.

Web Mail Company to Pay Prize After CEO Hacked

<<

don

User avatar

Administrator
Administrator

Posts: 4226

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Thu Jun 11, 2009 11:35 am

Web Mail Company to Pay Prize After CEO Hacked


A secure Web mail company that challenged hackers to break into the company's Web mail system is paying out a US$10,000 prize, just days after launching the contest.

A team of hackers managed to hack into StrongWebmail CEO Darren Berkovitz's Web mail account, using what's known as a cross-site scripting (XSS) attack, the company confirmed Monday. "They did it using an XSS script that took advantage of a vulnerability in the backend webmail program," StrongWebmail said in a statement.

StrongWebmail launched the contest at the end of May as a way of promoting the voice-based identification technology sold by its parent company, Telesign. Hackers were given Berkovitz's e-mail address and password and challenged to break into the account. The company thought this would prove difficult because StrongWebmail requires a special password that is telephoned to the user before e-mail can be accessed.

Secure Science Chief Scientist Lance James and his fellow hackers Aviv Raff and Mike Bailey found a back door in a common Web flaw, however, and claimed that they'd won the contest last Thursday. StrongWebmail's statement confirmed that they had indeed hacked into Berkovitz's e-mail account.

In cross-site scripting, the attacker takes advantage of a bug on the Web server in order to run malicious Web script in the victim's browser, essentially taking control of the browser.

The hackers found the Web flaw within a minute, James said, and then spent about six hours perfecting their attack. Not a lot of work for a $10,000 payout.

StrongWebmail said it was "not deterred" by the contest's quick conclusion and would be launching a new competition once this bug was fixed. "We won't rest until we have created the most secure e-mail in the world," the company said.

The bug used by the hackers was actually in the Rackspace Web mail software used to power StrongWebmail, not in the Telesign authentication system that StrongWebmail was created to promote, Berkovitz said in an e-mail interview.

The prize amount and rules of the next contest have yet to be determined, he added. "We are going to try and make the next contest really about breaching the portion that TeleSign protects," he said. "The e-mail we licensed is obviously from a large and reliable provider, but there is only so much we can do to ensure that they don't have holes on their end."

In an e-mail sent to James and viewed by the IDG News Service, the company complimented him on his hacking skills. "You and your team are quite impressive - what are your consulting rates?" the e-mail states.



Original story:
http://www.pcworld.com/businesscenter/a ... acked.html

Don
CISSP, MCSE, CSTA, Security+ SME
<<

former33t

Full Member
Full Member

Posts: 226

Joined: Sat Feb 14, 2009 12:33 am

Post Thu Jun 11, 2009 3:55 pm

Re: Web Mail Company to Pay Prize After CEO Hacked

Thanks for sharing this.  Immediately took me into the "way back" machine as it sounded familiar.  Remember this one with Argus?  They offered roughly $48,000 to anyone who could hack their software.  Unfortunately it was running on an x86 solaris machine that was exploitable.  When the hacking group beat the OS rather than the application, Argus tried not to pay.  Hope this doesn't turn out that way.

http://www.vnunet.com/vnunet/news/21150 ... -challenge

http://marc.info/?l=isn&m=103840472904698&w=2

To be fair to StrongWebmail, it sucks that their apparently more secure front end was undone by a vulnerability in the back end.  Still, if they purport the system as secure and are packaging it with this web mail server product, the whole thing needs to be secure.  If it isn't, don't cry foul, write your own web mail server you are happy with.
Certifications: CREA, MCSE: Security, CCNA, Security+, other junk
<<

jason

User avatar

Hero Member
Hero Member

Posts: 1013

Joined: Sat Jun 21, 2008 6:23 pm

Location: USA

Post Thu Jun 11, 2009 5:29 pm

Re: Web Mail Company to Pay Prize After CEO Hacked

The e-mail we licensed is obviously from a large and reliable provider, but there is only so much we can do to ensure that they don't have holes on their end


Well that's just silly. If you're advertising that you're the most secure X around, quibbling about the exact form of attack used is ridiculous. "We have the world's best bulletproof vest, as long as you only shoot it in this spot right here, are standing more than 1000 yards away, are not using anything more powerful than a BB gun, and are a half blind, one-armed person with no more than three fingers that has just sustained a severe head injury."
<<

UNIX

User avatar

Hero Member
Hero Member

Posts: 1244

Joined: Mon Apr 28, 2008 9:20 am

Post Fri Jun 12, 2009 1:02 am

Re: Web Mail Company to Pay Prize After CEO Hacked

I remember many similar contests where people who successfully hack into something will get some money. Unfortunately often companys won't pay for whatever reasons when someone succeeded.

The above mentioned contest may be a target for practicing ones social engineering skills. :)

Is there somewhere a place where such contests are collected? Unfortunately I always read about such things when they are over.
<<

jason

User avatar

Hero Member
Hero Member

Posts: 1013

Joined: Sat Jun 21, 2008 6:23 pm

Location: USA

Post Fri Jun 12, 2009 2:22 pm

Re: Web Mail Company to Pay Prize After CEO Hacked

That's a good idea. Maybe we need a board like "Hacking for fortune and glory" to collect these sorts of things up. Don?
<<

former33t

Full Member
Full Member

Posts: 226

Joined: Sat Feb 14, 2009 12:33 am

Post Sat Jun 13, 2009 10:12 am

Re: Web Mail Company to Pay Prize After CEO Hacked

Absolutely.  I'm in the same boat as UNIX.  I always hear about these things because someone beat the challenge.

Put me down with jason as another vote for a new forum board.
Certifications: CREA, MCSE: Security, CCNA, Security+, other junk
<<

UNIX

User avatar

Hero Member
Hero Member

Posts: 1244

Joined: Mon Apr 28, 2008 9:20 am

Post Sat Jun 13, 2009 11:19 am

Re: Web Mail Company to Pay Prize After CEO Hacked

Yeah, such a subboard or section would be nice. +1

Return to News from the Outside World

Who is online

Users browsing this forum: No registered users and 1 guest

cron
.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software