LifeLock Bug Exposed Millions of Customer Email Addresses

Krebs on Security ^ | July 25, 2018 | Brian Krebs

[snarkpup]

Identity theft protection firm LifeLock — a company that’s built a name for itself based on the promise of helping consumers protect their identities online — may have actually exposed customers to additional attacks from ID thieves and phishers. The company just fixed a vulnerability on its site that allowed anyone with a Web browser to index email addresses associated with millions of customer accounts, or to unsubscribe users from all communications from the company.

The upshot of this weakness is that cyber criminals could harvest the data and use it in targeted phishing campaigns that spoof LifeLock’s brand. Of course, phishers could spam the entire world looking for LifeLock customers without the aid of this flaw, but nevertheless the design of the company’s site suggests that whoever put it together lacked a basic understanding of Web site authentication and security.

...

“If I were a bad guy, I would definitely target your customers with a phishing attack because I know two things about them,” Reese said. “That they’re a LifeLock customer and that I have those customers’ email addresses. That’s a pretty sharp spear for my spear phishing right there. Plus, I definitely think the target market of LifeLock is someone who is easily spooked by the specter of cybercrime.”

[mcatch22]

do an online line search for racing gas can.

I use the VP Racing Fuels 5 gallon cans. Can dump 5 gallons in under two minutes without spilling a drop.

well worth the money

[publius911]

I dropped them months ago.

I could never buy into their smug oversold commercials.

One less potential trap for the gullible...

[klimeckg]

Its a smart service to sell but a bit overpriced. I canceled mine years ago and shop smart and use some common sense. But there are times things happen.