Slashdot Mirror

← Back to Stories (view on slashdot.org)

Hackers Claim $10K Prize For StrongWebmail Breakin

Posted by Soulskill on from the worth-their-while dept.

alphadogg writes "Telesign, a provider of voice-based authentication software, challenged hackers to break into its StrongWebmail.com Web site late last week. The prize: $10,000. On Thursday, a group of security researchers claimed to have won the contest, which challenged hackers to break into the Web mail account of StrongWebmail CEO Darren Berkovitz and report back details from his June 26 calendar entry. The hackers, led by Secure Science Chief Scientist Lance James and security researchers Aviv Raff and Mike Bailey, provided details from Berkovitz's calendar to IDG News Service. In an interview, Berkovitz confirmed those details were from his account. However, Berkovitz could not confirm that the hackers had actually won the prize. He said he would need to check to confirm that the hackers had abided by the contest rules, adding, 'if someone did it, we'll kind of put our heads down.'"

45 of 193 comments (clear)

  1. Hu? by ae1294 · · Score: 5, Insightful

    Wait I'm confused??? They expected the hackers to follow rules?

    1. Re:Hu? by Allicorn · · Score: 4, Interesting

      I'm thinking - if the hackers actually bribed/tricked the CEO's PA into just telling them what what in the calendar record then the guy is going to try to weasel out of paying.

      --
      OMG!!! Ponies!!!
    2. Re:Hu? by Tubal-Cain · · Score: 3, Insightful

      I could understand if they don't want to pay up to someone that hacked something other than their software. Exploiting a Window bug may count if they are not cross-platform may count, but bribing the janitor probably doesn't. Yes, a real cracker may hack one of this product's customers that way, but Telesign couldn't be at fault for that.

    3. Re:Hu? by MrMista_B · · Score: 5, Insightful

      Social engineering is an perfectly valid and entirely effective method of hacking.

    4. Re:Hu? by XanC · · Score: 4, Insightful

      But it doesn't test their software.

    5. Re:Hu? by jesseck · · Score: 5, Informative

      While I agree that social engineering is a very legit way to hack a system, the terms of the challenge ( link here state that "You may not work with an employee, partner, or owner of StrongWebmail.com or any of its affiliates or partners to accomplish the email hack." Since this was StrongWebmail's contest, they make the rules. Even if the rules prevent a common method of hacking from taking place. On the other hand, people are quite often the weak link... by preventing the contestants from using this "easy" entry point (say, a janitor or secretary), they can test the technical system itself.

    6. Re:Hu? by ae1294 · · Score: 3, Insightful

      Honestly what I find extremely funny is that they already know they have a security problem and that these hackers have some sort of access.

      Are they really going to try and piss them off and not pay up?

    7. Re:Hu? by C18H27NO3+ · · Score: 4, Insightful

      agreed.
      In the real world I'm not going to care HOW my secret correspondence was hacked when they assured me it would never happen.
      "They got in through a vulnerability in our OS, but our software held up".
      "Someone in our company helped themselves/someone else to your mails, but our software held up".
      "Someone installed a trojan that compromised the authentication system, but our software held up".

      I understand perfectly what they are trying to achieve with this contest but they come off as sounding as if any other means of obtaining 'secure' information is beyond their liability when they state that it is the most secure webmail system out there.
      There are many different levels to security that need to be continually addressed yet they seem to think that as long as their little solo phone app doesn't get compromised then it's not really their fault.
      At least that's the way the rules and TFA sound.

    8. Re:Hu? by ta+bu+shi+da+yu · · Score: 4, Interesting

      Uh? According to NetworkWorld, "the IDG attack did not work initially, but succeeded when security software called NoScript was disabled on the Firefox browser, running on a Windows XP machine." wtf?

