Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coinbase design allows for mass, targeted phishing of its users

blog.shubh.am

Post reply on HN
Print view View original

51–60 of 75 posts

Re: Coinbase design allows for mass, targeted phishing of its users

#51

Post by MichaelGG »

homakov wrote: post #45

There's another bug when you can substitute coinbase's iframe with your own, when you use coinbase button. This iframe can ask for username / password, and there's no way for user to distinguish fake iframe from real. They also not into replying emails on their whitehat@ address.

>substitute coinbase's iframe with your own, when you use coinbase button

How would they go about fixing that? Verified by Visa is the same - you get redirected to some random domain "arcot.com"?. There's a verification code, but that's viewable by anyone that has your credit card (including the site operator where you just input your CC number).

Wouldn't Coinbase need to fully redirect to their own domain, or popup a window with the URL visible in order for users to know they're really dealing with Coinbase?

Re: Coinbase design allows for mass, targeted phishing of its users

#52

Post by MichaelGG »

iancarroll wrote: post #2

API rate limiting seems to be their best course of action, and it's disappointing that they're ignoring you.

They addressed that here[1]. Sending invoices to lists of clients is specifically something they want to allow.

And anyways, an attacker could simply sign up for multiple accounts.

I don't think much of Coinbase technically (terrible execution in the past, use of MongoDB), but this breathless report is really overhyping an minor design decision on Coinbase's part.

1: https://hackerone.com/reports/5200

Re: Coinbase design allows for mass, targeted phishing of its users

#53

Post by sillysaurus3 »

homakov wrote: post #45

There's another bug when you can substitute coinbase's iframe with your own, when you use coinbase button. This iframe can ask for username / password, and there's no way for user to distinguish fake iframe from real. They also not into replying emails on their whitehat@ address.

I'm surprised that even homakov's emails are going unanswered.

Re: Coinbase design allows for mass, targeted phishing of its users

#54

Post by pbreit »

homakov wrote: post #45

There's another bug when you can substitute coinbase's iframe with your own, when you use coinbase button. This iframe can ask for username / password, and there's no way for user to distinguish fake iframe from real. They also not into replying emails on their whitehat@ address.

Sounds more like a design decision. Do you have any suggestions besides not using iframes?

Re: Coinbase design allows for mass, targeted phishing of its users

#55

Post by infosec-au »

abalone wrote: post #49
infosec-au wrote: post #44

Earlier quoted context omitted.

The actual bug report is the technical section of my blog post: http://blog.shubh.am/full-disclosure-coinbase-security/#tech... You're reading the Proof of Concept, which is meant to be a practical demonstration of how once could use the bug to their advantage. I didn't document the proof of concept in detail, to ensure that others couldn't easily use the blog post as a guide to harvesting Coinbase emails. If you wan…

The "full, technical" report doesn't offer any new information. It just shows how to get the firstname and lastname. The PoC does not at all demonstrate how the alleged bug could be used by phishers to their advantage.. it doesn't even show usage of the firstname or lastname! That makes it incoherent.

I don't think you understand, the PoC is not supposed to be a PoC for phishing but rather a PoC for their lack of rate limiting [1] , and user enumeration. I have showed the first name and last name [2], but have accordingly blurred them out [3] as I felt it was only appropriate.

In the technical section, I demonstrate where the first and last name would show up in the response from Coinbase. If you still think it's unclear, let me know, as reporting is something I wish to improve critically.

I appreciate the response from the Bitcoin community and the semi-fix from Coinbase they wish to implement in the future (optional masking of names on coinbase). However, I do also hope that rate limiting is implemented in the future, as I still personally consider this insecure by design.

[1] : http://i.imgur.com/nauHivq.png

[2] : http://blog.shubh.am/full-disclosure-coinbase-security/#tech...

[3] : http://i.imgur.com/l84eOi6.png and http://i.imgur.com/SDlbtty.png

Re: Coinbase design allows for mass, targeted phishing of its users

#56

Post by kochb »

300bps wrote: post #29
kochb wrote: post #26

Earlier quoted context omitted.

