Coinbase design allows for mass, targeted phishing of its users • Hacker News Board

Re: Coinbase design allows for mass, targeted phishing of its users

#11

Post by flopsey » Mon, Mar 31, 2014, 10:40 PM UTC

andrewparker wrote: post #6

I received a phishing email from the author. I guess he must have scraped my email address from a blog post I wrote about bitcoin and coinbase. While I am glad he has made attempts to contact Coinbase, I felt like live execution of the attack was spammy, so my first instinct was the block the domain of the sender's email, which Coinbase passes through to me. In execution of his proof of concept, the author is likely…

It wouldn't have been nearly as compelling without a live demonstration. I guess he felt it was worth the bad score.

Re: Coinbase design allows for mass, targeted phishing of its users

#12

Post by infosec-au » Mon, Mar 31, 2014, 10:42 PM UTC

andrewparker wrote: post #6

I received a phishing email from the author. I guess he must have scraped my email address from a blog post I wrote about bitcoin and coinbase. While I am glad he has made attempts to contact Coinbase, I felt like live execution of the attack was spammy, so my first instinct was the block the domain of the sender's email, which Coinbase passes through to me. In execution of his proof of concept, the author is likely…

Hey, I'm the author of this blog post. I think you're mistaken, I didn't send any phishing emails to anyone. All the emails were sent through coinbase via their request money featurein which I am trying to get them to fix. All emails to you were from Coinbase legitimately and none of them are phishing for your credentials. The lack of rate limiting on the api which allows for money requests is hence very dangerous.

Re: Coinbase design allows for mass, targeted phishing of its users

#13

Post by fatbat » Mon, Mar 31, 2014, 11:02 PM UTC

I am curious why Coinbase is not rate limiting that API call (temp-fix) or addressing this yet (even privately)?

Granted it is not a critical flaw, but is having no limits over time really necessary for Coinbase API users?

Re: Coinbase design allows for mass, targeted phishing of its users

#14

Post by lukashed » Mon, Mar 31, 2014, 11:10 PM UTC

On the screenshow of Humayun Khan's tweet it says "Click here to create an account". Does this mean that every email address that's not signed up with Coinbase yet will also get an email?

Re: Coinbase design allows for mass, targeted phishing of its users

#15

Post by nwh » Mon, Mar 31, 2014, 11:22 PM UTC

fatbat wrote: post #13

I am curious why Coinbase is not rate limiting that API call (temp-fix) or addressing this yet (even privately)? Granted it is not a critical flaw, but is having no limits over time really necessary for Coinbase API users?

What do rate limit by? There's billions of IP addresses a spammer could use, captchas can be solved by offshore farms, there's almost nothing to go by.

Re: Coinbase design allows for mass, targeted phishing of its users

#16

Post by mathrawka » Mon, Mar 31, 2014, 11:34 PM UTC

nwh wrote: post #15

fatbat wrote: post #13

I am curious why Coinbase is not rate limiting that API call (temp-fix) or addressing this yet (even privately)? Granted it is not a critical flaw, but is having no limits over time really necessary for Coinbase API users?

What do rate limit by? There's billions of IP addresses a spammer could use, captchas can be solved by offshore farms, there's almost nothing to go by.

User account.

Re: Coinbase design allows for mass, targeted phishing of its users

#17

Post by chandraonline » Mon, Mar 31, 2014, 11:34 PM UTC

nbody wrote: post #7

I didn't see any suggestion from the author, did I miss it?

- Rate limit API requests (flag / suspend if there are too many request for money requests from the same user) - Don't disclose which email addresses is registered/not registered with coinbase (right now they even go a bit further and actually disclose first and last names in the response).

Re: Coinbase design allows for mass, targeted phishing of its users

#18

Post by chandraonline » Mon, Mar 31, 2014, 11:37 PM UTC

nwh wrote: post #15

fatbat wrote: post #13

I am curious why Coinbase is not rate limiting that API call (temp-fix) or addressing this yet (even privately)? Granted it is not a critical flaw, but is having no limits over time really necessary for Coinbase API users?

What do rate limit by? There's billions of IP addresses a spammer could use, captchas can be solved by offshore farms, there's almost nothing to go by.

The call is made on behalf of an user account using an API key. You could rate limit by either one and/or both.

Re: Coinbase design allows for mass, targeted phishing of its users

#19

Post by larrys » Mon, Mar 31, 2014, 11:37 PM UTC

As someone who studies human nature I'd like to ask this question of the OP and anyone else who cares to answer. I'd seriously like to know this.

Why do people spend extensive time [1] documenting security flaws like this [2] and going to the trouble of informing the company. And then if that doesn't work take more time to write up a blog post to get the info out?

What do they gain by doing so exactly? Is this a play for internet notoriety? Or a way to gain attention that results in future fame that leads to something later?

Or, is it as simple as it just makes them feel good (like "hey why do you play poker") or is it they believe they are making the world a better place?

[1] Because this took considerable time.

[2] Yes I know the OP indicates he is a "Information Security Enthusiast".

Re: Coinbase design allows for mass, targeted phishing of its users

#20

Post by baddox » Mon, Mar 31, 2014, 11:43 PM UTC

iancarroll wrote: post #2

API rate limiting seems to be their best course of action, and it's disappointing that they're ignoring you.

Shouldn't they also stop letting the requester know whether the requested email address corresponds to a Coinbase user?