Break into my email: get $10,000. Here is my username and password. • Hacker News Board

Re: Break into my email: get $10,000. Here is my username and password.

#41

Post by mikeryan » Tue, Jun 02, 2009, 9:47 PM UTC

Confusion wrote: post #13

johns wrote: post #6

Sounds like a fun way to launch a DoS attack on someone's phone when you only know their email address.

You need the correct password as well. The phone verification takes place after the username/password authentication.

Does it? This line

"In addition to protection from fraudsters, StrongWebmail.com protects against friendly-fraud where a boss or spouse snoops on your email. If one of these people tries to log into your account, you’ll receive a phone call alerting you that someone is trying to access your email (like a silent alarm)."

Seems to indicate that failed attempts would also text you?

Re: Break into my email: get $10,000. Here is my username and password.

#42

Post by weaksauce » Tue, Jun 02, 2009, 9:54 PM UTC

duskwuff wrote: post #11

Wait, you have to receive a phone call every time you want to check your email from a different computer than usual? This sounds incredibly annoying - especially if someone's actually trying to break into your account.

You only get the call if the username and password were actually entered correctly and the computer is different.

Re: Break into my email: get $10,000. Here is my username and password.

#43

Post by tlrobinson » Tue, Jun 02, 2009, 9:57 PM UTC

tptacek wrote: post #9

Ten THOUSAND dollars. That's literally, like, an entire FRACTION of what an application penetration test costs! They must really be serious! [ quick edit: I really hate talking about numbers here, because if you have some bootstrapped YC-style company and you're worried about security, I'd love to think you could reach out to us and not have us try to get into you for tens of thousands of dollars --- but for an actua…

I'm guessing this is more of a marketing ploy (and it seems to be working...).

Just like the LifeLock CEO who gave out his SSN to show how effective they were at preventing identity theft.

Re: Break into my email: get $10,000. Here is my username and password.

#44

Post by bk » Tue, Jun 02, 2009, 10:04 PM UTC

The left sidebar is a classic example of keyword stuffing. If you click on a lot of these tags, you get the same two blog posts for a lot of them.

These guys are at least clueless, probably unprofessional, perhaps even desperate or unethical. No thanks.

Fellow HNers: Don't gobble up cheap marketing (link-)bait. This story has too many upvotes.

Re: Break into my email: get $10,000. Here is my username and password.

#45

Post by vlisivka » Tue, Jun 02, 2009, 10:12 PM UTC

> When logging in from a home or work computer, a cookie can be stored so that no verification call is required.

Try XSS.

Re: Break into my email: get $10,000. Here is my username and password.

#46

Post by shader » Tue, Jun 02, 2009, 10:12 PM UTC

tptacek wrote: post #35

abalashov wrote: post #20

Earlier quoted context omitted.

Right, hence crowdsourcing.

I guess my point is: if you find a security hole in this service, why would you give it up for $10,000?

Sell it to as many customers as you can find first, and then go to them for the extra $10,000. You get more money than you would have otherwise, and you also save innocent people from being unduly compromised. It's a win-win situation ;)

Re: Break into my email: get $10,000. Here is my username and password.

#47

Post by shader » Tue, Jun 02, 2009, 10:15 PM UTC

arien wrote: post #32

miles wrote: post #5

"Here’s the thing, in order to get into a StrongWebmail account, the account owner must receive a verification call on their phone. This means that even if your password is stolen, the thief can’t access your email because they don’t have access to your telephone." Great. Users will love receiving calls at all hours as script kiddies in Russia try to log in to their accounts. "Break into my email: get $10,000. Here i…

The CEO username and password work for me. I've checked the obvious stuff and they have that covered, so it won't be an easy $10,000. But I'm sure no system is 100% infallible :)

I'm guessing that as many people as are probably trying to log into his account, he probably doesn't answer his phone any more, or even use that email account. How would he know if the access he just authorized was him, or someone else?

Maybe if they texted him a code he had to type in, it would be more secure, but then it would be simple enough to brute force all of the codes, or find the seed and generation mechanism.

Re: Break into my email: get $10,000. Here is my username and password.

