Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Coinbase design allows for mass, targeted phishing of its users

blog.shubh.am

Post reply on HN
Print view View original

41–50 of 75 posts

Re: Coinbase design allows for mass, targeted phishing of its users

#41

Post by abalone »

Meh, this is an extremely poor bug report despite the super-serious introductory tone. The "proof of concept" makes no sense. Quoting:

1. Scrape email addresses from bitcoin related websites, and organise them into a large list.

This has nothing to do with Coinbase.

2. Test for emails which are actual Coinbase accounts, and extract their First and Last names, associated to the emails.

Ok...

3. All sorts of panic happens.

Huh? How?

To prove "panic" he then leaps to a screenshot someone posted to Twitter of a money request email he generated. However,

a) It's not clear whether this was sent via the coinbase money request feature or whether it was spoofed (or why it would even need to be spoofed).

b) It doesn't even show usage of a firstname or lastname to "assist" in the spoofing.. which was the whole point of the bug report.

So it remains to be demonstrated how the exposure of firstname/lastname could be exploited to significantly assist phishing, especially when weighed against the other design tradeoffs -- like accidentally irreversibly sending money to the wrong person.

The lack of responsiveness to the whitehat email is the bigger problem here, but now that they've joined HackerOne perhaps that will improve.

Re: Coinbase design allows for mass, targeted phishing of its users

#42

Post by nwh »

danielweber wrote: post #24
nwh wrote: post #15

Earlier quoted context omitted.

What do rate limit by? There's billions of IP addresses a spammer could use, captchas can be solved by offshore farms, there's almost nothing to go by.

Lots of small businesses are perfectly happy to lock out foreign IP addresses on the slightest breeze, and it's probably a good result because for those businesses 1000 out of 1000 requests from the Eastern Hemisphere are hostile.

Assuming malicious requests come from other countries would be foolhardy.

Re: Coinbase design allows for mass, targeted phishing of its users

#43

Post by zwily »

rdl wrote: post #32

Ever so slight mitigation of this is that Coinbase uses SPF, but they use SPF with a fairly open list (just phish via Amazon SES, Mailgun, etc.). So phishing mail has some chance of getting marked down as spam by recipients if you make it appear to be from coinbase.com. I'd probably go all-out and send from coinbasemail.com though.

To phish via SES, you'd have to get coinbase.com as a verified domain, which mean you'd need DNS access. I assume the same is true of other email providers.

Re: Coinbase design allows for mass, targeted phishing of its users

#44

Post by infosec-au »

abalone wrote: post #41

Meh, this is an extremely poor bug report despite the super-serious introductory tone. The "proof of concept" makes no sense. Quoting: 1. Scrape email addresses from bitcoin related websites, and organise them into a large list. This has nothing to do with Coinbase. 2. Test for emails which are actual Coinbase accounts, and extract their First and Last names, associated to the emails. Ok... 3. All sorts of panic happ…

The actual bug report is the technical section of my blog post:

http://blog.shubh.am/full-disclosure-coinbase-security/#tech...

You're reading the Proof of Concept, which is meant to be a practical demonstration of how once could use the bug to their advantage. I didn't document the proof of concept in detail, to ensure that others couldn't easily use the blog post as a guide to harvesting Coinbase emails.

If you want the full, technical bug report, please visit: http://shubh.am/bugs/coinbase.htm

Re: Coinbase design allows for mass, targeted phishing of its users

#45

Post by homakov »

There's another bug when you can substitute coinbase's iframe with your own, when you use coinbase button. This iframe can ask for username / password, and there's no way for user to distinguish fake iframe from real. They also not into replying emails on their whitehat@ address.

Re: Coinbase design allows for mass, targeted phishing of its users

#46

Post by sillysaurus3 »

kochb wrote: post #26
300bps wrote: post #4

This is obviously a serious issue. One way to mitigate it is to use email addresses that have specific purposes. firstinitiallastname@gmail.com is my "public" email address that is used for friends and what not. genericemail@gmail.com is the email address I use for many retail sites. I then have an email address dedicated to each commonly used site (Amazon, Coinbase, etc). I also have Google two-factor authentication…

Why so many accounts? You can use the "jsmith+coinbase@gmail.com" syntax to get a unique email address for each service. Two factor auth drastically frustrates an account hijack, so you're gaining almost nothing by separating them.

I gave up on that long ago because few sites actually allow the foo+bar@email.com syntax. + seems to be disallowed by most regex filters.

Re: Coinbase design allows for mass, targeted phishing of its users

#47

Post by alirazaq »

larrys wrote: post #19

As someone who studies human nature I'd like to ask this question of the OP and anyone else who cares to answer. I'd seriously like to know this. Why do people spend extensive time [1] documenting security flaws like this [2] and going to the trouble of informing the company. And then if that doesn't work take more time to write up a blog post to get the info out? What do they gain by doing so exactly? Is this a play…

He's just upset there was no reward given to him and is blowing this thing out of proportion.

Re: Coinbase design allows for mass, targeted phishing of its users

#48

Post by MichaelGG »

abalone wrote: post #41

Meh, this is an extremely poor bug report despite the super-serious introductory tone. The "proof of concept" makes no sense. Quoting: 1. Scrape email addresses from bitcoin related websites, and organise them into a large list. This has nothing to do with Coinbase. 2. Test for emails which are actual Coinbase accounts, and extract their First and Last names, associated to the emails. Ok... 3. All sorts of panic happ…

The author does spend a LOT of effort writing stuff (and showing a silly gif) to basically say "requests aren't rate limited, can disclose existence of user and full name if email is known".

Coinbase responded to him on the 25th[1]:

"We've spent some time considering the implications of this behavior and have built this intentionally. The benefits to obscuring this information is minimal and, in our opinion, not worth the additional friction alternative flows would introduce"

Anyone can signup on Coinbase, right? So even if they did add some rate limiting, unless it was severe (or required a verified account), attackers would just sign up for more accounts.

1: http://shubh.am/bugs/coinbase.htm

Edit: I also like this part of their response: "Furthermore, it's not necessary to use "Burp Suite Intruder" in the manner demonstrated here. The functionality is exposed more directly in an intentional fashion over our API"

https://hackerone.com/reports/5200

Re: Coinbase design allows for mass, targeted phishing of its users

#49

Post by abalone »

infosec-au wrote: post #44
abalone wrote: post #41

Meh, this is an extremely poor bug report despite the super-serious introductory tone. The "proof of concept" makes no sense. Quoting: 1. Scrape email addresses from bitcoin related websites, and organise them into a large list. This has nothing to do with Coinbase. 2. Test for emails which are actual Coinbase accounts, and extract their First and Last names, associated to the emails. Ok... 3. All sorts of panic happ…

The actual bug report is the technical section of my blog post: http://blog.shubh.am/full-disclosure-coinbase-security/#tech... You're reading the Proof of Concept, which is meant to be a practical demonstration of how once could use the bug to their advantage. I didn't document the proof of concept in detail, to ensure that others couldn't easily use the blog post as a guide to harvesting Coinbase emails. If you wan…

The "full, technical" report doesn't offer any new information. It just shows how to get the firstname and lastname.

The PoC does not at all demonstrate how the alleged bug could be used by phishers to their advantage.. it doesn't even show usage of the firstname or lastname! That makes it incoherent.

Re: Coinbase design allows for mass, targeted phishing of its users

#50

Post by MichaelGG »

pbreit wrote: post #27

Divulging a name when presented with an email address is pretty bad and I'm not sure why it would be necessary. Just confirming that an email address is in the system is fairly minor.

Coinbase says the name is optional, so only people that chose to share their name are affected.
Post reply on HN