Yikes. Seems like a pretty massive oversight by Verizon. I wish in situations like this there was some responsibility of the company at fault to provide information about if anyone else had used and abused this vector before it was responsibly disclosed.
Have you ever seen a more internal-looking domain name?
Cequint is a company that provides caller ID services. "Vz" is short for Verizon. "Cid" is short for caller ID. That only leaves "we", which probably refers to either "wireless" or "web" in some way, e.g. wireless/web "edge" or "endpoint".
The domain is therefore the Cequint Verizon Wireless (Web?) Edge Caller ID endpoint.
I don't know what clr or aqx are, though. (I assume CLR is not Microsoft's Common Language Runtime, but I suppose it could be. I know at least one company that likes to name services after the technology used to implement them.)
(Note that "ignorance" is not pejorative here: not everyone can know everything.)
...I gotta go take a walk near some nature and flowers, because i just depressed myself with my comment. :-(
* Several Consumer Protection Safety Board lawsuits were withdrawn in February: https://apnews.com/article/cfpb-drops-capital-one-rocket-law...
* New York Mayor Eric Adams's corruption case was dismissed in an apparent quid-pro-quo. White House official Thomas Howan asserted that he had an agreement with Adams on the morning news show Fox and Friends. Evidence indicated Adams accepted a hundred thousand dollars in benefits and bribes in exchange for helping the Turkish government certify a building permit. https://www.nbcnews.com/politics/justice-department/trumps-b...
[0] https://www.whitehouse.gov/presidential-actions/2025/01/unle...
Who is charge of security over there?
There need to be some answers, this is such an obvious and easily exploited security hole we need to ask what else is leaking from them?
Good that they fixed it quickly.
While you're waiting a few days for steve to get back from vacation and approve the PO for a pentesting contract, everyone else in the world is already pentesting your systems anyways.
Doesn't look like Verizon has bug bounties, so I guess we're lucky that the person who found this one was willing to work for free.
This data has likely proliferated widely throughout the company, subsidiaries and contractors, to reside on an unknowable number of systems. I would assume call record metadata is fully compromised at this point.
That’s not to take away from the finding in the blog – I’m merely commenting on the question in its conclusion, about the implications of a barely know technology vendor controlling the vulnerable server holding this data.
Normally those companies need an intervention from an authority to do something about it though.
Source: Personal experience.
> There are millions of apps across both stores. Perhaps find a way to introspect all of them?
I would be surprised if this method wasn't also being employed, if not by individual hackers, then in the form of growth hacking by companies who sell a means of fixing it.
Still seems like something fun to try.
Of course, the answer is that the corporations own both Congress and the media.