Feeds

Hackers scalp StrongWebmail to claim cash prize

$10,000 for successful schedule snoop

Securing Web Applications Made Simple and Scalable

Ethical hackers are claiming a $10,000 prize for successfully breaking into the webmail account of the chief exec of StrongWebmail after the firm issued a "hack us if you can" challenge.

StrongWebMail runs a callback verification system so that, in theory, even if someone obtains a user's login details they can't read email from the account without also having access to the phone associated with a particular account. Logins into StrongWebMail from previously unused machines need this secondary form of confirmation.

The US start-up was so confident of its claims that its Darren Berkovitz published his account name and password in laying down a $10K challenge to hackers to break into his account and find out his schedule for 26 June. StrongWebMail's features include calendar and to-do lists as well as webmail.

Security researchers Lance James, Aviv Raff and Mike Bailey obtained the information and claimed their prize on Thursday. StrongWebMail confirmed that the data obtained was correct, but are holding off in paying out the prize because they are yet to be convinced the Ruff and co stuck to competition rules. The rules prohibit the use of social engineering trickery (such as tricking or paying an insider to hand over account access).

The group of researchers maintain they played fair and used a cross-site scripting (XSS) vulnerability to access the target account after first registering an account of their own with the service. The trio are withholding details out of concerns the same approach might be used to access other accounts without permission, and in line with competition rules.

James, Raff and Bailey demonstrated their attack on a test account set up with StrongWebMail by IDG. But the compromise was possible only after the NoScript extension on the Firefox browser of the XP machine used in the test was disabled, IDG reports.

Hacking competitions such as the one established by StrongWebMail might make for good publicity but they don't prove much. Even if no one wins a particular challenge it doesn't follow that a system is unhackable - just that it wasn't broken this time around. ®

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.