      --
      XML is like violence. If it doesn't solve the problem, use more.
    9. Re:Hu? by nine-times · · Score: 3, Insightful

      Why shouldn't bribing a janitor count? If I'm paying someone to call me every time I want to log into my email, then I'm probably pretty paranoid about security and don't want other people gaining access to my email. If security is so bad that random employees (including the janitor) can read my email, and those employees are so untrustworthy that they can be easily bribed, then that's just as real of a security problem as if their software were flawed.

      Security is often only as strong as its weakest point. If the point of this prize was to prove that your email is secure on their servers, then gaining unauthorized access to other people's email on their servers should be enough to claim the prize.

    10. Re:Hu? by Allicorn · · Score: 3, Insightful

      That wasn't the whole challenge. The challenge was to access an account on their allegedly super-secure webmail service. If the software is fairly solid but the staff are easily duped/bribed... how secure is the service?

      Even if social engineering alone resulted in getting access to the prize data, then the challenge has still been met: StrongWebmail.com - the service - is not secure.

      --
      OMG!!! Ponies!!!
    11. Re:Hu? by capnkr · · Score: 3, Informative
      FTFA (page 2, first paragraph):

      James said that these contests might be fun, but they don't provide a realistic measure of real security because they are encumbered with rules. The StrongWebmail contest prohibits working with a company insider, for example.

      --
      "...there are some things that can beat smartness and foresight. Awkwardness and stupidity can." ~ Mark Twain
    12. Re:Hu? by Tubal-Cain · · Score: 4, Interesting

      The hell it doesn't! If hackers can pay the janitor or other employee a few bucks to access the CEO's email then I wanna know that before I hand StrongWebmail $$$ to handle my email.

      That depends on what they are providing. If they are providing a hosting service of some sort, then bribing a janitor counts. If they are providing a system to be handled by the local network admins (that's the impression I get), then it shouldn't. The janitors there are not the janitors that will be around the customers servers.

    13. Re:Hu? by innocent_white_lamb · · Score: 2, Informative

      Your impression is wrong. I just looked at their website. They're offering a webmail service like Yahoo or Gmail -- the difference is that they phone you with an access code at a pre-determined phone number every time you want to access your email account.

      --
      If you're a zombie and you know it, bite your friend!
    14. Re:Hu? by Nikker · · Score: 3, Insightful

      In reality they have just shot themselves in the foot by admitting they have had sensitive information retrieved by an unauthorized person. The whole idea of contests like this is for marketing and the CEO looking for a gold star type reputation. If the contest had gone without a hitch then they would pass their service off as 'air tight' since they are "securewebmail.com" ;) Regardless now of whether they pay out it is obvious that they are insecure so spending time arguing semantics is just going to kill them by the Streisand effect. It's stupid for them to argue over 10K while their rep will cost the company its livelihood regardless if they pay it or not. Some posts here seem to refer that any social engineering would likely be limited in nature as off-the-cuff phone calls to employees where the attacker seems to be a trusted member will not likely be effective in the long run. The truth is that supply and demand will mitigate this factor, especially since people get more interested in whats inside a room the more locks you put on it ;) New vectors will be sought and acted on and they will be hacked again. It would have been better for them to offer the 10K as a consultants fee and have all this under a NDA then going balls out with this kind of thing cause obviously it wasn't secure to begin with.

      --
      A loop, by its nature, continues. If that didn't make sense, start reading this sentence again.
    15. Re:Hu? by Anonymous Coward · · Score: 5, Insightful

      They never logged into the account themselves.

      It's an XSS exploit: StrongWebmail expended all their resources attempting to prevent people obtaining credentials and logging in. However, send an email with an appropriate piece of script to the target user, or provide a link targetting one of the iframes on the site, and all you have to do is sit back and wait for that to get loaded in the browser.

      The person doing the exploit never has to log in, all they need is to get some script on the page and wait for the target user to use their account as normal, which triggers the exploit right inside the browser. That's why noscript blocked the attempt on IDG - it wasn't the hackers running Firefox+noscript, it was the journalist asking them to replicate the attack.

