5 ms·

Nomx Passes Security Tests After Blogger Claims to Have Penetrated Nomx

56 points by mynewtb 9y ago

nezza-_- 9y ago
This is a perfect guide on how to not respond to the release of a security researcher. Also, for context, here is the original article from the security researcher: https://scotthelme.co.uk/nomx-the-worlds-most-secure-communications-protocol/ https://scotthelme.co.uk/nomx-the-worlds-most-secure-communi...
- j_s 9y ago
  Discussed here yesterday: https://news.ycombinator.com/item?id=14209874 https://news.ycombinator.com/item?id=14209874
  - floatboth 9y ago
    Hahaha the best thing is how, because the admin panel is not HTTPS, the researcher's browser literally says "Not secure" :D
- darklajid 9y ago
  Given HOW broken the setup was (it wasn't even a remotely decent mail server setup in the first place, let alone 'the only secure solution' of course), what did we expect? The marketing material was already screaming snake oil. Now they're trying to put out the fire with .. more snake oil, avoiding any specifics related to the original criticism. Sad. Absolutely expected, but sad nonetheless.
  - tgragnato 9y ago
    > as we’ve demonstrated to the blogger, the media and our customers There's no demonstration, and they can't know if a customer has been compromised or not. Selling snake oil is .. well, let's say despicable; but clearly lying when exposed is perhaps even worse. I expect the decency to be silent, please.
coldcode 9y ago
I once worked for a HIPAA controlled healthcare company and complained about their security when I found out all the production database and server passwords were stored in a text file available to most of the company. Their defense was "we passed our security audits so it's ok."
- resonanttoe 9y ago
  Security Vs. Compliance operating at it's finest there :P
- unhinged_wanker 9y ago
  Maybe most of the company had approved need to access? I mean, I wouldn't put $1 on that being true, but hey, infinite universe and all.
brilliantcode 9y ago
This seems like a bad PR move. Now there's serious questions about the validity of the claims. I've never heard of Nomx but this really should not be how you should introduce your product by claiming it's safe and you should just believe the website.
j0hnM1st 9y ago
HN front page on 2 days on a row, BBC - looks like not even Apple can't manage to pull of such PR !
- resonanttoe 9y ago
  Apple learnt that gasoline is terrible for putting out fires.
MrZeus 9y ago
I wonder why Nomx don't have a Comments section at the bottom of their rebuttal... >:-D
mike-cardwell 9y ago
They've basically put a message on their front page which says: "Look everybody! We don't know what the hell we're doing and here's the proof!" Even people who don't understand the initial report are going to get suspicious and Google this.
- MichaelGG 9y ago
  I'm guessing they've already selected the least suspicious customers. This is basically the best response they can create. They have no real product and no defense, so just reiterating the product is fantastic is all they need to do.
strictnein 9y ago
Floating around infosec Twitter last night: https://pbs.twimg.com/media/C-cMZg5VoAAcz24.jpg https://pbs.twimg.com/media/C-cMZg5VoAAcz24.jpg
j_s 9y ago
"Security" through obscurity vs. the spotlight of the BBC! Both sides are pretty much true: the simplistic proof-of-concept XSS requires the target device's internal IP address. This product winds up accomplishing its intended purpose simply because of how few active users it has. It is unfortunate the takeaway from the initial post was a "works on my machine" XSS attack rather than emphasizing that there is only one widely shared public/private key pair "securing" all communication all of the devices. There is plenty of precedent demonstrating that not-private private keys is a serious issue eg. https://isc.sans.edu/diary/22076 https://isc.sans.edu/diary/22076 Speculatively, all that old software is a juicy target as well (obscured by ARM vs. x86). However, since the security researcher appears to specialize most in XSS that wound up in the spotlight. I'm most curious about how this person was selected by the BBC to review the device. Imagine if Matthew Garrett had done it!
- MichaelGG 9y ago
  It publishes the internal IP address in public DNS under localmail.domain.
  - j_s 9y ago
    Nice, I missed that in the big list at the end! That should have allowed the security researcher to make significant progress in the bogus security test with ease. [Edit: Didn't see this before; thanks!]
- pritambaral 9y ago
  Where are you getting that the takeaway was an XSS attack? There's a whole host of things wrong that the researcher finds — it almost reads like a how-to of bad security. When you say: > However, since the security researcher appears to specialize most in XSS that wound up in the spotlight. It seems like you haven't read the original report. The researcher does NOT specialize in XSS (can one?), and is even lent a hand at the XSS portion. Here, read the original: https://scotthelme.co.uk/nomx-the-worlds-most-secure-communications-protocol/ https://scotthelme.co.uk/nomx-the-worlds-most-secure-communi...
thrillgore 9y ago
At this point I don't think anything positive of Nomx.
CodeWriter23 9y ago
They (and a few here) are missing the key point. I'll refer everyone to the passage "One Good Thing" in Helme's article, just above the disclosure timeline. The product does not create an MX record for the email server, hence it is a write-only system. You can't receive email without an MX record because no sender can locate your MTA. I don't care how secure it may or may not be, it's still useless to me.
- zaroth 9y ago
  Technically, MX are not mandatory. As per RFC2821, if no MX is found the A record will be used. In the past I used this fact regularly when obtaining SSL certificates for subdomains that were pointed at my server. Customer "foo.com" would point app.foo.com at my server for me to host my service for them on their subdomain. To obtain an SSL certificate, I would select email validation to admin@app.foo.com and not need an MX record in the customer's DNS system in order to receive the email, it would be delivered purely based on the A record pointing to my server.
wjh_ 9y ago
Stands in burning building "Our fire protection systems passed all tests, nothing is wrong."
borplk 9y ago
What a joke.
angry_octet 9y ago
This is a very poor article title, at best it could be 'Nomx rejects vulnerability report, claims to be secure.'