#48

Post by icey » Tue, Jun 02, 2009, 10:17 PM UTC

tlrobinson wrote: post #43

tptacek wrote: post #9

Ten THOUSAND dollars. That's literally, like, an entire FRACTION of what an application penetration test costs! They must really be serious! [ quick edit: I really hate talking about numbers here, because if you have some bootstrapped YC-style company and you're worried about security, I'd love to think you could reach out to us and not have us try to get into you for tens of thousands of dollars --- but for an actua…

I'm guessing this is more of a marketing ploy (and it seems to be working...). Just like the LifeLock CEO who gave out his SSN to show how effective they were at preventing identity theft.

You mean the one who had his identity stolen multiple times?

http://www.wvgazette.com/News/200805172662

Re: Break into my email: get $10,000. Here is my username and password.

#49

Post by telegraph » Tue, Jun 02, 2009, 10:21 PM UTC

icey wrote: post #3

I worked on something similar in the 90s. One of the problems that we found was that people dislike having to answer their phone late at night. (Or making phone calls, for that matter.) The biggest security risk we found wasn't the second form of authentication; it was making sure it was just as hard to add other phone numbers. Then there were instances of disconnected phones, dead cell phones, etc to deal with. If t…

I think late night phone calls are a lot more palatable now than they were in the 90s, when phone calls for many people meant loud noises in rooms all over ones home instead of a subtle vibration in ones pocket.

Re: Break into my email: get $10,000. Here is my username and password.

#50

Post by tptacek » Tue, Jun 02, 2009, 10:24 PM UTC

SwellJoe wrote: post #40

tptacek wrote: post #9

Ten THOUSAND dollars. That's literally, like, an entire FRACTION of what an application penetration test costs! They must really be serious! [ quick edit: I really hate talking about numbers here, because if you have some bootstrapped YC-style company and you're worried about security, I'd love to think you could reach out to us and not have us try to get into you for tens of thousands of dollars --- but for an actua…

So, based on the edit, how should small startups (or Open Source projects) reach out to security pros? Some Open Source projects have millions of users, and so security is obviously a concern...I've noticed in our own project that we occasionally get penetration testing reports from security companies out of the blue (I guess because Webmin is high profile enough, and is potentially dangerous enough, to be on everyon…

I've never felt comfortable talking about this here before because I have zero interest in trying to make money off companies that need to conserve every dollar they've got. Been there. Recently.

It's really kind of tricky. I've been working with my team for the past couple months on an "Indie SDLC" (SDLC is the industry's jargon term for secure development); we gave a talk on it at C4 last August. Rentzsch may post the video someday, and I'll be sure to post it here.

I have a shortlist of things I think every company should be doing now on security:

1. Stop talking about security. (Don't be a target).

2. Train every developer on SQL Injection and Cross-Site Scripting, and --- if they're writing C code --- Integer Overflows.

3. Avoid a set of "features that always doom dev teams", including encryption, password storage, browser plugins that inject into the DOM, templating, installers, network listeners, and file upload/download.

4. Deploy the "rubber chickens" that make users feel safe --- SSL, big long random URLs, little lock icons, and if you really need to, something like Hackersafe (which is snake oil, but whatever).

5. Screw with amateur web pests --- use your own magic version of base64 with some of the characters swapped, use 3DES for something with swapped-around s-boxes, etc.

6. Make time in QA for every release to fuzz. Fuzzing is all you really need to do for security QA. Buy a copy of Burp Suite and run the "Intruder" on every page. Write your own fuzzer for any custom formats you handle.

7. For god's sake have a security contact and a /security URL on your site. Post a GPG key. Publish advisories when people find things. Act like you've handled this before.

(Obviously we fleshed a lot of this out, and the fact that we haven't posted it yet tells you that I'm not totally in love with where it is now).

Getting someone who bills N x $100 an hour to look at your app for free, even if it's open source, will probably be tricky. With the good firms (I like to think we're one of them), advice is free, so by all means reach out with lots of questions. If the question is "how can I get my app looked at without spending $50,000", well, that's a good question! There's probably something creative you can do.