      No secretaries, janitors or midnight exchanges of cash-filled envelopes required - they spent so much time decorating the front door that they forgot to check inside the constant stream of animal-shaped wooden statues delivered to the service entrance.

    16. Re:Hu? by Odinlake · · Score: 2, Funny

      ...social engineering is a very legit way to hack a system

      interesting - are there more legit ways to hack a system? I'd like to hack into this bank but preferably without breaking the law...

  2. Telegraphing by inviolet · · Score: 4, Insightful

    The size of the prize -- $10,000 -- indicates that the company thought it reasonably possible that they'd get hacked, and/or desired to avoid motivating any serious hacking attempt. Neither explanation gives me much confidence in their product.

    And wow did it ever backfire. Normally they do these kinds of promotions in the hopes that nobody will bother, so that the company can later say "We offered a wheelbarrow of cash, and still nobody hacked us!". As if that was equivalent to a real security audit.

    --
    FATMOUSE + YOU = FATMOUSE
    1. Re:Telegraphing by Alethes · · Score: 5, Insightful

      Maybe I'm naive, but I figure StrongWebmail.com might be the best webmail site to use for security right now because they're in a heightened state of alert. Kinda like flying after right after 9/11.

    2. Re:Telegraphing by gavron · · Score: 3, Insightful
      There was nothing done after 9/11 to raise the level of security for the flying public. That includes the period right after 9/11 up to and including today. Everything that was done was in the spirit of "security theater" (credit: Bruce Schneier).

      Strongmail isn't the "best" (whatever criteria you use for "best") webmail site for "security" (whatever your definition of "security"). It's proven that it's easily cracked, and that is in and of itself a stay-away sign.

      I highly recommend Bruce's blog at http://www.schneier.com/blog/.

      E

    3. Re:Telegraphing by gavron · · Score: 3, Insightful
      "Heightened awareness" of untrained personnel yield more chaos and more chaffe, not more data. Sorry.

      Body pat downs are security theater. The 9/11 terrorists didn't have boxcutters on them nor would that have been found in a pat down.

      Newer equipment has only been installed in test markets to do the "puff" test. It detects gunpowder or explosive residue. Neither the "liquid explosive" (myth) nor the boxcutters can be detected by it.

      Under-cover air-marshals board first, and keep their jackets on. IF THEY WERE ADEQUATELY TRAINED, NOT CORRUPT (see many news stories to the contrary) then they might make a difference but not for any real scenarios.

      You forgot to mention "reinforced cockpit doors" and "not congregating at the toilet." These also, like the former, do not prevent a terrorist with a boxcutter from putting it to the throat of a flight attendant (and four of them doing so to all four flight attendants) and threatening to kill them all.

      Before you argue whether such an attack would be successful -- consider this -- if they can do it (which they can) then security since 9/11 has not increased which is exactly what I said.

      "Who says security theater isn't effective?"

      It's effective as mediocre entertainment if someone you don't like has to go through it.

      It's not effective as security.

      Best regards

      E

    4. Re:Telegraphing by Anonymous Coward · · Score: 4, Informative

      You think awareness will help to any degree? Awareness of what and how is that equal greater security? I worked at a major airline before and about 5 months after 9/11. I worked at an airline and at an airport that was used by the 9/11 terrorists. Things may have seem to have changed but if you knew anything about the operations at an airport, it was smoke and mirrors. Maybe have things have changed since then so I can not comment.

      On another note, I now live and work in DC. I see cars being checked before pulling into parking garages of important buildings. A security guard walks around the car with a mirror on a stick and checks the underneath of the cars before allowing entry. You call that increased security? Paint your bomb with undercoating or put it in the truck, in your engine bay, or hell, even in the back seat. As long as it does not have flashing lights and does not say "EXPLOSIVE" on it, they would never know.

      You want to know what heightened awareness there is? Remeber this incident? http://en.wikipedia.org/wiki/2007_Boston_Mooninite_Scare
      It had lights and wires, it must be a bomb. You feel save with that level of awareness? I don't.

