Feeds

StrongWebmail holds up hands to hack, plots further challenge

Er... best of three, chaps?

Seven Steps to Software Security

StrongWebmail has conceded that a group of ethical hackers beat its systems to claim a $10,000 prize, while reiterating its commitment to callback verification technology and plotting a further "hacker challenge".

The US start-up was so confident of its claims to provide a secure webmail and calendar service that it challenged security researchers to defeat its callback verification system and obtain its chief exec's schedule for 26 June. Security researchers Lance James, Aviv Raff and Mike Bailey defeated the system after locating a cross-site scripting (XSS) vulnerability on its website that allowed registered users to snoop on details from other users' accounts.

StrongWebmail uses a callback verification system from parent firm Telesign that ought to mean that even if someone obtains a user's login credentials, they can't get into their inbox without also having access to the phone associated with a particular account. Users using a previously unused computer are prompted to enter a code sent to a registered phone.

StrongWebmail maintains that this approach is solid, and is even contemplating a further "hacker challenge", while admitting that James and co beat its systems fair and square this time around.

It is important to note that the front end protection offered by StrongWebmail.com was not compromised. In fact, Lance [James] and his team were forced to find a way around the phone authentication. We are working with our email provider to solve this vulnerability and ensure that the backend email software is more secure.

We remain confident that our authentication solution - sending a verification call or text message to a person’s cell phone - is the best frontend protection for usernames and passwords. Vulnerabilities in backend cloud-based data such as webmail are a universal security issue for every webmail provider.

We hope this contest brings attention to the importance of email security. Specifically, most email accounts are protected by a simple username and password. It’s easy to steal a username and password using a key logger, phishing attack, or guessing the correct password. Sarah Palin’s Yahoo email account was breached last year by resetting her password using publicly available information. StrongWebmail.com hopes that the largest webmail providers will offer the option of two factor authentication to their users, as most email breaches happen when a username and password are stolen.

Congratulations to Lance James and his team for winning the contest. Once this vulnerability is fixed, TeleSign will announce a new competition. We won’t rest until we have proven that telephone-based authentication is the most secure form of username/password protection available.

StorngWebmail is quite correct in drawing attention to the general vulnerabilities of webmail, and in particular password resetting functions, as illustrated by the Sarah Palin webmail hack. But its argument that hackers bypassed rather than defeated its call verification technology in hacking into its chief exec account skirts the fact its systems were defeated.

Users in general are far more interested in whether a service does what it says on the tin than how individual components work.

The idea of a second hacking challenge is risky at best and pointless at worst. If StrongWebmail's systems are defeated for a second time it will end up looking a bit silly - and even if no one wins the second challenge, it doesn't follow that the system has become uncrackable. ®

Mobile application security vulnerability report

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.