Slashdot Mirror
Even My Mom Could Hack These Sites
I figured that if I wrote to them saying "I forgot my password, please mail it to me," that would be too obvious. Instead, at the time I had set up shop with these hosting companies, I entered a domain name at the time of creating my account, and asked them to register it on my behalf (long before I had this experiment in mind). Then when I wrote to them recently from my Hotmail address, I sent each of them a message saying: I need to transfer this domain somewhere else, can you give me the login at the registrar where you registered the domain, so I can change the domain settings. Five of the ten companies either (a) gave me the registrar login, (b) transferred the domain to my registrar account on request (even though I never provided any proof that the owner of that registrar account was really me, either), or (c) changed the domain to point to a new IP address that I specified -- all of which, of course, would allow an attacker to take over a site temporarily or even permanently, if it hadn't really been me writing from the Hotmail address.
But slow down before you go off to try this out on Yahoo, eBay or Google hoping to get the same 50% success rate. First, these were all low-budget hosting companies, so the people handling my queries were likely not highly trained professionals who would have developed all the right habits about when to get suspicious. Second, this ruse only worked because the hosting companies registered the domains on my behalf. Most sites that are really worth taking over, are hosted on dedicated servers, and this trick wouldn't work on a dedicated hosting company because they usually don't register domains on behalf of customers; they assume that anybody buying an expensive dedicated server, knows enough to buy the domain and point it at the server that the company gives them.
But even for small-time hosting, a 50% success rate for a trick like this is uncomfortably high. So what can we do about it? Well, every problem has a non-solution that requires changing human nature ("People should just stop buying from spammers and they'd go out of business!") and a non-solution that ignores the economics of the situation ("ISPs should devote more resources to stopping spammers on their own network!"). In this case, the corresponding non-solutions would be (a) "People who work for hosting companies should be less gullible" and (b) "ISPs should hire smarter people, without charging more to their hosting customers".
The solution that doesn't require any cheating, though, is to have procedures in place for anything remotely security-related, and drum into employees' heads that they have to follow those procedures. Here's some good news: Of the five companies that fell for the ruse asking for my registrar login information, when I followed up with them saying "Hey, I forgot my account password, can you mail it to me", only two of them actually sent my password to the Hotmail account. To those two, I replied with some terse words about having a six-inch-thick steel door while leaving the window wide open. But at least it was only two out of ten that fell for that ruse, compared to five out of ten that fell for the registrar trick. The difference is that hosting companies have procedures in place to deal with password resets -- a script that sends the existing password, or sends a reset-password link, only to the customer's e-mail address on file.
Similarly, any hosting company that registers domains on behalf of users, should have procedures in place for transferring the domains to users or letting them change domain settings. In fact, of the five companies that didn't fall for the ruse, most of them said "Go to the customer control panel here and log in" -- it wasn't that their guard went up because I was writing from a Hotmail account, it was that they already had procedures in place for a customer wanting to change domain settings, and what's what the idiot-proof book told them to do. Kevin Mitnick always said that the weakest link in any security chain was people. Sometimes the way for ISPs to tighten security is to make the people in the chain act more like machines.
Until then, there are probably many sites out there that are this easy to "hack", using a method that could charitably be called low-tech. After seeing which hosting companies fell for the trick, I pointed out that they had sent the login information to an unverified address and admonished them to be more careful in the future, but I didn't storm out vowing to take all of my business elsewhere -- after all, if 50% of all low-budget hosting companies out there fall for this, what would be the point?
One cannot conclude from the small sample size that 50% of all small, low-budget hosting companies are not security-conscious. Further, if you want to motivate these insecure companies to change their behavior, voting with your feet by taking your business elsewhere is the correct behavior.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
for various reasons, i think passwords should be stored in hashed format. it should be impossible for the hosting company to tell me my password. they should just reset it.
of these three options: Cheap, Fast, Secure.
I try this with every new company we utilize through work. I call from a variety of numbers, including the one registered, my cell phone, and my home phone. I call, giving them only the company name and claim to be "new". If they get suspicious, I tell them the entire IT staff was fired and I'm their replacement and the old staff wouldn't give anyone details about accounts. The social engineering aspects are insanely easy. A few want a fax sent on company letterhead. Any idea how easy it is to fake letterhead through fax? Even a postal letter is easily faked. I remove our liability, or at least reduce it, with companies like this. It takes maybe 10-15 minutes for each company -- give a try sometime.
For more fun, forge your from: and reply-to: headers. Attach an empty file called signature.asc. Or make it appear to have been sent from a Blackberry, with a fake tag line "Sent via BlackBerry(r)" at the end. You could even go so far as to forge a "conversation" between 2 people which you are forwarding to make it look like the officers of the company authorized you dealing with the company.
I think part of the failure is that many IT workers have faced a similar situation: new job duties include trying to recover accounts/information from a disgruntled former employee.
What I've done with a few companies that we work with is given them a secret key to store in the account notes. I am the only one that knows the key. The other members of the board know the location to get the key, but not the key itself. Major account changes require the key. Along with the stored key there are detailed instructions about each and every external IT account in case something happens to me, or they wish to fire me. It's not flawless, but it's better than nothing.
a 50% success rate for a trick like this is uncomfortably high
It seems that the only thing "uncomfortably high" is the author. If real, a 50% failure rate is deplorable, to the point where it ought to have prompted some righteous moral outrage. This isn't just another intellectual exercise in social engineering, it's a failure of the system. It's equivalent to 5 out of 10 grocery stores accepting a check presented by someone not the account holder and with no signature on it. That sort of behavior wouldn't be socially tolerable, nor should this be.
