Interesting findings. Though I didn't get why the author concentrated so much on the security issues of the UI while the real issue is that the whole thing is snake oil. I mean - what if the UI was great, had https and there were no CSRF vulnerabilities? Would this be considered a secure product?
An analysis of the Nomx secure communications device
61–70 of 77 posts
Re: An analysis of the Nomx secure communications device
#62[deleted]
Re: An analysis of the Nomx secure communications device
#63Website appears to be down as of now (10PM GMT+1)
Re: An analysis of the Nomx secure communications device
#64From the nomx respone:
> Contrary to the blogger's claim that this was an easy, simply hack, in fact, the blogger couldn't make the code work and requested other participants to support his attempts and publicly stated so on his blog. The "payload" he developed was from a third party named Paul.
That's embarassingly bad logic. The fact that this particular guy wasn't an expert at XSS doesn't make the hack hard, and the fact that it exists at all is the issue. What a bunch of fuckin' jokers.
Re: An analysis of the Nomx secure communications device
#65Their response (on their homepage) is awful: http://nomx.com/ "nomx Passes Security Tests After Blogger Claims to Have Penetrated nomx - UK blogger makes false claims he can access nomx remotely - UK blogger fails to access nomx remotely"
From the BBC article about this:
http://www.bbc.co.uk/news/technology-38934822
> Addressing the issue of old software, he said Nomx planned to let users choose which updates should be applied to their device.
> "We will selectively allow users to pick and choose when that becomes available but today we're not forcing any types of updates," he said, adding that updates can introduce vulnerabilities.
> "Updates actually cause a cascading effect and now you're patching patches and that is not a good place to be in," he told Click.
Re: An analysis of the Nomx secure communications device
#66> "We've advised them that they should not use the nomx admin while surfing any other sites which contain malware or were otherwise compromised" That's so hilariously misguided I don't even know where to start!
They ripped that straight out of the OWASP CSRF cheat sheet, under "Personal Safety CSRF Tips for Users". Yep, clearly nomx's issues are all just user education issues.
[1] https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%...
Re: An analysis of the Nomx secure communications device
#67Wow. The title kind of gave away that this was going to be a fun read, but I did not expect it to be that bad. Even if the vendor did not make those bold claims and simply sold it as a hassle-free email appliance for home users and small businesses, it would be borderline fraudulent. With the bold claims attached it almost looks like performance art to ridicule all the snake oil-peddlers out there.
It's unlikely to be performance art, and if this isn't fraud it's gross negligence. Does anyone know of any British legislation that refers to the sale of these types of products?
Re: An analysis of the Nomx secure communications device
#68I read through the patent application cited in the article [1] so I can explain what the device is supposed to be doing. The "secret sauce" is it can send email between two Nomx devices without using DNS or other third party servers, avoiding DNS attacks. The handshake between two devices sets up DNS records on each device so they can locally resolve each other. There's a mechanism so if a device changes IP address,…
From what the author found, it seems pretty clear to me that that patent is nothing more than an idea on paper right now. If the device doesn't send anything over the network for a "handshake" then it isn't a handshake at all. Also, I'm not sure if the author added detail or not but it makes it quite clear that the web interface simply adds a row to the handshake table with the fields entered and nothing else. He also found that the only other place in the GUI that references this table at all is to display the existing "handshakes".
As far as how it actually works on the device the author also showed the relevant portion of the postfix config where it checks if the domain is in the handshake table and if it is then connect to that IP on port 26 with the hardcoded default cert.
Maybe they plan on creating something based on that patent someday but right now what they're selling as based on that patent has nothing to do with it.
Re: An analysis of the Nomx secure communications device
#69Earlier quoted context omitted.
For Microsoft/Hotmail, you'll want to register your IP with their feedback loop (Junk Mail Reporting Program): https://postmaster.live.com/snds/JMRP.aspx It's free. A bonus of this is that you get reports about emails from your IP that their users mark as spam.
Thanks Mike! I know you work on a lot of email tools. What is your go-to resource when someone asks about deliverability? If you're written something up yourself I'd appreciate a link!
I don't really have a go-to resource, or anything written down. It's all in my head. I should probably write up a blog post about it at some point.
Re: An analysis of the Nomx secure communications device
#70This (statistics on the nomx rebuttal pages) must be coming from some kind of alternate universe:
>For Media - Some statistics:
Number of nomx accounts that have been compromised since inception: 0
Number of Gmail accounts that have been compromised in the United States (from 2014): About 5 million to 24 million depending on source
How about the TOTAL number of (respectively) nomx accounts and gmail accounts (from 2014)?
I mean, 0/(something) is undoubtedly a smaller number than 5-24*10^6/(a very HUGE number), but maybe the (something) is so little that the target in itself is irrelevant...