Misconfigured LifeLock Database May Lead To Targeted Phishing

Some days you win and some days you lose. One particular day this July, the identity theft protection company, LifeLock lost…big. A researcher found that a misconfigured server of one of Lifelocks business partners allowed him to download email addresses of LifeLock customers. He only accessed a small number of them, but that was enough for him and others to realize that this server was a problem. If a cybercriminal found the same issue, the entire customer base of LifeLock is at risk of receiving targeted phishing emails.

As reported by Brian Krebs and Krebs on Security, the researcher received an email to an address he’d used when he was a LifeLock member. When he clicked the “unsubscribe” link in the email, it took him to a page with a peculiar URL. That email very well could have been a phishing email in another scenario and he wouldn’t even have had a second thought about clicking it. That’s the real danger of this situation.

In that URL was his specific customer ID number. With a little bit of poking around, he found that those numbers are sequential, and he was able to pull the email addresses that were linked to those ID numbers. After retrieving 70 of them, he stopped and reported it to Krebs.

LifeLock followed up on the discovery and has confirmed that other than the 70 emails initially pulled by for the test, there was no other suspicious activity and they believe no data was actually stolen.  That said, subscribers, current and former should be on alert for phishing email messages that may attempt to trick them into clicking links or attachments. With just the two pieces of information retrieved in this—email addresses and the fact they are LifeLock subscribers-- a scammer can do a lot of damage. Instead of clicking on any links, especially those that are asking for sensitive information, go directly into your account using a trusted link. There are typically unsubscribing options in there as well as ways to modify other account details. There’s no need to click a link from an email or text message to do this.

Symantec immediately took the page down when Krebs contacted them. He was subsequently told that the issue was due to a third-party marketing company that managed the page that was misconfigured. That may be true, but it was obviously not handled with care. Third parties can be great partners, but present new risks to their customers which can often be missed.  While Lifelock did not manage or control the servers that were at risk, it is still their customers that were affected and ultimately it is Lifelock who is dealing with the PR mess.  This is why it is so important for organizations to remember that when providing customer data to third party providers, that data may be put at risk in new ways.  While it is highly unlikely that your organization can preform exhaustive security audits on every third party provider, at a minimum, you should be asking for audit reports and other security documentation that shows that the websites and servers used to host your data have been properly tested and secured. This is true no matter what the business does. Ultimately Lifelock may not be technically responsible for this breach, but the fallout and embarrassment will still land on their shoulders. All that said, business owners and managers…don’t let it happen to you.