    5. Re:Telegraphing by bitt3n · · Score: 4, Funny

      The size of the prize -- $10,000 -- indicates that the company thought it reasonably possible that they'd get hacked, and/or desired to avoid motivating any serious hacking attempt. Neither explanation gives me much confidence in their product.

      And wow did it ever backfire. Normally they do these kinds of promotions in the hopes that nobody will bother, so that the company can later say "We offered a wheelbarrow of cash, and still nobody hacked us!". As if that was equivalent to a real security audit.

      Perhaps they'll fix their software by simply offering a lower prize.

      "Hack our software, and win a free small soda with purchase of any McDonald's value meal!"

      --
      how many pairs of boxer shorts should you own?
    6. Re:Telegraphing by michaelhood · · Score: 2, Insightful

      You started to touch one the one thing that has changed that matters, IMO. And that's largely a policy change.

      We used to operate under the assumption that would-be hijackers wanted political attention and/or money. Now we operate under the assumption they are willing to die if it means inflicting more casualties. This means we will never again open the [now reinforced] cockpit doors in any circumstances when there is a hostile scenario in the cabin.

      So all of this talk about box-cutters and other mythical impromptu melee weapons is a false dilemma. This is no longer a viable threat. Virtually all threats to be considered at this point are ones capable of causing harm to a large number of passengers in the passenger cabin (firearms), or causing the plane to crash (explosives). There are of course fringe cases, but all things must be a balance of convenience/accessibility and security.

    7. Re:Telegraphing by gavron · · Score: 2, Insightful
      That's a red herring. Today's pilots don't know whether the terrorist of tomorrow wants to use the plane as a weapon (as did the one occurrence in 2001) or whether they have other goals they wish to accomplish. These same N terrorists (pick a number -- the lack of security won't prevent ten boxcutters from being brought on board any more than they'd not prevent 4 being brought on board) can threaten a LARGE number of innocent women, children, and men.

      Pilots will likely respond and land the plane. Sure, it won't be used as a weapon (but that was the 8-year-old plan... not tomorrow's plan). They can still get hundreds of hostages.

      Going back to my original point. THERE IS NO MORE SECURITY TODAY. The Pilots' attitude is not a result of heightened security nor better screeners, nor the creation of DHS nor anything else.

      Again, the web site does not provide stronger security. The airlines do not provide stronger security. There is equal lack of realism in saying "I'd rather fly now than before 2001" as "I'd rather trust strongwebmail now rather than before they were hacked." Neither has improved their security.

      E

    8. Re:Telegraphing by gavron · · Score: 3, Insightful
      "An airliner in the US will never be hijacked again."

      Sadly, sir, you are incorrect.

      E

  3. Interesting approach by l2718 · · Score: 3, Insightful

    Offering bounties is a great approach to finding bugs in your code. The crackers are taking quite a legal risk, however -- what if the owner of the computer decided that they "exceeded the hacking authorization"?

    1. Re:Interesting approach by The+MAZZTer · · Score: 4, Insightful

      As long as they followed the rules, in theory they could probably defend themselves quite well in court considering the whole thing with the prize money and the offer. It's a bit hard to claim that someone illegally hacked into your system when a) you invited anyone to hack it and b) you laid out rules WHICH THEY FOLLOWED.

  4. This is obvious by empesey · · Score: 5, Insightful

    If they idea is to determine whether it can be cracked, why are there rules? Whether they followed some self-imposed rules or not, it still indicates that there is a weak link in the armor.

    1. Re:This is obvious by houghi · · Score: 2, Interesting

      Because they might not be interested to see if it as a whole can be hacked, but if certain parts can be hacked. They might be aware that it can be DDOSsed. They know that social engineering will work, so they do not need or do not want to test those parts of the security.

