Feeds

StrongWebmail holds up hands to hack, plots further challenge

Er... best of three, chaps?

The Power of One eBook: Top reasons to choose HP BladeSystem

StrongWebmail has conceded that a group of ethical hackers beat its systems to claim a $10,000 prize, while reiterating its commitment to callback verification technology and plotting a further "hacker challenge".

The US start-up was so confident of its claims to provide a secure webmail and calendar service that it challenged security researchers to defeat its callback verification system and obtain its chief exec's schedule for 26 June. Security researchers Lance James, Aviv Raff and Mike Bailey defeated the system after locating a cross-site scripting (XSS) vulnerability on its website that allowed registered users to snoop on details from other users' accounts.

StrongWebmail uses a callback verification system from parent firm Telesign that ought to mean that even if someone obtains a user's login credentials, they can't get into their inbox without also having access to the phone associated with a particular account. Users using a previously unused computer are prompted to enter a code sent to a registered phone.

StrongWebmail maintains that this approach is solid, and is even contemplating a further "hacker challenge", while admitting that James and co beat its systems fair and square this time around.

It is important to note that the front end protection offered by StrongWebmail.com was not compromised. In fact, Lance [James] and his team were forced to find a way around the phone authentication. We are working with our email provider to solve this vulnerability and ensure that the backend email software is more secure.

We remain confident that our authentication solution - sending a verification call or text message to a person’s cell phone - is the best frontend protection for usernames and passwords. Vulnerabilities in backend cloud-based data such as webmail are a universal security issue for every webmail provider.

We hope this contest brings attention to the importance of email security. Specifically, most email accounts are protected by a simple username and password. It’s easy to steal a username and password using a key logger, phishing attack, or guessing the correct password. Sarah Palin’s Yahoo email account was breached last year by resetting her password using publicly available information. StrongWebmail.com hopes that the largest webmail providers will offer the option of two factor authentication to their users, as most email breaches happen when a username and password are stolen.

Congratulations to Lance James and his team for winning the contest. Once this vulnerability is fixed, TeleSign will announce a new competition. We won’t rest until we have proven that telephone-based authentication is the most secure form of username/password protection available.

StorngWebmail is quite correct in drawing attention to the general vulnerabilities of webmail, and in particular password resetting functions, as illustrated by the Sarah Palin webmail hack. But its argument that hackers bypassed rather than defeated its call verification technology in hacking into its chief exec account skirts the fact its systems were defeated.

Users in general are far more interested in whether a service does what it says on the tin than how individual components work.

The idea of a second hacking challenge is risky at best and pointless at worst. If StrongWebmail's systems are defeated for a second time it will end up looking a bit silly - and even if no one wins the second challenge, it doesn't follow that the system has become uncrackable. ®

Designing a Defense for Mobile Applications

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.