Original URL: http://www.theregister.co.uk/2009/06/10/strongwebmail/

StrongWebmail holds up hands to hack, plots further challenge

Er... best of three, chaps?

By John Leyden

Posted in Security, 10th June 2009 15:30 GMT

StrongWebmail has conceded that a group of ethical hackers beat its systems to claim a $10,000 prize, while reiterating its commitment to callback verification technology and plotting a further "hacker challenge".

The US start-up was so confident of its claims to provide a secure webmail and calendar service that it challenged security researchers to defeat its callback verification system and obtain its chief exec's schedule for 26 June. Security researchers Lance James, Aviv Raff and Mike Bailey defeated the system after locating a cross-site scripting (XSS) vulnerability on its website that allowed registered users to snoop on details from other users' accounts.

StrongWebmail uses a callback verification system from parent firm Telesign that ought to mean that even if someone obtains a user's login credentials, they can't get into their inbox without also having access to the phone associated with a particular account. Users using a previously unused computer are prompted to enter a code sent to a registered phone.

StrongWebmail maintains that this approach is solid, and is even contemplating a further "hacker challenge", while admitting that James and co beat its systems fair and square this time around.

It is important to note that the front end protection offered by StrongWebmail.com was not compromised. In fact, Lance [James] and his team were forced to find a way around the phone authentication. We are working with our email provider to solve this vulnerability and ensure that the backend email software is more secure.

We remain confident that our authentication solution - sending a verification call or text message to a person’s cell phone - is the best frontend protection for usernames and passwords. Vulnerabilities in backend cloud-based data such as webmail are a universal security issue for every webmail provider.

We hope this contest brings attention to the importance of email security. Specifically, most email accounts are protected by a simple username and password. It’s easy to steal a username and password using a key logger, phishing attack, or guessing the correct password. Sarah Palin’s Yahoo email account was breached last year by resetting her password using publicly available information. StrongWebmail.com hopes that the largest webmail providers will offer the option of two factor authentication to their users, as most email breaches happen when a username and password are stolen.

Congratulations to Lance James and his team for winning the contest. Once this vulnerability is fixed, TeleSign will announce a new competition. We won’t rest until we have proven that telephone-based authentication is the most secure form of username/password protection available.

StorngWebmail is quite correct in drawing attention to the general vulnerabilities of webmail, and in particular password resetting functions, as illustrated by the Sarah Palin webmail hack. But its argument that hackers bypassed rather than defeated its call verification technology in hacking into its chief exec account skirts the fact its systems were defeated.

Users in general are far more interested in whether a service does what it says on the tin than how individual components work.

The idea of a second hacking challenge is risky at best and pointless at worst. If StrongWebmail's systems are defeated for a second time it will end up looking a bit silly - and even if no one wins the second challenge, it doesn't follow that the system has become uncrackable. ®