      It is like a bargame. You have a glass with beer and on top is a coaster. You must drink the beer without touching the coaster and when done drinking the coaster must be on top of the glass again.
      The solution would be to take two barstools, place them close together, get the glass from top to bottom so that the coaster rests on the two stools and the glass is still in your hand. Drink the beer, and pick up the coaster with the glass.

      Now you could say "why rules? Just drink the beer." But the challenge is not drinking the beer. The challenge is to solve the problem on HOW to do it. The beer is the prize.

      --
      Don't fight for your country, if your country does not fight for you.
  5. The Catch by LSDelirious · · Score: 5, Informative

    from StrongWebmail's Site

    There's just one catch: to access a StrongWebmail.com email account, the account's owner must receive a verification call on his pre-registered phone number. So even though you have our CEO's username and password, you still have some work to do because you don't have access to his telephone. If you do manage to be the first person to break into his email account, there's $10,000 in it for you - just register below to get started. Good luck!

    So they have to hack the phone company's system too, or find a way to clone his cellphone, so they can intercept the call and approve access? They might be cool with having their own systems hacked, but it sounds like they are now involving a phone company, which might not be too thrilled to be a part of their little game - the only way around that I can see is to hack the StrongWebmail system to change the "pre-registered" phone number....

    and who the hell wants an email account you have to approve via phone call every time you login?!? What if your phone is lost/broken/dead/no reception/etc.. then you have no way in

    --
    Slavery is the legal fiction that a person is property; A Corporation is the legal fiction that property is a person.
    1. Re:The Catch by Tubal-Cain · · Score: 2, Funny

      Telesign, a provider of voice-based authentication software...

      Sounds like something for protecting a phone system.

    2. Re:The Catch by Gi0 · · Score: 3, Insightful

      If i could hack the phone company's system, or find a way to clone their CEO cellphone,besides hacking their system,would i be willing to let them know for just 10 grant?Nop.That knowledge has got to be more precious.

      --
      There's no patch for stupidity
    3. Re:The Catch by Jaime2 · · Score: 2, Insightful

      Or hack the authentication system so that it thinks you already went through all that stuff when all you did was forge an authentication proof. Their system is very resistant to some types of attacks, like password guessing. But, it is no stronger than a normal username and password against most attacks on the system itself. SrongWebmail.com's biggest mistake was thinking that they knew of all of their weaknesses.

    4. Re:The Catch by michaelhood · · Score: 3, Funny

      My voice is my passport; verify me.

    5. Re:The Catch by digitalchinky · · Score: 5, Interesting

      Damn, I wish I lived in the US. This is easy money.

      For 10 grand in prize money - wow, they didn't think about this very well. The kit you need is all available on ebay for less than a grand. I already have the modems, EDT data capture cards, a couple of Sun ultra's (old, but they do the job dependably), a spectrum analyser, antennas, level converters, up/down converter, transceivers and a bunch of cables to connect it all together.

      It would take a half a day at most. Camp outside his office or home, figure out which cell tower he is on (line of site) and poke an antenna in the path of the microwave link the tower uses to talk to the exchange. (This traffic is all unencrypted, bog standard T1/E1 stuff) - do whatever you need to do to trigger the text alert, suck down the CCITT-7 channel, then pick through the SMS payload until you find the code. Log in and take the cash.

      Legal? I'd say absolutely, you haven't actually monitored a 'cell phone' at all, nor have you tuned your receive gear to any part of the spectrum used by a cell phone. All you've done is read the out of band signalling system on an entirely separate trunk over a link, that is not breaking the 'do not monitor phone calls' rule. (No such rules exist where I live, mostly because radio is still thought of as magic by the Government)

    6. Re:The Catch by JonJ · · Score: 3, Funny

      That's "easy money" where you live? Where the fuck is that? And I wonder what's considered "hard" for you people.