If it is, in fact, a real event.
The author ought to be immediately forthcoming with the who, what, and when of his experiment if he really wants some serious consideration and feedback.
I can tell most people posting have never worked for a hosting company. The company I worked for did not have much information on clients to "test" them. We did require that they send us email from their original sign-up address. Here is the problem though. Often, an account would be setup by one employee sometimes in their own name for a company. That employee would them leave and the business would be stuck with no login and inaccurate account information. What do we do then? Of course they knew her name, but not much else. In the case of customers outside the US, we had a policy that we could not call them. So we had to take incoming calls or emails only. Sometimes the customer changed their contact address to their website. This means that if their email is not working, we could of course not receive an email from them about their account!
Obviously for many accounts, it is possible to get accurate, useful information. Then again, when a company views it that you are holding their website hostage they get a little upset too! We have several lawyers get froggy with us on behalf of their clients when we did try to verify things. Also, with so many hosting companies its a very cut throat business. Its hard to make money when you get $10 a month at best from most customers. That's less than most Internet access accounts.
Now if you pay verio through the roof for hosting they will go through quite a few steps to verify you are you but they won't keep spam off their network. I had an account with them a few years ago and they actually had an open relay setup. Anyone could impersonate your website and if you had an account, it was easy to enumerate the domains on the server your site was on. Some of this might be resolved with their costly VPS services, but its also resolved with a dedicated server you can lock down yourself too. These days I won't run anything on a server I do not control. I've also found that ISPs are much more careful with dedicated server or VPS account customers.
As far as listing companies, I think most people are scared of lawsuits these days. Since I happened to pick on my verio experience, I should be just as unfair to my own former employer. http://www.customweb.net/ (myeasyhost.com now i believe) There is something wrong with every hosting company. The trick is finding one that you can live with.
MidnightBSD: The BSD for Everyone
so I can check the veracity of this story.
Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
What truth?
There is no dupe
I have some serious doubts about the Truthiness(tm) of this article, just because in years of web business I've never met a serious fellow with 10 different hosting providers. A normal person would either pick one provider and pay for a large enough account to handle the 10 projects, or take the next step and get a dedicated server.
The author also suggests that small hosting companies have poorly-trained staff. That could not be any further from the truth. In most cases, small companies are run by one or more highly skilled techie entrepreneurs who know their clients well enough to avoid such security blunders. A large faceless company with dozens or even hundreds of employees is far more likely to have things slip through the cracks, and the staff hierarchy ensures that no single individual knows the whole story.
Take for example the world of Internet Service Providers. In a small, 3-man shop, when you call tech-support you're probably talking to a server administrator or network guru. In a big nationwide telecom, you're talking to an outsourcer who learned his "trade" six months ago during his job training and his primary source of information is the knowledge base and screenshots on his workstation.
Well here's a not-so-secret fact about hosting companies: they outsource their sales and support just like any other business. The bigger they are, the more likely you will be speaking with someone who has no idea who you are, what your server looks like and who is more afraid of their own supervisor than of you withdrawing your business. I was shopping for a cheap junky server a couple months ago and I dealt with 4-5 different hosting companies who were looking great, right up until their sales person dropped the ball out of either ignorance or laziness. Most of them were just human parking pages, no matter what I typed into the chat box, they'd simply return a list of links to their terms of service or FAQ. There's one particularly brilliant fellow who pointed me to a non-existent PDF file on their website, then took another 10 minutes to finally accept that I am not an idiot and if I say a link is 404, it's friggin 404. Many of them ended the conversation saying they would email me various documents or a contract, and none ever did. At one point I was even doubting my own mail server, since NONE of them were coming through on their promises.
The moral of this rant ? The world of web hosting is bursting with fraudsters, posers and imbeciles. I probably put in 30-40 hours of research before finally coming across a provider that suited my needs and budget, most of that time was wasted dealing with crooks and idiots. Here's a tip: go to a forum like webhostingtalk.com and have a chat with other hosting clients, read all the success and horror stories before throwing your money at a company you don't know. Make sure you know what you're getting into before signing anything.
-Billco, Fnarg.com
It's obvious that you're a C programmer, since a C++ programmer would have immediately recognized the difference between a class and an instance of that class.
It's funny though how if the poster had said "Even a [insert any race here] person could hack these sites" it would be a completely different kettle of fish that would probably see people fired and a national outcry over racism.
I'm not condoning racism, I'm just pointing out how much sexism is often seen as O.K. whereas racism is seen as an eternal evil. The line "As long as there's far more tech-savvy men than women, the generalization by assuming a gender serves a useful purpose" in particular would not go down well if made on racial rather than sexual grounds, despite probably being equally valid.
Really. Who has 10 different hosting companies to host "some of my websites"?
If this guy actually has 10 businesses or unique sites or whatever (unlikely), wouldn't you pick the one hosting service with the best service plan and just use it?
Well, we all know asians are good with computers, blacks steal them but don't know how to use them, and mexicans are too damned lazy to do anything with the ones they buy with the money they earn from working the jobs americans won't.
How was that?
Not a Twitter sockpuppet... but I wish I was.
How was that?
That was horribly offensive. As a white I feel very excluded.
Thank God for evolution.