3 ms·

How I Would Try to Hack Your Mint.com Account

22 points by jowens 16y ago

rdamico 16y ago
Great article. It seems that simply using Gmail over SSL would mitigate the email-related issues here, no?
- macrael 16y ago
  Absolutely. And, I can't think of any email service that sends passwords in clear text. I'm not convinced it is this easy to compromise someone's email account.
  - jowens 16y ago
    What I was thinking about was someone using say POP and a client like Thunderbird. The POP traffic by default is clear-text, so when you send your password to the server, it's in the clear unless you're either tunneling your traffic or going to a secure port to your ISPs mail server.
    - For_Iconoclasm 16y ago
      This is sadly true. I cannot connect to my school's e-mail service with either of the security schemes provided by Thunderbird (SSL, TLS, or STARTTLS). The trade-off is a nice program versus a secure connection. I'm not exactly concerned about the security of my school account, but it could potentially suck to have it compromised.
jrockway 16y ago
What's the value of hacking my Mint.com account? Learning where I bank so that you can send me phishing emails? (Downmodded? Last time I checked, there's no "transfer all my money to an offshore bank account" button, nor are the passwords to the linked sites available. So while annoying that some dude on the Internet can see that you have lunch at McDonalds every day, it's not going to cost you any money.)
- rdl 16y ago
  The main value would be in finding other accounts to attack (some of which might have known weak security). Also, if I stole a credit card, seeing what purchases someone has made in the past would let you make a larger number of future purchases without getting the card blocked. Hacking email account still seems to be one of the best rewards for lowest difficulty.
- Confusion 16y ago
  Downmodded? Please, wait a few hours before complaining about that and providing additional explanations. It usually evens out.
- cookiecaper 16y ago
  There probably wouldn't be much utility in doing this to some random stranger, but it could be useful if you were trying to blackmail or embarrass someone. For instance, say that you're a senator and you've made some enemies. If these enemies could log in to your account, they could reveal some "suspicious charges" from an escort or pornography service, or perhaps they'd notice some large expenditures on airfare and travel when you were supposedly just off for a weekend hike (Mark Sanborn). All of these things are bad. That's a prominent example, but the same could be done to anyone you wanted some leverage against, be it a teacher, supervisor, or anyone else. Yes, it'd be ideal if people didn't do things that destroy their careers and/or families in the first place, but often times that's not how people work.
  - hugh3 16y ago
    So it's only the same amount of damage that you could do by stealing my mail and going through my bank statements. You'd probably do far better at embarrassing someone by going through their email, which is a necessary step for several of these methods.
- eds 16y ago
  Last time I pulled my credit report, the security questions included "Choose which of the following is true: you have an account at XXX Bank / you have a loan in the amount of $YYY at ZZZ Bank / etc." Yes, some other information was required too, and no, I don't know what good a credit report does you either.
shalmanese 16y ago
Eh, the amount of ways anyone could hack anything is so much staggeringly larger than the amount of times people actually end up getting hacked. Pointing out one specific flaw in one specific service is about as useful & damaging as pondering new theoretical ways terrorists could strike the US.

22 points by jowens 16y ago

rdamico 16y ago

Great article. It seems that simply using Gmail over SSL would mitigate the email-related issues here, no?

macrael 16y ago
Absolutely. And, I can't think of any email service that sends passwords in clear text. I'm not convinced it is this easy to compromise someone's email account.
- jowens 16y ago
  What I was thinking about was someone using say POP and a client like Thunderbird. The POP traffic by default is clear-text, so when you send your password to the server, it's in the clear unless you're either tunneling your traffic or going to a secure port to your ISPs mail server.
  - For_Iconoclasm 16y ago
    This is sadly true. I cannot connect to my school's e-mail service with either of the security schemes provided by Thunderbird (SSL, TLS, or STARTTLS). The trade-off is a nice program versus a secure connection. I'm not exactly concerned about the security of my school account, but it could potentially suck to have it compromised.

jrockway 16y ago

What's the value of hacking my Mint.com account? Learning where I bank so that you can send me phishing emails? (Downmodded? Last time I checked, there's no "transfer all my money to an offshore bank account" button, nor are the passwords to the linked sites available. So while annoying that some dude on the Internet can see that you have lunch at McDonalds every day, it's not going to cost you any money.)

rdl 16y ago
The main value would be in finding other accounts to attack (some of which might have known weak security). Also, if I stole a credit card, seeing what purchases someone has made in the past would let you make a larger number of future purchases without getting the card blocked. Hacking email account still seems to be one of the best rewards for lowest difficulty.
Confusion 16y ago
Downmodded? Please, wait a few hours before complaining about that and providing additional explanations. It usually evens out.
cookiecaper 16y ago
There probably wouldn't be much utility in doing this to some random stranger, but it could be useful if you were trying to blackmail or embarrass someone. For instance, say that you're a senator and you've made some enemies. If these enemies could log in to your account, they could reveal some "suspicious charges" from an escort or pornography service, or perhaps they'd notice some large expenditures on airfare and travel when you were supposedly just off for a weekend hike (Mark Sanborn). All of these things are bad. That's a prominent example, but the same could be done to anyone you wanted some leverage against, be it a teacher, supervisor, or anyone else. Yes, it'd be ideal if people didn't do things that destroy their careers and/or families in the first place, but often times that's not how people work.
- hugh3 16y ago
  So it's only the same amount of damage that you could do by stealing my mail and going through my bank statements. You'd probably do far better at embarrassing someone by going through their email, which is a necessary step for several of these methods.
eds 16y ago
Last time I pulled my credit report, the security questions included "Choose which of the following is true: you have an account at XXX Bank / you have a loan in the amount of $YYY at ZZZ Bank / etc." Yes, some other information was required too, and no, I don't know what good a credit report does you either.

shalmanese 16y ago

Eh, the amount of ways anyone could hack anything is so much staggeringly larger than the amount of times people actually end up getting hacked. Pointing out one specific flaw in one specific service is about as useful & damaging as pondering new theoretical ways terrorists could strike the US.