      --
      -- Linux user #369862
    7. Re:The Catch by digitalchinky · · Score: 3, Interesting

      I'm Australian, a former secret 3 letter agency drone (Defence Signals Directorate, and others), probably disgruntled, and a few years back I moved to Asia. I'd love to say I now dabble in a little light industrial espionage, but really, there isn't much of a call for former spies. People don't believe you anyway. These days I'm just some guy with a keen interest in radio communications. And this problem is naught more than a bit of a jigsaw puzzle of equipment and a hex editor. Pretty much anyone working with any kind of satellite communication system will be familiar with the technology.

      What is hard? For me, anything that is largely not radio communications, like women, and carburettors :-)

    8. Re:The Catch by toddestan · · Score: 2, Insightful

      The only detail that your missing is that you would also his username and password in addition to being able to tap his cell phone.

  6. Re:Full Details by LSDelirious · · Score: 5, Informative

    Official Contest Rules, Terms, and Conditions

    --
    Slavery is the legal fiction that a person is property; A Corporation is the legal fiction that property is a person.
  7. Just Kidnap the Bastard by LSDelirious · · Score: 2, Interesting

    Just make sure Darren Berkovitz has his phone on him There's nothing in the rules against it...

    --
    Slavery is the legal fiction that a person is property; A Corporation is the legal fiction that property is a person.
  8. Blackjacking's been around for awhile by sgt_doom · · Score: 2, Informative

    Hacking (or blackjacking, to use the vernacular) cells has been in existence for quite awhile, with probably Thai coders taking the lead, with Chinese, Americans, Germans and Brits coming up from the rear.....

    1. Re:Blackjacking's been around for awhile by grcumb · · Score: 4, Funny

      Hacking (or blackjacking, to use the vernacular) cells has been in existence for quite awhile, with probably Thai coders taking the lead, with Chinese, Americans, Germans and Brits coming up from the rear.....

      That must be uncomfortable for the Thais...

      ... What? Oh! 'Coming up from the rear.' Forget I said anything.

      --
      Crumb's Corollary: Never bring a knife to a bun fight.
  9. Point of Order... by ae1294 · · Score: 2, Insightful

    Void where prohibited, taxed, or otherwise restricted by law. Subject to all federal, state, and local laws. This Contest is open to all legal residents of the United States and the District of Columbia, and U.S. Military personnel (and their families) with APO/FPO addresses, who are eighteen (18) years of age or older.

    Void where prohibited? - Hacking? Nah...
    Taxed? - Hacking? - Donno it might be now...
    Otherwise restricted by law? - Hacking? Nah....
    Subject to all federal, state, and local laws? - Hacking? Nah...
    Only open to US residents? - SURE, "all" the best hackers and US born.
    18 Years of Age. - O yes, for "all" the best hackers are 18 and older because they have girlfriends, jobs and a shit-ton more to loose.

    Gezzzzz come on now... If you try and claim the 10 grand you're going to get 30 years in federal prison.....
    No wonder they didn't think anyone would try for the 10 grand.

    1. Re:Point of Order... by pavon · · Score: 3, Informative

      There are anti-hacker laws, but they generally read along the lines of

      Whoever having knowingly accessed a computer without authorization or exceeding authorized access...
      Whoever intentionally, without authorization to access any nonpublic computer ...
      Whoever knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access

      (From 18.USC 1030, the law Lori Drew was charged with)

      Darren Berkovitz gave explicit permission when he announced this contest, so they had authorization to attempt to gain access by any means allowed by the rules. The only restrictions given were that you had to register first, and you couldn't get help from a StrongWebmail employee.

      The rest of the rules looked innocuous to me. Most of it was standard broiler-plate which is required by law for any contest - a cereal box prize will have the same language. The last paragraph of the third section was all just Disclaimers of Liabilities - we aren't responsible for network congestion if someone tries to DoS us to win the prize, we aren't responsible if you download some script-kiddy software to use in the competition and it screws up your computer, etc.

      If you did clearly break the rules that you could be charged under 18.USC 1030 as the access was unauthorized, knowing (you agreed to the rules), and fraudulent (you were attempting to cheat them out of prize money), and crossed state lines. But they weren't tricky rules to follow.