4 ms·
This is out of my field, but how do you all think this will be compromised? My guess would be by spoofing the CEO's home IP & cookie to bypass the verification
by qeorge 17y ago
This is out of my field, but how do you all think this will be compromised?
My guess would be by spoofing the CEO's home IP & cookie to bypass the verification, based on this paragraph from the site:
"Plus, users only need to receive a verification call when they are logging in from an unrecognized computer. When logging in from a home or work computer, a cookie can be stored so that no verification call is required."
Does that seem like a big hole to anyone else?
- zkz 17y agoAlso people have cracked telephonic networks in the past. Why can't they do it again?
- qeorge 17y agoDefinitely. I read recently that a certain model of Nokia from a certain German factory are in high demand because they make it so easy to clone numbers. So I'd imagine cloning the number is one way through, but I wonder if there's not an even simpler way in.
- icey 17y agoIf it were me, I'd probably go to work on the database that stored the phone numbers first.
- nuclear_eclipse 17y agoAssuming that they use a strong enough cookie (eg, containing a randomized unique key that's verified by the server) and all connections are made over SSL, it should basically be as resistant to remote attack as the person's cellphone (eg, SIM chip spoofing to get two cells on the network under the same call number). I say that here, the weak points are the user and the cellphone; I think that the barriers to usage that the site sets up will most likely deter all but the most paranoid users from using it.
- tptacek 17y agoUnless you're incompetant, cookies aren't compromised by guessing them or by scooping them off the wire. They're compromised by cross-site scripting and XSRF attacks.
- nuclear_eclipse 17y agoI know XSS and CSRF are security issues for the attacked site (had to deal with that stuff with MantisBT somewhat recently), but can you enlighten on how XSS or CSRF can compromise your cookies for a third party site? I didn't realize that was possible.
- amalcon 17y agoThis is basically the same thing as MobilePass, which hasn't been broken to my knowledge, so I wouldn't expect a direct attack. Your suggestion is a possibility. There are also a bunch of unknowns. Are there any direct attacks (SQL injection, privilege escalation, etc) on the StrongWebmail site? What sort of datacenter is it in (alchemy.net, which are HIPAA compliant, which should be pretty safe)? Are the challenges generated in a cryptographically secure manner? How secure is the CEO's home machine? Does the CEO purge cookies at the end of the session? Does it count if I can manage to redirect his e-mail elsewhere instead (which can be done with well-known DNS exploits)? Part of the defense here is that the prize is small enough that it's not worth trying many of the more elaborate tricks (like attempting to break the PRNG for the keys, if any).
- spc476 17y agoInteresting idea, instead of attacking StrongEmail itself, you target the CEO's ISP. If this is legit, I could see some network engineer at the CEO's ISP making a few routing changes, logging in (since from the text, it appears that the IP would be allowed, and a re-login would be required since the proper cookies aren't being presented) to claim the $10,000 prize, then fixing the routing changes.