Hackers claim $10,000 prize for breaking into StrongWebmail

http://www.thestandard.com/news/2009/06/04/hackers-claim-10-000-prize-breaking-strongwebmail

by markbao • 17 years ago

71 34 17 years ago

icey2• 17 years ago

FTA:

The IDG attack did not work initially, but succeeded when security software called NoScript was disabled on the Firefox browser, running on a Windows XP machine.

Oh my.

vaksel• 17 years ago

Since NoScript just lets you block javascript, I'm guessing their powerful security system was nothing more than a few lines of javascript code?

tybris2• 17 years ago

I'm guessing they used XSS to perform the man-in-the-middle attack and snatch the username+password+security code, but initially it didn't work on the journalist's computer because he had NoScript installed.

Xichekolas3• 17 years ago

From what little I could glean, it sounded like the attackers used some kind of CSRF attack that required the target account to log in.

IDG probably logged in with NoScript enabled, preventing the attacker's script from being run by IDG's browser. Disabling NoScript allowed the CSRF attack to work properly. The website was merely an unwitting pawn.

modoc2• 17 years ago

I wonder if they have a viable business after this. Seems like this could be a deathblow right off the bat.

erlanger• 17 years ago

Ask Microsoft.

tptacek2• 17 years ago

They had no viable business plan to begin with. Google and Yahoo mail are among the top 10 trophy targets on the Internet. I have no idea how you'd convince me some startup had put more resources into securing mail than Google did.

staunch• 17 years ago

Volvo may not be the most popular brand of car, but it may still be the safest, if that's their primary focus.

brl• 17 years ago

Did they have a viable business to begin with? At least personally, I don't spend too much time worrying that hackers are going to raid my gmail.

modoc2• 17 years ago

I've dealt with several companies, mostly banks, that use web based "secure e-mail" systems (mostly they're just file storage systems). They won't e-mail important documents to you since most people's e-mail clients use plain text and/or people use weak passwords, etc...

In fact I recently received a four inch thick stack of documentation, APIs, etc... via FedEx from a bank because they didn't trust my e-mail and I wasn't on "the list" for their "secure e-mail" site (pay per account thing).

So yes, reasonable or not, secure or not, there is a business supplying "secure" communications for businesses.

dschobel2• 17 years ago

They may not have had a viable business, but enough gloss and marketing could cover that up.

This? this is straight up public humiliation.

tybris2• 17 years ago

So many people think they know security, so few people do.

dschobel2• 17 years ago

it's like any discipline, the best ones appreciate how little they truly know.

sucuri2• 17 years ago

I believe they probably found a way to inject some data that wasn't properly escaped.

When the CEO (or anyone else) would receive the alerts that someone was trying to break into their accounts, the XSS or javascript (or whatever) would be included in the alert and executed ... That's probably how they broke into it and why it didn't work with noscript enabled.

jgrahamc• 17 years ago

IIRC the telephone authentication is not used if the machine has already been used to log into the account. Since the company gave away the username and password, all that would remain is to steal the cookie used to identify a machine that has already logged in.

That could be done with an XSS attack using JavaScript to access the cookie and divert it.

I considered doing this but would have needed to sign up for an account and that required giving a credit card which I didn't want to do. Well done to the people who made it work.

lilsis• 17 years ago

I am really amused by how the 1337 h4x0r attack on Palin's e-mail always comes up in these security articles

duskwuff• 17 years ago

It doesn't matter how good the lock on your front door is if the hinges are on the outside.

rdj3• 17 years ago

Since everyone is venturing a guess, here's mine:

They used XSS (cross site scripting) to send a mail to the target. When the email is viewed a CSRF (cross site request forgery) is executed to add a new device (phone) to the authenticated devices list. Next they log in, receive the SMS on their phone that is now in the list...bam!

[Edit: I didn't mean XSS to send the email, I meant inject an XSS attack into the email and send it. I'm thinking something like psuedo: location.replace(/link/to/add/device/?phone=555-1212 ]

Xichekolas3• 17 years ago

As jgrahamc pointed out: http://news.ycombinator.com/item?id=642280

They probably sent the mail like you said, only used the CSRF to jack the cookie, which would be easier than adding a phone to the list.

tptacek2• 17 years ago

Can you explain what the CSRF attack you're thinking of is? Maybe I'm not reading you carefully enough (long day), but that doesn't sound like a CSRF to me.

rdj3• 17 years ago

I hope the rules of the contest allow disclosure. Until then, I only have this tweet to reference from June 3rd: http://twitter.com/XSSExploits/status/2019746890

"alternatively- add a device to the auth list and wala ;)"

[edit: I should note that XSSExploits seems to be the twitter account for the company that won the contest)

weegee• 17 years ago

glad to see the advertising program on HN working as planned

tlrobinson• 17 years ago

Advertising that their application is incredibly insecure?

Even if they fix this, I wouldn't trust a company that claims their product is very secure, offers a $10k reward for hacking it, then gets exploited in less than a day by (most likely) the simple XSS vulnerability mentioned in another comment.

miles• 17 years ago

"Advertising that their application is incredibly insecure?"

No, weegee is referring to this story which was deleted as spam apparently:

http://news.ycombinator.com/item?id=638494

tdavis• 17 years ago

Hackers love a challenge. And more than that, they love cash.

Strike that, reverse it.

TallGuyShort• 17 years ago

They claim it was to bring more attention to the issue, but you know they did it show off. Well THAT backfired, didn't it?

qeorge• 17 years ago

Wow, this is ridiculous:

http://www2.telesign.com/login.php?loginerror=yes&user=\...