- Security researcher finds error in an API used in a verizon -mobilapp
- The Bug enabled threat actors to see other people’s call logs
- It was found in February 2025 and fixed in March, but users still had to fit
A mistake in a Verizon API allowed malicious actors to see other people’s incoming call logs until it was resolved.
CyberSecurity -Scientist Evan Connelly found the error in call filter, a free app Verizon delivers with all iOS and Android devices sold directly via Telco to help users block spam calls, identify unknown numbers and avoid Robocalls.
Given Verizon’s major subscriber base, the app probably has millions of users as it offers features such as spam detection, call ID, personal block lists and automatic blocking of high risk calls. Ring Filter also has a Premium version that adds spam lookups, custom checks and callers -id for unknown numbers.
Targeting journalists
As Connelly explained, the app creates connection to an API endpoint where it retrieves the logged user’s incoming call history and then shows it in the app. However, due to an incorrect configuration in the API, the user’s phone number is not verified, which means that any user can request the data for anyone else.
Connelly tested the iOS version but claims that the problem is platform-embroidery as the error is resident of API instead of the app itself.
Seeing a person’s call log may not look much at first, but Connelly warns that it could be a “powerful surveillance tool”, especially against high profiled goals such as journalists, government opponents, dissidents and the like.
“Ring metadata may seem harmless, but in the wrong hands it becomes a powerful monitoring tool. With unlimited access to another user’s call story, an attacker could reconstruct daily routines, identify frequent contacts and derive personal relationships,” Connelly said.
Verizon turned to the error sometime in March 2025, but we do not know how long this information was exposed, so users still had to take extra care.
Via Bleeping computer
