21–30 of 35 posts
I wonder if they have a viable business after this. Seems like this could be a deathblow right off the bat.
Since everyone is venturing a guess, here's mine: They used XSS (cross site scripting) to send a mail to the target. When the email is viewed a CSRF (cross site request forgery) is executed to add a new device (phone) to the authenticated devices list. Next they log in, receive the SMS on their phone that is now in the list...bam! [Edit: I didn't mean XSS to send the email, I meant inject an XSS attack into the email…
As jgrahamc pointed out: http://news.ycombinator.com/item?id=642280 They probably sent the mail like you said, only used the CSRF to jack the cookie, which would be easier than adding a phone to the list.
"alternatively- add a device to the auth list and wala ;)"
[edit: I should note that XSSExploits seems to be the twitter account for the company that won the contest)
http://www2.telesign.com/login.php?loginerror=yes&user=\...
Pathetic. (Telesign is behind StrongWebmail)
I wonder if they have a viable business after this. Seems like this could be a deathblow right off the bat.
They had no viable business plan to begin with. Google and Yahoo mail are among the top 10 trophy targets on the Internet. I have no idea how you'd convince me some startup had put more resources into securing mail than Google did.
Earlier quoted context omitted.
As jgrahamc pointed out: http://news.ycombinator.com/item?id=642280 They probably sent the mail like you said, only used the CSRF to jack the cookie, which would be easier than adding a phone to the list.
I hope the rules of the contest allow disclosure. Until then, I only have this tweet to reference from June 3rd: http://twitter.com/XSSExploits/status/2019746890 "alternatively- add a device to the auth list and wala ;)" [edit: I should note that XSSExploits seems to be the twitter account for the company that won the contest)
I wonder if they have a viable business after this. Seems like this could be a deathblow right off the bat.
Did they have a viable business to begin with? At least personally, I don't spend too much time worrying that hackers are going to raid my gmail.
In fact I recently received a four inch thick stack of documentation, APIs, etc... via FedEx from a bank because they didn't trust my e-mail and I wasn't on "the list" for their "secure e-mail" site (pay per account thing).
So yes, reasonable or not, secure or not, there is a business supplying "secure" communications for businesses.
Earlier quoted context omitted.
As jgrahamc pointed out: http://news.ycombinator.com/item?id=642280 They probably sent the mail like you said, only used the CSRF to jack the cookie, which would be easier than adding a phone to the list.
Can you explain what the CSRF attack you're thinking of is? Maybe I'm not reading you carefully enough (long day), but that doesn't sound like a CSRF to me.
Victim logs in using two-factor auth, gets a cookie which lets them back in without phone in future.
Attacker sends email to victim with some kind of script embedded.
Victim views email, javascript runs and sends cookie info to attacker.
Attacker uses cookie to impersonate victim.
Of course, it's been a long day here too, and I'm so far from an expert on this stuff it's entirely probable that what I just described doesn't make sense/isn't possible.
Edit: Yeah, guess what I described is more XSS than CSRF
glad to see the advertising program on HN working as planned
Even if they fix this, I wouldn't trust a company that claims their product is very secure, offers a $10k reward for hacking it, then gets exploited in less than a day by (most likely) the simple XSS vulnerability mentioned in another comment.
So many people think they know security, so few people do.
I wonder if they have a viable business after this. Seems like this could be a deathblow right off the bat.
Did they have a viable business to begin with? At least personally, I don't spend too much time worrying that hackers are going to raid my gmail.
This? this is straight up public humiliation.