Mobile Giants: Please Don’t Share the Where
Summary: AT&T, Sprint, T-Mobile and Verizon are selling real-time customer location data to third-party companies without consent or a court order, and T-Mobile was the only carrier that admitted providing Securus and LocationSmart with real-time lookup capability. KrebsOnSecurity reported that a LocationSmart demo allowed anyone to track virtually any U.S. mobile phone without authentication, that Securus was hacked and its database of law enforcement usernames and passwords stolen, and that someone at Securus had uploaded internal files to Virustotal for two years.
Why it matters: The same real-time lookup capability sold to police can be turned on officers, informants, jurors, witnesses and judges by anyone who knows a cell phone number, and Securus's own portal reportedly reset passwords through three security questions with no limit on attempts.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026