Identifying a security risk for a retired Executive Assistant Director of the FBI

Reported to FBI: Stationary profile of Michael Mason is viewable by public URL
Reported to Verizon

What do Verizon, The FBI And Fitness Bikes have in common?

The answer should be nothing.

Meet Michael Mason. A retired Executive Assistant Director of the FBI, He was hired by Verizon and was named one of The Most Influential People in Security 2014 by securitymagazine.com

He also spends time exercising at the Verizon fitness center

And considering his branch was responsible for computer-based criminal threats against the U.S I though it might be worthwhile tipping him off that The exercise bike you use creates a URL anyone in the world can click on.

Here it is at the URL of https://expresso.com/Profile/Rider/30215931

Espresso is a bike company. Specifically a stationary bike with a monitor where poeple run their own ‘’Challenges’’ And from this URL I can not only see the exact location of the (stationary) bike but also that Michael has completed the hard to achieve ‘ Savage Revenge’’ Challenge.

Good going, but not something the world needs to be able to view!

How did this happen?

Looks like this started around 2009 when

Interactive Fitness Holdings acquires Expresso Fitness' assets and intellectual property » RE

go to http://www.ifholdings.com/

and you can watch a interactive video of a bike moving around.

it’s a awesome idea and clearly works in regard to gaining.. gains.
And one of the things they advertise a little bit less is that every user gets a profile.

A Public profile by default with details on what challenges they have run, how far they bike and where the bike is.

but the user profile permissions should not be set to default,

and people should not be able to click the map and see where someone is stationary.

So who’s effected?

Anyone who signed up to create a profile on these bikes.

Pictured: Search Team for ‘’Google’’ then choose B46 and click ‘’Challenges’’ No recent activity but there are some results in 2014

Here’s a search for ‘’bob’’

Just go to https://expresso.com/Home

and click the handy dandy search options.

Presto! First name, Last name, Location and Age range. Along with biking metadata.

 

 

Reported to Verizon Jun 1, 2019 via the Cyber Security Incident Response Team Services.
The person I spoke with was quite excited to receive the call and promised it would be handled.
I do wonder if he reported it as his own discovery- but in the end it doesn't matter.
Today the URL is private.