Credit bureau Experian just fixed a weakness with a partner website that let anyone look up the credit score of tens of millions of Americans just by supplying their name and mailing address, KrebsOnSecurity learned. Though the flaw has been fixed according to Experian, the researcher, Bill Demirkapi, who reported the finding says he fears the same weakness may affect other lending websites that work with the credit bureau.

360 Mobile Vision - 360mobilevision.com North & South Carolina Security products and Systems Installations for Commercial and Residential - $55 Hourly Rate. ACCESS CONTROL, INTRUSION ALARM, ACCESS CONTROLLED GATES, INTERCOMS AND CCTV INSTALL OR REPAIR 360 Mobile Vision - 360mobilevision.com is committed to excellence in every aspect of our business. We uphold a standard of integrity bound by fairness, honesty and personal responsibility. Our distinction is the quality of service we bring to our customers. Accurate knowledge of our trade combined with ability is what makes us true professionals. Above all, we are watchful of our customers interests, and make their concerns the basis of our business.

Demirkapi found he could access the Experian API directly and without any sort of authentication. He also noted that by entering all zeros in the “date of birth” field, he could pull a person’s credit score.

“No one should be able to perform an Experian credit check with only publicly available information,” he said. “Experian should mandate non-public information for promotional inquiries, otherwise an attacker who found a single vulnerability in a vendor could easily abuse Experian’s system.”

The post Student researcher discovered Experian API flaw that exposed credit scores of “most Americans” appeared first on IT Security Guru.

By admin