Slashdot Mirror
6 Million Virgin Mobile Users Vulnerable To Brute-Force Attacks
An anonymous reader writes "'If you are one of the six million Virgin subscribers, you are at the whim of anyone who doesn't like you.' The Hacker News describes how the username and password system used by Virgin Mobile to let users access their account information is inherently weak and open to abuse." Computerworld also describes the problem: essentially, hard-coded, brute-force guessable passwords, coupled with an inadequate mechanism for reacting to failed attempts to log on.
I'm not surprised security isn't strong - given the Virgin Media (ISP) account puts a 10 character limit on your password. Seriously. 10 is woefully short as a maximum.
-- Lattyware (www.lattyware.co.uk)
There is nothing about hard coded password on the news release:
http://kev.inburke.com/kevin/open-season-on-virgin-mobile-customer-data/
It's all about short numeric only password with no attempt limitation.
Its a shame we cant mod the title funny innit?
I read this as "Six million virgins vulnerable to brute force attack :D"
I would have thought that Virgin would be less vulnerable to penetration.
for failed login attempt checks. This can be bypassed simply by using a different cookie each time, and brute-forcing can take place.
They should've used an IP-based check maybe?
according to Kevin Burke who originally found the issue (scroll down to "Wednesday morning").
Last time it was tried.
Quick poll, is vulnerable to brute-force attacks better or worse than T-Mobile's "email me my existing password in plaintext" forgot-password feature? (Yes, T-Mobile uses your phone number as your username too.)
Forget VM, Boost Mobile forces the username to be your 10-digit mobile number and the password to a 4-digit number that you select.
I can mend the break of day, heal a broken heart, and provide temporary relief to nymphomaniacs.
Where am i, is this not slashdot?
---- Booth was a patriot ----
Apparently they used passwords that are super strong and was guaranteed by a French bank, Swype account administrator. So this story is pure fiction. I tell you no one would believe what that password is if someone told them "this is the password for the french bank swype account portal." It was that incredible.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
ill re-write that for ya.... My republican friends tell me that if it's a legitimate brute force attack,women's bodies have ways to shut the whole thing down. But as a man i have not way to shutdown the bruit force attack of stupidity when i hear Romney speak.
You will not get any data that way.
Yes, you may DOS the phone, but what good does that do you?
Don't know something? Look it up. Still don't know? Then ask.
ill re-write that for ya
Agreed, if you rewrote it it would indeed be ill. Can't you fucking kids follow conventions for the sake of clear communications, or are you doing like Microsoft does and making up your own "standards"? Not capitalizing the "I" wasnt the only thing about the way you wrote your comment that made you look like a retarded ten year old.
Get your GED, kid, so you don't come across as such a moron.
Free Martian Whores!
When asked about their vulnerability to brute force attacks, the six million people said, "This must be what the Slashdot people felt like in high school."
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
I guessed this when I first started using their service late last year. Your account "login" information is simply your real 10-digit phone number, and your "password" is just a 6-digit PIN. Everything you need to enter it is right there, on the numpad (with the exception of Tab). SMS spammers guess people's phone numbers and carriers to successfully send unwanted messages through e-mail; surely if they wanted to bad enough it wouldn't be too difficult to guess or do a brute-force attack on the six-digit string of digits protecting it.
Seriously, I was (and still am) shocked how such a poor system could be put into place in 2011/2012. They could at least set up two-factor authentication if they're going to have such a piss-poor username/password system, and require their primary authentication phone number to be another phone line so, you know... if the phone connected to the account is lost and/or stolen no one can get into your account before you do. And the secondary authenticator could optionally be the phone number of the account/phone in question to make personally logging into your account and checking your info easier--but as soon as the phone is labeled missing, it would be immediately be rendered useless for receiving any codes to log in. Virgin Mobile already nags you with text messages and e-mails constantly as your month of service comes to an end; sending an occasional text message with an account authentication code shouldn't hurt too badly.
Really though... the whole system needs rethought. At the very least, allow lowercase letters and more than six characters in the password. And while they're at it, why not allow capital letters and a few special characters? Of course, the problem then would be that when you call customer support, "verifying" that you're you wouldn't be as simple as asking "What's your phone number and your 6-digit account PIN?"
I just think it's funny that the guy who blogged about it had to write a script to brute-force his own account to "verify" that he was right, then finally call Sprint, and publicly write about it when they didn't do anything about it. Do you REALLY need to verify that a 6-digit PIN attached to a phone number is easily guessable? And as scummy as telecommunications companies are, does anyone really expect to get to someone who will actually forward the message over to someone else higher up who might potentially actually *do* something?
Isn't the entire modern world vulnerable to brute force attacks? Isn't that the definition of what to do when you can't reasonably narrow down the choices?
To Sprint's horrendously bad network.
Believe me, I am not a computer wizard by any means, but when Virgin insisted on a 6 digit numeric only passphrase I was shocked. I have logged onto other sites and used passphrases that were commented as being very high as far as security, using both upper and lower case letters as well as numerals and symbols. I hope they change this soon; I will feel much better/safer.