4 ms·
The title and article are hyperbole. I tried it myself, as did a few other people who commented on the article. After a few attempts you can no longer use a PI
by dsl 14y ago
The title and article are hyperbole. I tried it myself, as did a few other people who commented on the article.
After a few attempts you can no longer use a PIN and must call in or use your security question.
- kevinburke 14y agoNot sure what you tried, but they haven't fixed the problem. I just tried 100 different random 6-digit passwords using a python script over a one minute interval, then logged in to my account just fine using the web interface. I'd post my code, but that would let any idiot figure out how to replicate this attack. Try including a user agent, and not using the same cookies every time.
- thechut 14y agoI say post the code. That would really light the fire under Virgin's ass. Any person nefarious enough to perform the attack is probably smart enough to figure it out anyway.
- kevinburke 14y agoNo thanks... that would cross the line between full disclosure and malice. It should be trivial for anyone who understands HTTP and threads to reimplement.
- rquirk 14y agoI really hope that Virgin are not stupid enough to go after you in some lawyery way over this. I think you are already running a risk by disclosing this at all. The usual next step when a company doesn't show willingness to fix a security problem is that they try and shoot the messenger :-(
- SideburnsOfDoom 14y agoIt should be trivial for anyone who understands HTTP and a for loop to reimplement.
- phildeschaine 14y agoIt appears they are still clueless about how the internet works. https://twitter.com/VirginMobileAus/status/247958119966208000 https://twitter.com/VirginMobileAus/status/24795811996620800...
- ZoFreX 14y agoThis is perhaps the best false promise corp-speak I've heard in relation to an exploit: > any word on supporting longer passwords eventually? > Nothing as of right now but it's something we may definitely look into in the future. Thanks, Shane. "May definitely"?
- spullara 14y agoThey are probably keeping it in a cookie for expediency.
- Swifty 14y agoAfter reading down a few comments on the article you see that the write is talking about Virgin Mobile in the UAS, as someone in Australia points out that this doesn't work. It would be nice if the writer of the article would have said that they where talking about Virgin Mobile US, as Virgin Mobile are a multi national company.