Even My Mom Could Hack These Sites 233
I figured that if I wrote to them saying "I forgot my password, please mail it to me," that would be too obvious. Instead, at the time I had set up shop with these hosting companies, I entered a domain name at the time of creating my account, and asked them to register it on my behalf (long before I had this experiment in mind). Then when I wrote to them recently from my Hotmail address, I sent each of them a message saying: I need to transfer this domain somewhere else, can you give me the login at the registrar where you registered the domain, so I can change the domain settings. Five of the ten companies either (a) gave me the registrar login, (b) transferred the domain to my registrar account on request (even though I never provided any proof that the owner of that registrar account was really me, either), or (c) changed the domain to point to a new IP address that I specified -- all of which, of course, would allow an attacker to take over a site temporarily or even permanently, if it hadn't really been me writing from the Hotmail address.
But slow down before you go off to try this out on Yahoo, eBay or Google hoping to get the same 50% success rate. First, these were all low-budget hosting companies, so the people handling my queries were likely not highly trained professionals who would have developed all the right habits about when to get suspicious. Second, this ruse only worked because the hosting companies registered the domains on my behalf. Most sites that are really worth taking over, are hosted on dedicated servers, and this trick wouldn't work on a dedicated hosting company because they usually don't register domains on behalf of customers; they assume that anybody buying an expensive dedicated server, knows enough to buy the domain and point it at the server that the company gives them.
But even for small-time hosting, a 50% success rate for a trick like this is uncomfortably high. So what can we do about it? Well, every problem has a non-solution that requires changing human nature ("People should just stop buying from spammers and they'd go out of business!") and a non-solution that ignores the economics of the situation ("ISPs should devote more resources to stopping spammers on their own network!"). In this case, the corresponding non-solutions would be (a) "People who work for hosting companies should be less gullible" and (b) "ISPs should hire smarter people, without charging more to their hosting customers".
The solution that doesn't require any cheating, though, is to have procedures in place for anything remotely security-related, and drum into employees' heads that they have to follow those procedures. Here's some good news: Of the five companies that fell for the ruse asking for my registrar login information, when I followed up with them saying "Hey, I forgot my account password, can you mail it to me", only two of them actually sent my password to the Hotmail account. To those two, I replied with some terse words about having a six-inch-thick steel door while leaving the window wide open. But at least it was only two out of ten that fell for that ruse, compared to five out of ten that fell for the registrar trick. The difference is that hosting companies have procedures in place to deal with password resets -- a script that sends the existing password, or sends a reset-password link, only to the customer's e-mail address on file.
Similarly, any hosting company that registers domains on behalf of users, should have procedures in place for transferring the domains to users or letting them change domain settings. In fact, of the five companies that didn't fall for the ruse, most of them said "Go to the customer control panel here and log in" -- it wasn't that their guard went up because I was writing from a Hotmail account, it was that they already had procedures in place for a customer wanting to change domain settings, and what's what the idiot-proof book told them to do. Kevin Mitnick always said that the weakest link in any security chain was people. Sometimes the way for ISPs to tighten security is to make the people in the chain act more like machines.
Until then, there are probably many sites out there that are this easy to "hack", using a method that could charitably be called low-tech. After seeing which hosting companies fell for the trick, I pointed out that they had sent the login information to an unverified address and admonished them to be more careful in the future, but I didn't storm out vowing to take all of my business elsewhere -- after all, if 50% of all low-budget hosting companies out there fall for this, what would be the point?
The moral of the story is: (Score:5, Insightful)
Statistical sample (Score:5, Insightful)
Re:well what ISPs released the info? i want to avo (Score:3, Insightful)
Re:past mistakes (Score:3, Insightful)
passwords should be hashed (Score:5, Insightful)
Pick any two... (Score:5, Insightful)
It's probably easier than you think (Score:5, Insightful)
http://www.google.com/search?q=inurl%3Aadmin%3Dtr
I'm not attempting to start a flame-war here, but the percentage of those sites that end in ".php" is remarkably high...
