For any of you using burner phones (or worse, working who use this as work phone)
Did not see any comments or posts yet on this forum about Freedom getting breached and customer lists and info getting released
A message to Freedom Mobile Customers.
After speaking back and forth with the Chief Privacy Officer at Shaw Inc(Owns Freedom Mobile). I have been informed that all your data is held with Freedom using security that rivals that of banks.
Here is a screenshot of the effectiveness of this security: https://imgur.com/VFgYcCi
Please do not fear, I do not access your accounts for any reason. Some people however would steal your information.
I have currently identified over 1000 at-risk-accounts on Freedom Mobile's MyAccount page.
If this upsets you, be sure to send an email to privacyofficer@freedommobile.ca
You may also lodge a complaint for "Failure to safeguard my personal information" at https://www.priv.gc.ca/en/report-a-...-complaint/file-a-complaint-about-a-business/
Freedom Representatives may reach me at NullHumanity@gmail.com
From user on Reddit: https://www.reddit.com/user/NullHumanity
Reddit Thread: https://www.reddit.com/r/freedommobile/comments/7wyedg/security_breach/
Update: https://mobilesyrup.com/2018/02/12/freedom-mobile-security-breach/ has been posted there as well now.
some more comments from the person that found this
" Great article Rose and thank you for bringing attention where it is needed.I'm quite concerned by the response of Chethan Lakshman.
There is evidence to suggest that other people have been attacking this lax security for quite some time. Since they are not posting publicly I am guessing they are stealing the information.
And the official response is that the customer is to blame?
"We continue to strongly encourage our customers to use unique PIN numbers that are not easy to guess, and to change their PINs frequently to best protect their personal account information.”
I've spoken just now to 6 people who have been in your stores since WIND was on the sign. Not a single one of them can recall even one instance of being advised the importance of a "unique PIN." You say this is strongly encouraged...
There is no such thing as a unique PIN number when you have approximately 1.2million subscribers and exactly 10,000 possible pins. Even if everyone was evenly distributed among the pins, you would actually have more of a problem...
Changing your PIN frequently is NOT good security. It's actually the opposite. This is a common fallacy. "
" I fully understand where you're coming from. I don't think a security professional is even required here.
I'd say I spent a total of a full days work trying to communicate the issue in terms understandable to anyone. When I spoke with my mother for example, she immediately understood the problem.
I also wrote to CBC on the issue.
There is also the fact that this is a very high risk issue which modifies responsible disclosure considerably. The amount of information available at the rate in which it can be obtained could easily result in millions of dollars of exposure in hours.
Basically I wasn't taken seriously by policy. A policy to save money. "
Did not see any comments or posts yet on this forum about Freedom getting breached and customer lists and info getting released
A message to Freedom Mobile Customers.
After speaking back and forth with the Chief Privacy Officer at Shaw Inc(Owns Freedom Mobile). I have been informed that all your data is held with Freedom using security that rivals that of banks.
Here is a screenshot of the effectiveness of this security: https://imgur.com/VFgYcCi
Please do not fear, I do not access your accounts for any reason. Some people however would steal your information.
I have currently identified over 1000 at-risk-accounts on Freedom Mobile's MyAccount page.
If this upsets you, be sure to send an email to privacyofficer@freedommobile.ca
You may also lodge a complaint for "Failure to safeguard my personal information" at https://www.priv.gc.ca/en/report-a-...-complaint/file-a-complaint-about-a-business/
Freedom Representatives may reach me at NullHumanity@gmail.com
From user on Reddit: https://www.reddit.com/user/NullHumanity
Reddit Thread: https://www.reddit.com/r/freedommobile/comments/7wyedg/security_breach/
Update: https://mobilesyrup.com/2018/02/12/freedom-mobile-security-breach/ has been posted there as well now.
some more comments from the person that found this
" Great article Rose and thank you for bringing attention where it is needed.I'm quite concerned by the response of Chethan Lakshman.
There is evidence to suggest that other people have been attacking this lax security for quite some time. Since they are not posting publicly I am guessing they are stealing the information.
And the official response is that the customer is to blame?
"We continue to strongly encourage our customers to use unique PIN numbers that are not easy to guess, and to change their PINs frequently to best protect their personal account information.”
I've spoken just now to 6 people who have been in your stores since WIND was on the sign. Not a single one of them can recall even one instance of being advised the importance of a "unique PIN." You say this is strongly encouraged...
There is no such thing as a unique PIN number when you have approximately 1.2million subscribers and exactly 10,000 possible pins. Even if everyone was evenly distributed among the pins, you would actually have more of a problem...
Changing your PIN frequently is NOT good security. It's actually the opposite. This is a common fallacy. "
" I fully understand where you're coming from. I don't think a security professional is even required here.
I'd say I spent a total of a full days work trying to communicate the issue in terms understandable to anyone. When I spoke with my mother for example, she immediately understood the problem.
I also wrote to CBC on the issue.
There is also the fact that this is a very high risk issue which modifies responsible disclosure considerably. The amount of information available at the rate in which it can be obtained could easily result in millions of dollars of exposure in hours.
Basically I wasn't taken seriously by policy. A policy to save money. "
