Feeds

StrongWebmail holds up hands to hack, plots further challenge

Er... best of three, chaps?

The Essential Guide to IT Transformation

StrongWebmail has conceded that a group of ethical hackers beat its systems to claim a $10,000 prize, while reiterating its commitment to callback verification technology and plotting a further "hacker challenge".

The US start-up was so confident of its claims to provide a secure webmail and calendar service that it challenged security researchers to defeat its callback verification system and obtain its chief exec's schedule for 26 June. Security researchers Lance James, Aviv Raff and Mike Bailey defeated the system after locating a cross-site scripting (XSS) vulnerability on its website that allowed registered users to snoop on details from other users' accounts.

StrongWebmail uses a callback verification system from parent firm Telesign that ought to mean that even if someone obtains a user's login credentials, they can't get into their inbox without also having access to the phone associated with a particular account. Users using a previously unused computer are prompted to enter a code sent to a registered phone.

StrongWebmail maintains that this approach is solid, and is even contemplating a further "hacker challenge", while admitting that James and co beat its systems fair and square this time around.

It is important to note that the front end protection offered by StrongWebmail.com was not compromised. In fact, Lance [James] and his team were forced to find a way around the phone authentication. We are working with our email provider to solve this vulnerability and ensure that the backend email software is more secure.

We remain confident that our authentication solution - sending a verification call or text message to a person’s cell phone - is the best frontend protection for usernames and passwords. Vulnerabilities in backend cloud-based data such as webmail are a universal security issue for every webmail provider.

We hope this contest brings attention to the importance of email security. Specifically, most email accounts are protected by a simple username and password. It’s easy to steal a username and password using a key logger, phishing attack, or guessing the correct password. Sarah Palin’s Yahoo email account was breached last year by resetting her password using publicly available information. StrongWebmail.com hopes that the largest webmail providers will offer the option of two factor authentication to their users, as most email breaches happen when a username and password are stolen.

Congratulations to Lance James and his team for winning the contest. Once this vulnerability is fixed, TeleSign will announce a new competition. We won’t rest until we have proven that telephone-based authentication is the most secure form of username/password protection available.

StorngWebmail is quite correct in drawing attention to the general vulnerabilities of webmail, and in particular password resetting functions, as illustrated by the Sarah Palin webmail hack. But its argument that hackers bypassed rather than defeated its call verification technology in hacking into its chief exec account skirts the fact its systems were defeated.

Users in general are far more interested in whether a service does what it says on the tin than how individual components work.

The idea of a second hacking challenge is risky at best and pointless at worst. If StrongWebmail's systems are defeated for a second time it will end up looking a bit silly - and even if no one wins the second challenge, it doesn't follow that the system has become uncrackable. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.