Ah to hell with it, let the flames commence.
*runs*
Re:Statistical sample (Score:1, Insightful)
Re:past mistakes (Score:5, Insightful)
I did something like this once... (Score:5, Insightful)
uncomfortably high? (Score:5, Insightful)
It seems that the only thing "uncomfortably high" is the author. If real, a 50% failure rate is deplorable, to the point where it ought to have prompted some righteous moral outrage. This isn't just another intellectual exercise in social engineering, it's a failure of the system. It's equivalent to 5 out of 10 grocery stores accepting a check presented by someone not the account holder and with no signature on it. That sort of behavior wouldn't be socially tolerable, nor should this be.
If it is, in fact, a real event.
The author ought to be immediately forthcoming with the who, what, and when of his experiment if he really wants some serious consideration and feedback.
Re:well what ISPs released the info? i want to avo (Score:3, Insightful)
2: Ill gained PROFIT!!!
It is responsible of the poster to not reveal which companies have weaknesses he has discovered.
Re:past mistakes (Score:2, Insightful)
Social Engineering Expert... because there is no patch for human stupidity.
[/blatantly stolen]
You're a feminist? How cute! (Score:4, Insightful)
One swallow does not a summer make.
As long as there's far more tech-savvy men than women, the generalization by assuming a gender serves a useful purpose. Get your fellow sisters to become on average at least as tech-savvy as the average man, and then complain.
Note that men don't complain when allegories about the opposite sex are used. A statement like "His hands were typing at the speed of an old grandmother knitting" won't be met with outrage from men feeling offended because grandfathers could be knitting too.
Take your hardcore feminism elsewhere -- it doesn't belong on
parent is a troll (Score:5, Insightful)
Re:Am I wrong? (Score:3, Insightful)
I on the other hand have worked for a company where hosted sites payed upwards of $50.000 for the site and $500+ for hosting per month, we knew our customers and never had to consider such problems.
Both my friends company and the one I worked for had about the same number of people employed but we cater to different crowds - who is enterprise and who is small time?
Re:Statistical sample (Score:1, Insightful)
Re:well what ISPs released the info? i want to avo (Score:5, Insightful)
If this guy actually has 10 businesses or unique sites or whatever (unlikely), wouldn't you pick the one hosting service with the best service plan and just use it?
Re:well what ISPs released the info? i want to avo (Score:4, Insightful)
WARNING! WARNING! You are entering a ethical gray area in which arguments either way have valid points, please give this issue the respect it deserves and don't try to treat this like some cut-and-dry right-or-wrong answer.
I, for one, could put forward the argument that it is the responsibility of the poster to fully disclose to the public, (after first notifying the offenders and waiting a reasonable amount of time), so that those of us who are vulnerable to such a social engineering attack, can know about it and react accordingly.
Re:The moral of the story is: (Score:2, Insightful)
Sounds like a pretty crappy setup right from the start. You needed a better plan, bro, instead of being so damned greedy to take the customer's bucks. You did NOT plan for all contingencies, that's your fault. Sure, the customer is stupid. But you have to look out for them if you're doing business with them; that's YOUR responsibility, and that's why they paid you.
Just hand out their user name and password? That's dumb. And now YOU are part of the problem.
You can be absolutely sure I'll never do business with anyone like you.
And I _will_ sue whoever releases information like that.
Dumb asses.
Re:well what ISPs released the info? i want to avo (Score:2, Insightful)
Re:well what ISPs released the info? i want to avo (Score:3, Insightful)
Re:You're a feminist? How cute! (Score:4, Insightful)
While discrimination may be wrong, being overly sensitive to remarks that are true just raises the amount of discrimination and prejudice in the air. I don't know anyone that thinks women should be second class citizens, but I also know very few people who don't hate feminists.
Re:well what ISPs released the info? i want to avo (Score:3, Insightful)
Sounds like that's what he was doing (Score:4, Insightful)