Fandango Media LLC

Agency: Federal Trade Commission (FTC)Washington
Description:

On August 13, 2014, the Federal Trade Commission ("FTC") filed a Decision and Order with Fandango settling charges they violated the FTC Act. The FTC Complaint alleges Fandango misrepresented the security of their mobile apps and failed to secure the transmission of millions of consumers' sensitive personal information from their mobile apps. The FTC Complaint further charged Fandango disabled a critical default process, known as Secure Sockets Layer ("SSL") certificate validation, which would have verified that the apps' communications were secure. Fandango provides a website and mobile applications for consumers to purchase movie tickets. A service fee is applied to consumers who use this application. Fandango uses a SSL to authenticate and encrypt connections which relies on SSL Certificates to vouch for its identity. If the application fails to perform this process, an attacker could get between the application on the consumer's device and the online service by presenting an invalid certificate to the application, which would allow the attacker to decrypt and alter communications without being detected. From March 2009 to March 2013, the movie applications failed to validate SSL certificates and securely transmit consumer's personal information including credit card information. The misuse of credit card information and authentication credentials could lead to identity theft and financial harm.

The Decision and Order requires Fandango to establish comprehensive security programs designed to address security risks during the development of their applications and to undergo independent security assessments every other year for the next 20 years. The Order further prohibits Fandango from misrepresenting the level of privacy or security of their products and services. This Order will terminate on August 13, 2034 or twenty years from the most recent date that the United States or the FTC files a Complaint in federal court alleging any violation of the Order.