4 lines] > incident, therefore, it is absolutely important to notify all their > customer about the incident. Yeah- you've shown that your own level of non-expertise would allow you to prevent it in the future.
Sarah Tanembaum - 15 Jan 2005 17:51 GMT >>>T-Mobile makes no representations or warranties about the security >> [quoted text clipped - 8 lines] > Yeah- you've shown that your own level of non-expertise would allow you to > prevent it in the future. I'm sorry about my lack of expertise in this area, but I know for sure that if there are problem, T-Mobile should give full disclosure of that issues and perhaps warn the public of how deal with it if it hit them.
Stefan - 25 Jan 2005 04:13 GMT Re: Looks like Jym L gets his paycheck from T-Mo
>>>> T-Mobile makes no representations or warranties about the security >>> [quoted text clipped - 13 lines] > that if there are problem, T-Mobile should give full disclosure of that > issues and perhaps warn the public of how deal with it if it hit them.
|
|
|