Finding vulnerable Twitter accounts with expired domains
1–10 of 128 posts
Re: Finding vulnerable Twitter accounts with expired domains
#2What would be a universal solution to this problem? The only thing I can really think of is platforms not allowing custom domains for connected email accounts, but that seems sub-optimal.
Re: Finding vulnerable Twitter accounts with expired domains
#3This was a common way to harvest 6-digit ICQ numbers back in the day. Hotmail, MSN etc. had expiring email addresses as well that you could register to reset the password to the ICQ number.
Re: Finding vulnerable Twitter accounts with expired domains
#4What would be a universal solution to this problem? The only thing I can really think of is platforms not allowing custom domains for connected email accounts, but that seems sub-optimal.
If you deliver email to a customer and you notice that it bounces, any account security flows requiring access to that email should be disabled. Additionally, you should never show the full email address or phone number that is being used for an auth challenge. Nonetheless, those defenses will eventually be compromised.
Beyond that, it is not a company problem IMO. One of the most common uses for custom domains is custom email addresses. If a website prevented me from using it, as you propose, I would be flabbergasted.
Re: Finding vulnerable Twitter accounts with expired domains
#5What would be a universal solution to this problem? The only thing I can really think of is platforms not allowing custom domains for connected email accounts, but that seems sub-optimal.
On the user-side, using private email relays (i.e. Apple's Hide My Email, AnonAddy, etc) mostly eliminates this issue.
Re: Finding vulnerable Twitter accounts with expired domains
#6What would be a universal solution to this problem? The only thing I can really think of is platforms not allowing custom domains for connected email accounts, but that seems sub-optimal.
cronjob to regularly check if the domain is expired/up for sale? The service "has this domain changed owners in a way it's relevant for logins" could even be turned into a SAAS startup... later to be extended to individual accounts (someone deletes e-mail acct, cancels phone plan, etc. then a new person creates a new one with just that name) One could strike contracts with all the e-mail providers and phone networks to tell via API when this happens and then send the info to services that use those accounts.
Re: Finding vulnerable Twitter accounts with expired domains
#7What would be a universal solution to this problem? The only thing I can really think of is platforms not allowing custom domains for connected email accounts, but that seems sub-optimal.
What does "custom domain for connected email accounts" mean? Isn't every domain custom? Do you mean anything that isn't @gmail.com?
Re: Finding vulnerable Twitter accounts with expired domains
#8What would be a universal solution to this problem? The only thing I can really think of is platforms not allowing custom domains for connected email accounts, but that seems sub-optimal.
cronjob to regularly check if the domain is expired/up for sale? The service "has this domain changed owners in a way it's relevant for logins" could even be turned into a SAAS startup... later to be extended to individual accounts (someone deletes e-mail acct, cancels phone plan, etc. then a new person creates a new one with just that name) One could strike contracts with all the e-mail providers and phone networks…
What would you do in this situation though? People still need to be able to reset their own passwords. And some accounts don't have any other means of contact. It's extremely common to only have an email address and a password.
Re: Finding vulnerable Twitter accounts with expired domains
#9> This attack can potentially be executed on other platforms besides Twitter, assuming one can find a similar discovery method
You don’t need another discovery method after you take their Twitter account and email :)
Only for targets not on twitter.
My point is that Twitter is probably enough.
But if you really just want to compare domain names that are expiring to email addresses, you can just use one of those business bots that spammers, recruiters and sales people use, and just check emails in their database to domains expiring.
Re: Finding vulnerable Twitter accounts with expired domains
#10Even though they show the starred email address and one of the suggestions is not to show the email, I really hope people don't do that.
There is nothing more frustrating when you're recovering your password and the site says we have sent you an email with no hint where and even worse sometimes they say "if that email was in our records then you should get the link" and you're wondering did that work and #1 worst is after making me solve 10 traffic lights and zebra crossings.
Because at that moment I feel it's just easier to start over and create a new account.