I am really amused by how the 1337 h4x0r attack on Palin's e-mail always comes up in these security articles
Hackers claim $10,000 prize for breaking into StrongWebmail
11–20 of 35 posts
Re: Hackers claim $10,000 prize for breaking into StrongWebmail
#12It doesn't matter how good the lock on your front door is if the hinges are on the outside.
Re: Hackers claim $10,000 prize for breaking into StrongWebmail
#13Since everyone is venturing a guess, here's mine:
They used XSS (cross site scripting) to send a mail to the target. When the email is viewed a CSRF (cross site request forgery) is executed to add a new device (phone) to the authenticated devices list. Next they log in, receive the SMS on their phone that is now in the list...bam!
[Edit: I didn't mean XSS to send the email, I meant inject an XSS attack into the email and send it. I'm thinking something like psuedo: location.replace(/link/to/add/device/?phone=555-1212 ]
Re: Hackers claim $10,000 prize for breaking into StrongWebmail
#14Since everyone is venturing a guess, here's mine: They used XSS (cross site scripting) to send a mail to the target. When the email is viewed a CSRF (cross site request forgery) is executed to add a new device (phone) to the authenticated devices list. Next they log in, receive the SMS on their phone that is now in the list...bam! [Edit: I didn't mean XSS to send the email, I meant inject an XSS attack into the email…
As jgrahamc pointed out: http://news.ycombinator.com/item?id=642280
They probably sent the mail like you said, only used the CSRF to jack the cookie, which would be easier than adding a phone to the list.
Re: Hackers claim $10,000 prize for breaking into StrongWebmail
#15glad to see the advertising program on HN working as planned
Re: Hackers claim $10,000 prize for breaking into StrongWebmail
#16Hackers love a challenge. And more than that, they love cash.
Strike that, reverse it.
Re: Hackers claim $10,000 prize for breaking into StrongWebmail
#17I wonder if they have a viable business after this. Seems like this could be a deathblow right off the bat.
Ask Microsoft.
Re: Hackers claim $10,000 prize for breaking into StrongWebmail
#18I wonder if they have a viable business after this. Seems like this could be a deathblow right off the bat.
They had no viable business plan to begin with. Google and Yahoo mail are among the top 10 trophy targets on the Internet. I have no idea how you'd convince me some startup had put more resources into securing mail than Google did.
Re: Hackers claim $10,000 prize for breaking into StrongWebmail
#19They claim it was to bring more attention to the issue, but you know they did it show off. Well THAT backfired, didn't it?
Re: Hackers claim $10,000 prize for breaking into StrongWebmail
#20Since everyone is venturing a guess, here's mine: They used XSS (cross site scripting) to send a mail to the target. When the email is viewed a CSRF (cross site request forgery) is executed to add a new device (phone) to the authenticated devices list. Next they log in, receive the SMS on their phone that is now in the list...bam! [Edit: I didn't mean XSS to send the email, I meant inject an XSS attack into the email…
As jgrahamc pointed out: http://news.ycombinator.com/item?id=642280 They probably sent the mail like you said, only used the CSRF to jack the cookie, which would be easier than adding a phone to the list.
Can you explain what the CSRF attack you're thinking of is? Maybe I'm not reading you carefully enough (long day), but that doesn't sound like a CSRF to me.