56 points by mynewtb 9y ago

This is a perfect guide on how to not respond to the release of a security researcher. Also, for context, here is the original article from the security researcher: https://scotthelme.co.uk/nomx-the-worlds-most-secure-communications-protocol/ https://scotthelme.co.uk/nomx-the-worlds-most-secure-communi...

j_s 9y ago
Discussed here yesterday: https://news.ycombinator.com/item?id=14209874 https://news.ycombinator.com/item?id=14209874
- floatboth 9y ago
  Hahaha the best thing is how, because the admin panel is not HTTPS, the researcher's browser literally says "Not secure" :D
darklajid 9y ago
Given HOW broken the setup was (it wasn't even a remotely decent mail server setup in the first place, let alone 'the only secure solution' of course), what did we expect? The marketing material was already screaming snake oil. Now they're trying to put out the fire with .. more snake oil, avoiding any specifics related to the original criticism. Sad. Absolutely expected, but sad nonetheless.
- tgragnato 9y ago
  > as we’ve demonstrated to the blogger, the media and our customers There's no demonstration, and they can't know if a customer has been compromised or not. Selling snake oil is .. well, let's say despicable; but clearly lying when exposed is perhaps even worse. I expect the decency to be silent, please.

coldcode 9y ago

I once worked for a HIPAA controlled healthcare company and complained about their security when I found out all the production database and server passwords were stored in a text file available to most of the company. Their defense was "we passed our security audits so it's ok."

resonanttoe 9y ago
Security Vs. Compliance operating at it's finest there :P
unhinged_wanker 9y ago
Maybe most of the company had approved need to access? I mean, I wouldn't put $1 on that being true, but hey, infinite universe and all.

brilliantcode 9y ago

This seems like a bad PR move. Now there's serious questions about the validity of the claims. I've never heard of Nomx but this really should not be how you should introduce your product by claiming it's safe and you should just believe the website.

j0hnM1st 9y ago

HN front page on 2 days on a row, BBC - looks like not even Apple can't manage to pull of such PR !

resonanttoe 9y ago
Apple learnt that gasoline is terrible for putting out fires.

MrZeus 9y ago

I wonder why Nomx don't have a Comments section at the bottom of their rebuttal... >:-D

mike-cardwell 9y ago

They've basically put a message on their front page which says: "Look everybody! We don't know what the hell we're doing and here's the proof!" Even people who don't understand the initial report are going to get suspicious and Google this.

MichaelGG 9y ago
I'm guessing they've already selected the least suspicious customers. This is basically the best response they can create. They have no real product and no defense, so just reiterating the product is fantastic is all they need to do.

strictnein 9y ago

Floating around infosec Twitter last night: https://pbs.twimg.com/media/C-cMZg5VoAAcz24.jpg https://pbs.twimg.com/media/C-cMZg5VoAAcz24.jpg

j_s 9y ago

"Security" through obscurity vs. the spotlight of the BBC! Both sides are pretty much true: the simplistic proof-of-concept XSS requires the target device's internal IP address. This product winds up accomplishing its intended purpose simply because of how few active users it has. It is unfortunate the takeaway from the initial post was a "works on my machine" XSS attack rather than emphasizing that there is only one widely shared public/private key pair "securing" all communication all of the devices. There is plenty of precedent demonstrating that not-private private keys is a serious issue eg. https://isc.sans.edu/diary/22076 https://isc.sans.edu/diary/22076 Speculatively, all that old software is a juicy target as well (obscured by ARM vs. x86). However, since the security researcher appears to specialize most in XSS that wound up in the spotlight. I'm most curious about how this person was selected by the BBC to review the device. Imagine if Matthew Garrett had done it!

MichaelGG 9y ago
It publishes the internal IP address in public DNS under localmail.domain.
- j_s 9y ago
  Nice, I missed that in the big list at the end! That should have allowed the security researcher to make significant progress in the bogus security test with ease. [Edit: Didn't see this before; thanks!]
pritambaral 9y ago
Where are you getting that the takeaway was an XSS attack? There's a whole host of things wrong that the researcher finds — it almost reads like a how-to of bad security. When you say: > However, since the security researcher appears to specialize most in XSS that wound up in the spotlight. It seems like you haven't read the original report. The researcher does NOT specialize in XSS (can one?), and is even lent a hand at the XSS portion. Here, read the original: https://scotthelme.co.uk/nomx-the-worlds-most-secure-communications-protocol/ https://scotthelme.co.uk/nomx-the-worlds-most-secure-communi...

thrillgore 9y ago

At this point I don't think anything positive of Nomx.

CodeWriter23 9y ago

They (and a few here) are missing the key point. I'll refer everyone to the passage "One Good Thing" in Helme's article, just above the disclosure timeline. The product does not create an MX record for the email server, hence it is a write-only system. You can't receive email without an MX record because no sender can locate your MTA. I don't care how secure it may or may not be, it's still useless to me.

zaroth 9y ago
Technically, MX are not mandatory. As per RFC2821, if no MX is found the A record will be used. In the past I used this fact regularly when obtaining SSL certificates for subdomains that were pointed at my server. Customer "foo.com" would point app.foo.com at my server for me to host my service for them on their subdomain. To obtain an SSL certificate, I would select email validation to admin@app.foo.com and not need an MX record in the customer's DNS system in order to receive the email, it would be delivered purely based on the A record pointing to my server.

wjh_ 9y ago

Stands in burning building "Our fire protection systems passed all tests, nothing is wrong."

borplk 9y ago

What a joke.

angry_octet 9y ago

This is a very poor article title, at best it could be 'Nomx rejects vulnerability report, claims to be secure.'