Fixing Flaws: The Art of Bug Fixing in the Business World. Issue 3

In the ever-evolving landscape of technology, the challenges businesses face in safeguarding their systems and ensuring a smooth user experience are more significant than ever.

At Fixing Flaws, we explore real-world stories that shed light on the multifaceted nature of these challenges, from Apple's race against exploits in the world of mobile devices to T-Mobile's unexpected privacy breach and the recent data compromise involving Johnson & Johnson Health Care Systems.?

Join us as we navigate the art of bug fixing in the business world, exploring the methods, consequences, and lessons learned from these high-profile cases.

New Zero-Day Exploits are Fixed in Apple Emergency Updates

Apple has released its emergency security updates to address three new zero-day vulnerabilities exploited in attacks targeting iPhone and Mac users. These vulnerabilities bring the total number of zero-days fixed by Apple this year to 16.

The system issues allowed attackers to bypass signature validation using malicious apps or execute arbitrary code through fraudulently crafted web pages.

Apple representatives say the company is aware of reports suggesting that these vulnerabilities may have been actively exploited against versions of iOS prior to iOS 16.7. However, it does not provide specific details about how these vulnerabilities were exploited in the wild.

Security researchers from Citizen Lab and Google Threat Analysis Group have previously disclosed zero-day vulnerabilities used in targeted spyware attacks against high-risk individuals, including journalists, opposition politicians, and dissidents. This suggests the significance of the security updates and the potential implications for user privacy and security.

Users Were Able to See Other People's Account Information via a T-Mobile App Glitch

Recently, T-Mobile customers reported being able to access other people's accounts and billing information when using the company's official mobile application.?

The exposed information included sensitive details such as customers' names, phone numbers, addresses, account balances, and credit card information.

T-Mobile has stated that this incident was not the result of a cyberattack, and their systems were not breached. They have clarified that it was a temporary system glitch related to a planned overnight technology update.

According to T-Mobile, this glitch affected a limited number of accounts, specifically fewer than 100 customers. The company claims to have promptly resolved the issue.

TransUnion denies Being Hacked

TransUnion denied claims of a security breach after a threat actor known as USDoD leaked data that they allege was stolen from TransUnion's network.?

TransUnion has over 10,000 employees who provide services to millions of consumers and over 65,000 businesses in 30 countries.

The company’s representatives responded to these claims by stating that upon discovering them, they initiated a thorough investigation in partnership with external cybersecurity and forensic experts. As a result of their investigation, both internal and external experts found no indication that TransUnion's systems had been breached or that data had been taken from their environment.

USDoD claims that a database allegedly stolen from TransUnion's systems contained sensitive information from approximately 59,000 individuals worldwide. However, TransUnion maintains that this data was not taken from their own systems, and their investigation suggests that the information came from elsewhere.

Johnson & Johnson Discloses IBM Data Breach Impacting Patients

The breach occurred through a third-party service provider, IBM, which manages the CarePath application and database for Janssen, a Johnson & Johnson subsidiary. The CarePath app is designed to assist patients in accessing Janssen medications, providing discounts and cost-saving information on eligible prescriptions, offering guidance on insurance coverage, and providing drug-related alerts.

Janssen became aware of a security vulnerability in the CarePath database that could potentially allow unauthorized users to access sensitive information. They reported this issue to IBM, who promptly addressed the security gap and initiated an internal investigation to determine whether any unauthorized access had occurred.

Given the value of medical data, healthcare software testing becomes incredibly important. Companies should always remember about the risks connected with such breaches as patient information may be sold for a premium on darknet markets, making it a particularly concerning incident for the affected individuals.

Summing up

As almost everything in this world, relies on software, it becomes crucial to test programs thoroughly and make sure they're safe for users, meet regulations, and provide excellent user experience.

Making QA an integral part of SDLS helps create software products that are safe and work well. This builds trust among businesses and users.

Feel free to reach out to us to find out more about our testing methods for software and how we can customize them to your business goals.