Why so many accounts? You can use the "jsmith+coinbase@gmail.com" syntax to get a unique email address for each service. Two factor auth drastically frustrates an account hijack, so you're gaining almost nothing by separating them.

you're gaining almost nothing by separating them. This isn't true at all. jsmith+coinbase@gmail.com can be easily guessed by someone doing a spearphishing attack, either directly against you or indirectly against you using a vendor. Read this to see a real world example: http://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ If the person who was hacked in that article had a unique email address at Amazon like…

Same logic applies, "jsmith+mnmnmnmnmnmnmn696969696969@gmail.com" then. Add a filter to discard email to that address unless it's from Coinbase. Done.

Re: Coinbase design allows for mass, targeted phishing of its users

#57

Post by jessieplk »

homakov wrote: post #45

There's another bug when you can substitute coinbase's iframe with your own, when you use coinbase button. This iframe can ask for username / password, and there's no way for user to distinguish fake iframe from real. They also not into replying emails on their whitehat@ address.

+ there was another bug (or "feature") that allowed all access to all funds via API access key.

Sure, the user needs to allow the permissions first, but the warning where disproportionate to the power it gave away.

They've disabled this kind of access since though.

http://www.theverge.com/2014/2/7/5386222/a-string-of-thefts-...

Re: Coinbase design allows for mass, targeted phishing of its users

#58

Post by gaadd33 »

infosec-au wrote: post #55
abalone wrote: post #49

Earlier quoted context omitted.

The "full, technical" report doesn't offer any new information. It just shows how to get the firstname and lastname. The PoC does not at all demonstrate how the alleged bug could be used by phishers to their advantage.. it doesn't even show usage of the firstname or lastname! That makes it incoherent.

I don't think you understand, the PoC is not supposed to be a PoC for phishing but rather a PoC for their lack of rate limiting [1] , and user enumeration. I have showed the first name and last name [2], but have accordingly blurred them out [3] as I felt it was only appropriate. In the technical section, I demonstrate where the first and last name would show up in the response from Coinbase. If you still think it's…

How would rate limiting really solve this though? Wouldn't it just result in needing to use a botnet/spend more time harvesting?

Assuming that this is still the easiest way to harvest email/name pairs for phishing, then it seems like the time it takes isn't really a factor in the outcome since it can be parallelized and is still easier than phishing alternatives. It seems like the real answer is just to have it return the same response no matter if there is an account or not.

Re: Coinbase design allows for mass, targeted phishing of its users

#59

Post by homakov »

pbreit wrote: post #54
homakov wrote: post #45

There's another bug when you can substitute coinbase's iframe with your own, when you use coinbase button. This iframe can ask for username / password, and there's no way for user to distinguish fake iframe from real. They also not into replying emails on their whitehat@ address.

Sounds more like a design decision. Do you have any suggestions besides not using iframes?

No, since there's no way to check iframe's domain I don't think it can be fixed for iframes.

They should stop asking for user's password right there, because it makes people trust any iframe

Re: Coinbase design allows for mass, targeted phishing of its users

#60

Post by homakov »

MichaelGG wrote: post #51
homakov wrote: post #45

There's another bug when you can substitute coinbase's iframe with your own, when you use coinbase button. This iframe can ask for username / password, and there's no way for user to distinguish fake iframe from real. They also not into replying emails on their whitehat@ address.

>substitute coinbase's iframe with your own, when you use coinbase button How would they go about fixing that? Verified by Visa is the same - you get redirected to some random domain "arcot.com"?. There's a verification code, but that's viewable by anyone that has your credit card (including the site operator where you just input your CC number). Wouldn't Coinbase need to fully redirect to their own domain, or popup…

>Wouldn't Coinbase need to fully redirect to their own domain, or popup a window with the URL visible in order for users to know they're really dealing with Coinbase?

Yes, of course

Post reply on HN