Feeds

StrongWebmail holds up hands to hack, plots further challenge

Er... best of three, chaps?

Website security in corporate America

StrongWebmail has conceded that a group of ethical hackers beat its systems to claim a $10,000 prize, while reiterating its commitment to callback verification technology and plotting a further "hacker challenge".

The US start-up was so confident of its claims to provide a secure webmail and calendar service that it challenged security researchers to defeat its callback verification system and obtain its chief exec's schedule for 26 June. Security researchers Lance James, Aviv Raff and Mike Bailey defeated the system after locating a cross-site scripting (XSS) vulnerability on its website that allowed registered users to snoop on details from other users' accounts.

StrongWebmail uses a callback verification system from parent firm Telesign that ought to mean that even if someone obtains a user's login credentials, they can't get into their inbox without also having access to the phone associated with a particular account. Users using a previously unused computer are prompted to enter a code sent to a registered phone.

StrongWebmail maintains that this approach is solid, and is even contemplating a further "hacker challenge", while admitting that James and co beat its systems fair and square this time around.

It is important to note that the front end protection offered by StrongWebmail.com was not compromised. In fact, Lance [James] and his team were forced to find a way around the phone authentication. We are working with our email provider to solve this vulnerability and ensure that the backend email software is more secure.

We remain confident that our authentication solution - sending a verification call or text message to a person’s cell phone - is the best frontend protection for usernames and passwords. Vulnerabilities in backend cloud-based data such as webmail are a universal security issue for every webmail provider.

We hope this contest brings attention to the importance of email security. Specifically, most email accounts are protected by a simple username and password. It’s easy to steal a username and password using a key logger, phishing attack, or guessing the correct password. Sarah Palin’s Yahoo email account was breached last year by resetting her password using publicly available information. StrongWebmail.com hopes that the largest webmail providers will offer the option of two factor authentication to their users, as most email breaches happen when a username and password are stolen.

Congratulations to Lance James and his team for winning the contest. Once this vulnerability is fixed, TeleSign will announce a new competition. We won’t rest until we have proven that telephone-based authentication is the most secure form of username/password protection available.

StorngWebmail is quite correct in drawing attention to the general vulnerabilities of webmail, and in particular password resetting functions, as illustrated by the Sarah Palin webmail hack. But its argument that hackers bypassed rather than defeated its call verification technology in hacking into its chief exec account skirts the fact its systems were defeated.

Users in general are far more interested in whether a service does what it says on the tin than how individual components work.

The idea of a second hacking challenge is risky at best and pointless at worst. If StrongWebmail's systems are defeated for a second time it will end up looking a bit silly - and even if no one wins the second challenge, it doesn't follow that the system has become uncrackable. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Blood-crazed Microsoft axes Trustworthy Computing Group
Security be not a dirty word, me Satya. But crevice, bigod...
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.