Hackers claim $10,000 prize for breaking into StrongWebmail
thestandard.com
Hackers claim $10,000 prize for breaking into StrongWebmail
1–10 of 35 posts
Re: Hackers claim $10,000 prize for breaking into StrongWebmail
#2FTA:
The IDG attack did not work initially, but succeeded when security software called NoScript was disabled on the Firefox browser, running on a Windows XP machine.
Oh my.
Re: Hackers claim $10,000 prize for breaking into StrongWebmail
#3I wonder if they have a viable business after this. Seems like this could be a deathblow right off the bat.
Re: Hackers claim $10,000 prize for breaking into StrongWebmail
#4FTA: The IDG attack did not work initially, but succeeded when security software called NoScript was disabled on the Firefox browser, running on a Windows XP machine. Oh my.
Since NoScript just lets you block javascript, I'm guessing their powerful security system was nothing more than a few lines of javascript code?
Re: Hackers claim $10,000 prize for breaking into StrongWebmail
#5So many people think they know security, so few people do.
Re: Hackers claim $10,000 prize for breaking into StrongWebmail
#6FTA: The IDG attack did not work initially, but succeeded when security software called NoScript was disabled on the Firefox browser, running on a Windows XP machine. Oh my.
Since NoScript just lets you block javascript, I'm guessing their powerful security system was nothing more than a few lines of javascript code?
I'm guessing they used XSS to perform the man-in-the-middle attack and snatch the username+password+security code, but initially it didn't work on the journalist's computer because he had NoScript installed.
Re: Hackers claim $10,000 prize for breaking into StrongWebmail
#7I believe they probably found a way to inject some data that wasn't properly escaped.
When the CEO (or anyone else) would receive the alerts that someone was trying to break into their accounts, the XSS or javascript (or whatever) would be included in the alert and executed ... That's probably how they broke into it and why it didn't work with noscript enabled.
Re: Hackers claim $10,000 prize for breaking into StrongWebmail
#8IIRC the telephone authentication is not used if the machine has already been used to log into the account. Since the company gave away the username and password, all that would remain is to steal the cookie used to identify a machine that has already logged in.
That could be done with an XSS attack using JavaScript to access the cookie and divert it.
I considered doing this but would have needed to sign up for an account and that required giving a credit card which I didn't want to do. Well done to the people who made it work.
Re: Hackers claim $10,000 prize for breaking into StrongWebmail
#9FTA: The IDG attack did not work initially, but succeeded when security software called NoScript was disabled on the Firefox browser, running on a Windows XP machine. Oh my.
Since NoScript just lets you block javascript, I'm guessing their powerful security system was nothing more than a few lines of javascript code?
From what little I could glean, it sounded like the attackers used some kind of CSRF attack that required the target account to log in.
IDG probably logged in with NoScript enabled, preventing the attacker's script from being run by IDG's browser. Disabling NoScript allowed the CSRF attack to work properly. The website was merely an unwitting pawn.
Re: Hackers claim $10,000 prize for breaking into StrongWebmail
#10Earlier quoted context omitted.
Since NoScript just lets you block javascript, I'm guessing their powerful security system was nothing more than a few lines of javascript code?
I'm guessing they used XSS to perform the man-in-the-middle attack and snatch the username+password+security code, but initially it didn't work on the journalist's computer because he had NoScript installed.
On my first read, I thought it was just shoddy editing, but I think you're definitely on the right track with this.