Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coinbase design allows for mass, targeted phishing of its users

blog.shubh.am

Post reply on HN
Print view View original

21–30 of 75 posts

Re: Coinbase design allows for mass, targeted phishing of its users

#21

Post by chandraonline »

lukashed wrote: post #14

On the screenshow of Humayun Khan's tweet it says "Click here to create an account". Does this mean that every email address that's not signed up with Coinbase yet will also get an email?

I think this is by design. If the email address is not associated with a registered coin base account, you get a link to sign up and receive money.

The email content copy should include a footer with a link to get out of receiving such emails. Since they are sending emails to "unverified" email address there is a good chance they get marked as spam by recipients there by damaging their email sender reputation.

Re: Coinbase design allows for mass, targeted phishing of its users

#22

Post by danielweber »

joezydeco wrote: post #3

"Initially, Coinbase ignored me. My succession of emails to their official "whitehat@coinbase.com" domain were ignored until I posted that they weren't replying on reddit" Deja vu, man.

The default state of every bug report ever is for the reporter to think they've found something that ends the world and the developer to think it's nothing to worry about at all. I've been on both sides and I've felt it.

Banks have entire security teams working around the clock and they work in an area where transactions are mostly reversible. When you work with Bitcoin nothing is reversible so you have to take things even more seriously than the banks.

Re: Coinbase design allows for mass, targeted phishing of its users

#23

Post by nwh »

chandraonline wrote: post #18
nwh wrote: post #15

Earlier quoted context omitted.

What do rate limit by? There's billions of IP addresses a spammer could use, captchas can be solved by offshore farms, there's almost nothing to go by.

The call is made on behalf of an user account using an API key. You could rate limit by either one and/or both.

Nothing really stopping somebody automating the creation of those either when you're up against people with ridiculous amounts of cost-free (read, botnet) resources to spam with. The Bitcoin reddit gets flooded with spam on an almost minutely basis despite reddits heavy rate limiting and captchas.

Re: Coinbase design allows for mass, targeted phishing of its users

#24

Post by danielweber »

nwh wrote: post #15
fatbat wrote: post #13

I am curious why Coinbase is not rate limiting that API call (temp-fix) or addressing this yet (even privately)? Granted it is not a critical flaw, but is having no limits over time really necessary for Coinbase API users?

What do rate limit by? There's billions of IP addresses a spammer could use, captchas can be solved by offshore farms, there's almost nothing to go by.

Lots of small businesses are perfectly happy to lock out foreign IP addresses on the slightest breeze, and it's probably a good result because for those businesses 1000 out of 1000 requests from the Eastern Hemisphere are hostile.

Re: Coinbase design allows for mass, targeted phishing of its users

#25

Post by vqc »

larrys wrote: post #19

As someone who studies human nature I'd like to ask this question of the OP and anyone else who cares to answer. I'd seriously like to know this. Why do people spend extensive time [1] documenting security flaws like this [2] and going to the trouble of informing the company. And then if that doesn't work take more time to write up a blog post to get the info out? What do they gain by doing so exactly? Is this a play…

Demonstrates expertise in a particular domain. It's a good exercise to improve one's skills and a good opportunity to provide evidence of one's skills. No one knows what you're good at unless you tell them.

Re: Coinbase design allows for mass, targeted phishing of its users

#26

Post by kochb »

300bps wrote: post #4

This is obviously a serious issue. One way to mitigate it is to use email addresses that have specific purposes. firstinitiallastname@gmail.com is my "public" email address that is used for friends and what not. genericemail@gmail.com is the email address I use for many retail sites. I then have an email address dedicated to each commonly used site (Amazon, Coinbase, etc). I also have Google two-factor authentication…

Why so many accounts? You can use the "jsmith+coinbase@gmail.com" syntax to get a unique email address for each service. Two factor auth drastically frustrates an account hijack, so you're gaining almost nothing by separating them.

Re: Coinbase design allows for mass, targeted phishing of its users

#28

Post by ianferrel »

baddox wrote: post #20
iancarroll wrote: post #2

API rate limiting seems to be their best course of action, and it's disappointing that they're ignoring you.

Shouldn't they also stop letting the requester know whether the requested email address corresponds to a Coinbase user?

The reasonable use case for this seems to be that you'd send a request for payment as part of a payment processing system.

So, user is on your site wanting to buy something, selects "pay with coinbase", and you ask for their email, then send the payment request.

In that case, you'd want to know that the email isn't in Coinbase's system so you could tell the user that the request didn't work, and can they check their email address or try another form of payment.

A reasonable way to limit this would be % of attempts that fail. If you're using this call reasonably, then the ratio of success to fail calls should be in some reasonable range. If it's too high, either you've designed a very confusing interface for payment, or you are doing something fishy.

Re: Coinbase design allows for mass, targeted phishing of its users

#29

Post by 300bps »

kochb wrote: post #26
300bps wrote: post #4

This is obviously a serious issue. One way to mitigate it is to use email addresses that have specific purposes. firstinitiallastname@gmail.com is my "public" email address that is used for friends and what not. genericemail@gmail.com is the email address I use for many retail sites. I then have an email address dedicated to each commonly used site (Amazon, Coinbase, etc). I also have Google two-factor authentication…

Why so many accounts? You can use the "jsmith+coinbase@gmail.com" syntax to get a unique email address for each service. Two factor auth drastically frustrates an account hijack, so you're gaining almost nothing by separating them.

you're gaining almost nothing by separating them.

This isn't true at all. jsmith+coinbase@gmail.com can be easily guessed by someone doing a spearphishing attack, either directly against you or indirectly against you using a vendor. Read this to see a real world example:

http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/

If the person who was hacked in that article had a unique email address at Amazon like mnmnmnmnmnmnmn696969696969@gmail.com then the attacker wouldn't have had any place to start the conversation with Amazon over the phone. Security by obscurity isn't perfect, but in many cases it does put up enough roadblocks to make someone give up.

If you use your technique, someone can also send you a spearphishing email purporting to come from any vendor that might fool you. On the other hand, if you get an email from Amazon to your Coinbase account it will be readily apparent it's fake.

Post reply on HN