Slashdot Mirror
6 Million Virgin Mobile Users Vulnerable To Brute-Force Attacks
An anonymous reader writes "'If you are one of the six million Virgin subscribers, you are at the whim of anyone who doesn't like you.' The Hacker News describes how the username and password system used by Virgin Mobile to let users access their account information is inherently weak and open to abuse." Computerworld also describes the problem: essentially, hard-coded, brute-force guessable passwords, coupled with an inadequate mechanism for reacting to failed attempts to log on.
I'm not surprised security isn't strong - given the Virgin Media (ISP) account puts a 10 character limit on your password. Seriously. 10 is woefully short as a maximum.
-- Lattyware (www.lattyware.co.uk)
Its a shame we cant mod the title funny innit?
I read this as "Six million virgins vulnerable to brute force attack :D"
I would have thought that Virgin would be less vulnerable to penetration.
for failed login attempt checks. This can be bypassed simply by using a different cookie each time, and brute-forcing can take place.
They should've used an IP-based check maybe?
according to Kevin Burke who originally found the issue (scroll down to "Wednesday morning").
Quick poll, is vulnerable to brute-force attacks better or worse than T-Mobile's "email me my existing password in plaintext" forgot-password feature? (Yes, T-Mobile uses your phone number as your username too.)
Forget VM, Boost Mobile forces the username to be your 10-digit mobile number and the password to a 4-digit number that you select.
I can mend the break of day, heal a broken heart, and provide temporary relief to nymphomaniacs.
i have to disagree with you there, Its 6 months or longer of hand holding , cuttleing, spooning, excessive making out, then when you finality get to penetrating its "slow down" or "ouch" and just unpleasant for both parties. that's how i remember it.
this is the NEW /. - Dice is digging (ha!) up new revenue sources
You will not get any data that way.
Yes, you may DOS the phone, but what good does that do you?
Don't know something? Look it up. Still don't know? Then ask.
Yea, hooking up with someone who knows what they're doing is a good thing.
And it's a good thing that she knew what she was doing, cause I sure as hell didn't.
Don't know something? Look it up. Still don't know? Then ask.
Last time it was tried.
Great in rehersal.
ill re-write that for ya
Agreed, if you rewrote it it would indeed be ill. Can't you fucking kids follow conventions for the sake of clear communications, or are you doing like Microsoft does and making up your own "standards"? Not capitalizing the "I" wasnt the only thing about the way you wrote your comment that made you look like a retarded ten year old.
Get your GED, kid, so you don't come across as such a moron.
Free Martian Whores!
When asked about their vulnerability to brute force attacks, the six million people said, "This must be what the Slashdot people felt like in high school."
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
I guessed this when I first started using their service late last year. Your account "login" information is simply your real 10-digit phone number, and your "password" is just a 6-digit PIN. Everything you need to enter it is right there, on the numpad (with the exception of Tab). SMS spammers guess people's phone numbers and carriers to successfully send unwanted messages through e-mail; surely if they wanted to bad enough it wouldn't be too difficult to guess or do a brute-force attack on the six-digit string of digits protecting it.
Seriously, I was (and still am) shocked how such a poor system could be put into place in 2011/2012. They could at least set up two-factor authentication if they're going to have such a piss-poor username/password system, and require their primary authentication phone number to be another phone line so, you know... if the phone connected to the account is lost and/or stolen no one can get into your account before you do. And the secondary authenticator could optionally be the phone number of the account/phone in question to make personally logging into your account and checking your info easier--but as soon as the phone is labeled missing, it would be immediately be rendered useless for receiving any codes to log in. Virgin Mobile already nags you with text messages and e-mails constantly as your month of service comes to an end; sending an occasional text message with an account authentication code shouldn't hurt too badly.
Really though... the whole system needs rethought. At the very least, allow lowercase letters and more than six characters in the password. And while they're at it, why not allow capital letters and a few special characters? Of course, the problem then would be that when you call customer support, "verifying" that you're you wouldn't be as simple as asking "What's your phone number and your 6-digit account PIN?"
I just think it's funny that the guy who blogged about it had to write a script to brute-force his own account to "verify" that he was right, then finally call Sprint, and publicly write about it when they didn't do anything about it. Do you REALLY need to verify that a 6-digit PIN attached to a phone number is easily guessable? And as scummy as telecommunications companies are, does anyone really expect to get to someone who will actually forward the message over to someone else higher up who might potentially actually *do* something?
Isn't the entire modern world vulnerable to brute force attacks? Isn't that the definition of what to do when you can't reasonably narrow down the choices?
To Sprint's horrendously bad network.