11–20 of 67 posts
Some years ago I stumbled with something similar on a webpage, posted it on reddit, and the next day the IT manager of the company called me... it was one of the most embarrassing days of my life.
Lesson: don't mess with other peoples work just because you can...
The only point of these token generators is to provide a stream of tokens, so that if the generator is cloned (which is trivial), that can be detected. That's it. As far as I can tell, this attack does not prevent the server from detecting a cloned token. (To do that, you would have to install a new client on the victim's device that will increment its counter and tell you the counter when you ask.)
This specific token is time-based, so a clone would not be detected. On the other hand, counter-based tokens as you described them do exist, and it would indeed be simple to detect if one of those was cloned. I wouldn't even call this an attack, given that you would need physical access to a rooted device to carry it out.
he is going to get a very awkard phone call from the bank... Some years ago I stumbled with something similar on a webpage, posted it on reddit, and the next day the IT manager of the company called me... it was one of the most embarrassing days of my life. Lesson: don't mess with other peoples work just because you can...
he is going to get a very awkard phone call from the bank... Some years ago I stumbled with something similar on a webpage, posted it on reddit, and the next day the IT manager of the company called me... it was one of the most embarrassing days of my life. Lesson: don't mess with other peoples work just because you can...
On the other hand, if anything, I exposed that they did a good job. They could have rolled out their own crypto, or some flawed form of code generation, in which case I would have disclosed it to them through proper means. But they adhered to standards (TOTP, RFC6238) and protected their data as well as possible. This article should be seen as praise.
Then again, corporations aren't always that understanding, which is why I would be happy to comply.
he is going to get a very awkard phone call from the bank... Some years ago I stumbled with something similar on a webpage, posted it on reddit, and the next day the IT manager of the company called me... it was one of the most embarrassing days of my life. Lesson: don't mess with other peoples work just because you can...
he is going to get a very awkard phone call from the bank... Some years ago I stumbled with something similar on a webpage, posted it on reddit, and the next day the IT manager of the company called me... it was one of the most embarrassing days of my life. Lesson: don't mess with other peoples work just because you can...
On top of that, why would you ever feel embarrassed? Perhaps if you posted something very damaging with the sole intent of harming that person, then realised they weren't responsible for the problem.
A good lesson for those of us who have had the idea of building a similar app to generate one-time passwords. Now we have a better idea of the minimum that needs to be done to build such an app securely. Thanks.
he is going to get a very awkard phone call from the bank... Some years ago I stumbled with something similar on a webpage, posted it on reddit, and the next day the IT manager of the company called me... it was one of the most embarrassing days of my life. Lesson: don't mess with other peoples work just because you can...
I recognize this as a possibility and I would definitely take it down if the bank requested it. On the other hand, if anything, I exposed that they did a good job. They could have rolled out their own crypto, or some flawed form of code generation, in which case I would have disclosed it to them through proper means. But they adhered to standards (TOTP, RFC6238) and protected their data as well as possible. This arti…
TOTP and co. require a private key, just like all crypto. If you have that private key, bad things happen. This is not exactly news at 11.
he is going to get a very awkard phone call from the bank... Some years ago I stumbled with something similar on a webpage, posted it on reddit, and the next day the IT manager of the company called me... it was one of the most embarrassing days of my life. Lesson: don't mess with other peoples work just because you can...
What was embarrassing about it? You didn't add the security hole to the software.
P.S. Consider yourself lucky to have such a bank. Here in the U.S., our major banks do not take security seriously by any stretch of the imagination (they have little incentive to).